Summary:


NtCallbackReturn(>) 
 1 
NtOpenProcessToken(>) 
 2 
NtQueryVirtualMemory(>) 
 9 
NtContinue(>) 
 101 

NtGdiCreateBitmap(>) 
 1 
NtOpenProcessTokenEx(>) 
 2 
NtSetInformationThread(>) 
 9 
NtOpenKey(>) 
 105 

NtGdiInit(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 
NtQuerySystemInformation(>) 
 125 

NtGdiQueryFontAssocInfo(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtOpenThreadToken(>) 
 10 
NtDuplicateObject(>) 
 191 

NtGdiSelectBitmap(>) 
 1 
NtSetInformationObject(>) 
 2 
NtQuerySection(>) 
 10 
NtTestAlert(>) 
 192 

NtOpenKeyedEvent(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtSetInformationFile(>) 
 10 
NtRegisterThreadTerminatePort(>) 
 194 

NtOpenSymbolicLinkObject(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtResumeThread(>) 
 206 

NtQueryObject(>) 
 1 
NtReadFile(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtQueryInformationThread(>) 
 209 

NtQueryPerformanceCounter(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtCreateFile(>) 
 15 
NtCreateThread(>) 
 214 

NtQuerySymbolicLinkObject(>) 
 1 
NtCreateIoCompletion(>) 
 4 
NtSetValueKey(>) 
 15 
NtQueryValueKey(>) 
 225 

NtQuerySystemTime(>) 
 1 
NtWriteFile(>) 
 4 
NtCreateKey(>) 
 19 
NtRequestWaitReplyPort(>) 
 242 

NtRaiseException(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtOpenFile(>) 
 19 
NtProtectVirtualMemory(>) 
 300 

NtSetInformationProcess(>) 
 1 
NtQueryInformationToken(>) 
 5 
NtOpenSection(>) 
 21 
NtClose(>) 
 301 

NtUserCallNoParam(>) 
 1 
NtConnectPort(>) 
 6 
NtQueryAttributesFile(>) 
 29 
NtSetEventBoostPriority(>) 
 496 

NtUserGetThreadDesktop(>) 
 1 
NtQueryInformationProcess(>) 
 6 
NtMapViewOfSection(>) 
 32 
NtAllocateVirtualMemory(>) 
 540 

NtCreateMutant(>) 
 2 
NtQueryVolumeInformationFile(>) 
 6 
NtDeviceIoControlFile(>) 
 36 
NtWaitForSingleObject(>) 
 803 

NtGdiCreateSolidBrush(>) 
 2 
NtFsControlFile(>) 
 8 
NtFlushInstructionCache(>) 
 43 

NtNotifyChangeKey(>) 
 2 
NtQueryInformationFile(>) 
 8 
NtCreateEvent(>) 
 67 

NtOpenDirectoryObject(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147481368, {status=0x0, info=1}, ) }, 0, 32, ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147481368, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147481368, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147481368, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147481368, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147481368, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147481368, 0, 0x0, 0x0, 0x90120,  (-2147481368, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147481480, ) == 0x0
 00059   896   NtClose  (-2147481480, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481480, ... -2147482136, ) == 0x0
 00061   896   NtClose  (-2147482136, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482136, ... -2147482748, ) == 0x0
 00063   896   NtClose  (-2147482748, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482748, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147481480, ... ) == 0x0
 00105   896   NtClose  (-2147482136, ... ) == 0x0
 00106   896   NtClose  (-2147482748, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147482748, ) == 0x0
 00145   896   NtClose  (-2147482748, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482748, ... -2147482136, ) == 0x0
 00147   896   NtClose  (-2147482136, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482136, ... -2147481480, ) == 0x0
 00149   896   NtClose  (-2147481480, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481480, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147482748, ... ) == 0x0
 00178   896   NtClose  (-2147482136, ... ) == 0x0
 00179   896   NtClose  (-2147481480, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147481368, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 94224, 4, ... (0x409000), 98304, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 98304, 128, ... (0x409000), 98304, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 94224, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x419010,}, 4, ... ) == 0x0
 00260   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00261   896   NtContinue  (1244400, 0, ...
 00262   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3276800, 4096, ) == 0x0
 00263   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00264   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtClose  (16, ... ) == 0x0
 00266   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00267   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00268   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00269   896   NtClose  (16, ... ) == 0x0
 00270   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00271   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00272   896   NtClose  (16, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00276   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00277   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00278   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00287   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00291   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00294   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00295   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00296   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00297   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00298   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00299   896   NtClose  (16, ... ) == 0x0
 00300   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00301   896   NtClose  (28, ... ) == 0x0
 00302   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00303   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00304   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00305   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00306   896   NtClose  (28, ... ) == 0x0
 00307   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00308   896   NtClose  (16, ... ) == 0x0
 00309   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00310   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00311   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00312   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00313   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00314   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00315   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00316   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00318   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00319   896   NtClose  (36, ... ) == 0x0
 00320   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00321   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00322   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00323   896   NtClose  (36, ... ) == 0x0
 00324   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   896   NtClose  (32, ... ) == 0x0
 00326   896   NtClose  (16, ... ) == 0x0
 00327   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00328   896   NtClose  (28, ... ) == 0x0
 00329   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00330   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00331   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00332   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00333   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00334   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00335   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00336   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00337   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00338   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00339   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00340   896   NtClose  (28, ... ) == 0x0
 00341   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00342   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00343   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00344   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00345   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00346   896   NtClose  (28, ... ) == 0x0
 00347   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00348   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00349   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00350   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00351   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00352   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00353   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00355   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00356   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00358   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00359   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00360   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00362   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00364   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00365   896   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00366   896   NtClose  (28, ... ) == 0x0
 00367   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00368   896   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00369   896   NtClose  (28, ... ) == 0x0
 00370   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00371   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00372   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00373   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00374   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00375   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00376   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00377   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00378   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00379   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00380   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 16, ) }, ... 16, ) == 0x0
 00381   896   NtQueryValueKey  (16,  (16, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   896   NtClose  (16, ... ) == 0x0
 00383   896   NtMapViewOfSection  (-2147481368, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x430000), 0x0, 1060864, ) == 0x0
 00384   896   NtClose  (-2147481368, ... ) == 0x0
 00385   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 16, ) == 0x0
 00386   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00387   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147481368, ) == 0x0
 00388   896   NtQueryInformationToken  (-2147481368, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00389   896   NtQueryInformationToken  (-2147481368, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00390   896   NtClose  (-2147481368, ... ) == 0x0
 00391   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5505024, 4096, ) == 0x0
 00392   896   NtFreeVirtualMemory  (-1, (0x540000), 4096, 32768, ... (0x540000), 4096, ) == 0x0
 00393   896   NtDuplicateObject  (-1, 32, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00394   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00395   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00396   896   NtClose  (-2147481368, ... ) == 0x0
 00397   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00398   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00399   896   NtClose  (-2147481368, ... ) == 0x0
 00400   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00401   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00402   896   NtUserCallNoParam  (24, ... ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  (0, ...
 00404   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5505024, 4096, ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00405   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00406   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00407   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00408   896   NtGdiCreateSolidBrush  (0, 0, ...
 00409   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8716288, 4096, ) == 0x0
 00408   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00410   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00411   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00412   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00413   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00414   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00415   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00416   896   NtClose  (44, ... ) == 0x0
 00417   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00418   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00419   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00420   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00421   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00422   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00423   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00424   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00425   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00426   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00427   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00428   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00429   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00430   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00431   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00432   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00433   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00434   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00435   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00436   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00437   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00438   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00439   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00440   896   NtCallbackReturn  (0, 0, 0, ...
 00441   896   NtGdiInit  (... ) == 0x1
 00442   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00443   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00444   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 8781824, 28672, ) == 0x0
 00445   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00447   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00448   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00449   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 48, ) == 0x0
 00450   896   NtQuerySection  (48, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00451   896   NtClose  (44, ... ) == 0x0
 00452   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00453   896   NtClose  (48, ... ) == 0x0
 00454   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 48, ) }, ... 48, ) == 0x0
 00455   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00456   896   NtClose  (48, ... ) == 0x0
 00457   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00458   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00459   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00460   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00461   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00462   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00463   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00465   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00466   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 48, {status=0x0, info=1}, ) }, 5, 96, ... 48, {status=0x0, info=1}, ) == 0x0
 00467   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 48, ... 44, ) == 0x0
 00468   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00469   896   NtClose  (48, ... ) == 0x0
 00470   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00471   896   NtClose  (44, ... ) == 0x0
 00472   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00473   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00474   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00475   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00476   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00477   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00478   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00479   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00480   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8847360, 65536, ) == 0x0
 00481   896   NtAllocateVirtualMemory  (-1, 8847360, 0, 4096, 4096, 4, ... 8847360, 4096, ) == 0x0
 00482   896   NtAllocateVirtualMemory  (-1, 8851456, 0, 8192, 4096, 4, ... 8851456, 8192, ) == 0x0
 00483   896   NtAllocateVirtualMemory  (-1, 8859648, 0, 4096, 4096, 4, ... 8859648, 4096, ) == 0x0
 00484   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00485   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x880000), 0x0, 12288, ) == 0x0
 00486   896   NtClose  (44, ... ) == 0x0
 00487   896   NtAllocateVirtualMemory  (-1, 8863744, 0, 4096, 4096, 4, ... 8863744, 4096, ) == 0x0
 00488   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00489   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00490   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00491   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00492   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00493   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00495   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00496   896   NtFreeVirtualMemory  (-1, (0x860000), 0, 32768, ... (0x860000), 28672, ) == 0x0
 00497   896   NtFreeVirtualMemory  (-1, (0x320144), 0, 32768, ... (0x320000), 4096, ) == 0x0
 00498   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00499   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00500   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00501   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 20480, 4096, 4, ... 3280896, 20480, ) == 0x0
 00502   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8978432, 1048576, ) == 0x0
 00503   896   NtAllocateVirtualMemory  (-1, 8978432, 0, 32768, 4096, 4, ... 8978432, 32768, ) == 0x0
 00504   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00505   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "Jobaka3"}, 0, ... 48, ) }, 0, ... 48, ) == 0x0
 00506   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00507   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00508   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00509   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00510   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Protocol_Catalog9"}, ... 60, ) }, ... 60, ) == 0x0
 00511   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00512   896   NtNotifyChangeKey  (60, 56, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00513   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00514   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00515   896   NtQueryValueKey  (60,  (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 00516   896   NtQueryValueKey  (60,  (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 00517   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Catalog_Entries"}, ... 64, ) }, ... 64, ) == 0x0
 00518   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00519   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000001"}, ... 68, ) }, ... 68, ) == 0x0
 00520   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00521   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00522   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00523   896   NtClose  (68, ... ) == 0x0
 00524   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000002"}, ... 68, ) }, ... 68, ) == 0x0
 00525   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00526   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00527   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00528   896   NtClose  (68, ... ) == 0x0
 00529   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000003"}, ... 68, ) }, ... 68, ) == 0x0
 00530   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00531   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00532   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00533   896   NtClose  (68, ... ) == 0x0
 00534   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000004"}, ... 68, ) }, ... 68, ) == 0x0
 00535   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00536   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00537   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00538   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00539   896   NtClose  (68, ... ) == 0x0
 00540   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000005"}, ... 68, ) }, ... 68, ) == 0x0
 00541   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00542   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00543   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00544   896   NtClose  (68, ... ) == 0x0
 00545   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000006"}, ... 68, ) }, ... 68, ) == 0x0
 00546   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00547   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00548   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00549   896   NtClose  (68, ... ) == 0x0
 00550   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000007"}, ... 68, ) }, ... 68, ) == 0x0
 00551   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00552   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00553   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00554   896   NtClose  (68, ... ) == 0x0
 00555   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000008"}, ... 68, ) }, ... 68, ) == 0x0
 00556   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00557   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00558   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00559   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00560   896   NtClose  (68, ... ) == 0x0
 00561   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000009"}, ... 68, ) }, ... 68, ) == 0x0
 00562   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00563   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00564   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00565   896   NtClose  (68, ... ) == 0x0
 00566   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000010"}, ... 68, ) }, ... 68, ) == 0x0
 00567   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00568   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00569   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00570   896   NtClose  (68, ... ) == 0x0
 00571   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000011"}, ... 68, ) }, ... 68, ) == 0x0
 00572   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00573   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00574   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00575   896   NtClose  (68, ... ) == 0x0
 00576   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000012"}, ... 68, ) }, ... 68, ) == 0x0
 00577   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00578   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00579   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00580   896   NtClose  (68, ... ) == 0x0
 00581   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000013"}, ... 68, ) }, ... 68, ) == 0x0
 00582   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00583   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00584   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00585   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00586   896   NtClose  (68, ... ) == 0x0
 00587   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000014"}, ... 68, ) }, ... 68, ) == 0x0
 00588   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00589   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00590   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00591   896   NtClose  (68, ... ) == 0x0
 00592   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000015"}, ... 68, ) }, ... 68, ) == 0x0
 00593   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00594   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00595   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00596   896   NtClose  (68, ... ) == 0x0
 00597   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000016"}, ... 68, ) }, ... 68, ) == 0x0
 00598   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00599   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00600   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00601   896   NtClose  (68, ... ) == 0x0
 00602   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000017"}, ... 68, ) }, ... 68, ) == 0x0
 00603   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00604   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00605   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00606   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00607   896   NtClose  (68, ... ) == 0x0
 00608   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000018"}, ... 68, ) }, ... 68, ) == 0x0
 00609   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00610   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00611   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00612   896   NtClose  (68, ... ) == 0x0
 00613   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000019"}, ... 68, ) }, ... 68, ) == 0x0
 00614   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00615   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00616   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00617   896   NtClose  (68, ... ) == 0x0
 00618   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000020"}, ... 68, ) }, ... 68, ) == 0x0
 00619   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00620   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00622   896   NtClose  (68, ... ) == 0x0
 00623   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000021"}, ... 68, ) }, ... 68, ) == 0x0
 00624   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00625   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00627   896   NtClose  (68, ... ) == 0x0
 00628   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000022"}, ... 68, ) }, ... 68, ) == 0x0
 00629   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00630   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00632   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 00633   896   NtClose  (68, ... ) == 0x0
 00634   896   NtClose  (64, ... ) == 0x0
 00635   896   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00636   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00637   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 68, ) }, ... 68, ) == 0x0
 00638   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00639   896   NtNotifyChangeKey  (68, 64, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00640   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00641   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00642   896   NtQueryValueKey  (68,  (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00643   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "Catalog_Entries"}, ... 72, ) }, ... 72, ) == 0x0
 00644   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000001"}, ... 76, ) }, ... 76, ) == 0x0
 00645   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00646   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00647   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00648   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00649   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00650   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00651   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00652   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00653   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00654   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00655   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00656   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00657   896   NtClose  (76, ... ) == 0x0
 00658   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000002"}, ... 76, ) }, ... 76, ) == 0x0
 00659   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00660   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00661   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00662   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00663   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00664   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00665   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00666   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00668   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00669   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00670   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00671   896   NtClose  (76, ... ) == 0x0
 00672   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000003"}, ... 76, ) }, ... 76, ) == 0x0
 00673   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00674   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00675   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00676   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00677   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00678   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00679   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00680   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00681   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00682   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00684   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   896   NtClose  (76, ... ) == 0x0
 00686   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000004"}, ... 76, ) }, ... 76, ) == 0x0
 00687   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00688   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00689   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00690   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00691   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00692   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00693   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 00694   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00695   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 00696   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   896   NtClose  (76, ... ) == 0x0
 00700   896   NtClose  (72, ... ) == 0x0
 00701   896   NtWaitForSingleObject  (64, 0, {0, 0}, ... ) == 0x102
 00702   896   NtClose  (52, ... ) == 0x0
 00703   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00704   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00705   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00706   896   NtQueryValueKey  (52,  (52, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00707   896   NtClose  (52, ... ) == 0x0
 00708   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00709   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 52, ) == 0x0
 00710   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) == 0x0
 00711   896   NtQueryInformationFile  (72, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 00712   896   NtQueryInformationFile  (72, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00713   896   NtQueryInformationFile  (72, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00714   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 8192, 4096, 4, ... 1359872, 8192, ) == 0x0
 00715   896   NtQueryInformationFile  (72, 1355896, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 00716   896   NtQueryInformationFile  (72, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00717   896   NtQueryInformationFile  (72, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 00718   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 00719   896   NtClose  (-2147481368, ... ) == 0x0
 00718   896   NtCreateFile  ... 76, {status=0x0, info=2}, ) == 0x0
 00720   896   NtQueryVolumeInformationFile  (76, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00721   896   NtQueryInformationFile  (76, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00722   896   NtQueryVolumeInformationFile  (72, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00723   896   NtQueryVolumeInformationFile  (72, 1239912, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00724   896   NtSetInformationFile  (76, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00725   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 72, ... 80, ) == 0x0
 00726   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x990000), {0, 0}, 90112, ) == 0x0
 00727   896   NtClose  (80, ... ) == 0x0
 00728   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0    \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0d\347\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 00729   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24592, 0x0, 0, ... {status=0x0, info=24592}, ) , 24592, 0x0, 0, ... {status=0x0, info=24592}, ) == 0x0
 00730   896   NtUnmapViewOfSection  (-1, 0x990000, ... ) == 0x0
 00731   896   NtSetInformationFile  (76, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 00732   896   NtClose  (72, ... ) == 0x0
 00733   896   NtClose  (76, ... ) == 0x0
 00734   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 76, ) }, ... 76, ) == 0x0
 00735   896   NtSetValueKey  (76,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 00736   896   NtSetInformationFile  (-2147482448, -135747792, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00737   896   NtSetInformationFile  (-2147482448, -135747884, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00738   896   NtSetInformationFile  (-2147482448, -135748192, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00739   896   NtSetInformationFile  (-2147482448, -135748288, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00735   896   NtSetValueKey  ... ) == 0x0
 00740   896   NtClose  (76, ... ) == 0x0
 00741   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 76, ) }, 0, ... 76, ) == 0x0
 00742   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10027008, 1048576, ) == 0x0
 00743   896   NtAllocateVirtualMemory  (-1, 11067392, 0, 8192, 4096, 4, ... 11067392, 8192, ) == 0x0
 00744   896   NtProtectVirtualMemory  (-1, (0xa8e000), 4096, 260, ... (0xa8e000), 4096, 4, ) == 0x0
 00745   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 72, {1252, 2016}, ) == 0x0
 00746   896   NtQueryInformationThread  (72, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00747   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81835, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00748   896   NtResumeThread  (72, ... 1, ) == 0x0
 00749  2016   NtTestAlert  (... ) == 0x0
 00750  2016   NtContinue  (11074864, 1, ...
 00751  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00752  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 80, ) == 0x0
 00753  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00754  2016   NtAllocateVirtualMemory  (-1, 11063296, 0, 4096, 4096, 260, ...
 00755   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11075584, 1048576, ) == 0x0
 00756   896   NtAllocateVirtualMemory  (-1, 12115968, 0, 8192, 4096, 4, ... 12115968, 8192, ) == 0x0
 00757   896   NtProtectVirtualMemory  (-1, (0xb8e000), 4096, 260, ... (0xb8e000), 4096, 4, ) == 0x0
 00758   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 84, {1252, 596}, ) == 0x0
 00759   896   NtQueryInformationThread  (84, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=596,}, 0x0, ) == 0x0
 00760   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81835, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81835, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ...  ...
 00754  2016   NtAllocateVirtualMemory  ... 11063296, 4096, ) == 0x0
 00761  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11071988, ... ) }, 11071988, ... ) == 0x0
 00762  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00763  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 88, ...
 00760   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81836, 0}  ... {28, 56, reply, 0, 1252, 896, 81836, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ) == 0x0
 00764   896   NtResumeThread  (84, ... 1, ) == 0x0
 00765   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 12124160, 1048576, ) == 0x0
 00766   896   NtAllocateVirtualMemory  (-1, 13164544, 0, 8192, 4096, 4, ... 13164544, 8192, ) == 0x0
 00767   896   NtProtectVirtualMemory  (-1, (0xc8e000), 4096, 260, ... (0xc8e000), 4096, 4, ) == 0x0
 00768   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 92, {1252, 376}, ) == 0x0
 00769   896   NtQueryInformationThread  (92, Basic, 28, ...
 00763  2016   NtCreateSection  ... 96, ) == 0x0
 00770   596   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00771  2016   NtClose  (88, ...
 00770   596   NtCreateEvent  ... 100, ) == 0x0
 00771  2016   NtClose  ... ) == 0x0
 00772   596   NtWaitForSingleObject  (100, 0, 0x0, ...
 00773  2016   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xc90000), 0x0, 245760, ) == 0x0
 00774  2016   NtClose  (96, ... ) == 0x0
 00769   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=376,}, 0x0, ) == 0x0
 00775   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81836, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81836, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81836, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" )  ) == 0x0
 00776   896   NtResumeThread  (92, ... 1, ) == 0x0
 00777  2016   NtUnmapViewOfSection  (-1, 0xc90000, ...
 00778   376   NtWaitForSingleObject  (100, 0, 0x0, ...
 00777  2016   NtUnmapViewOfSection  ... ) == 0x0
 00779  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11072296, ... ) }, 11072296, ... ) == 0x0
 00780  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00781  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ... 88, ) == 0x0
 00782  2016   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00783  2016   NtClose  (96, ... ) == 0x0
 00784   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13172736, 1048576, ) == 0x0
 00785   896   NtAllocateVirtualMemory  (-1, 14213120, 0, 8192, 4096, 4, ... 14213120, 8192, ) == 0x0
 00786   896   NtProtectVirtualMemory  (-1, (0xd8e000), 4096, 260, ... (0xd8e000), 4096, 4, ) == 0x0
 00787   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 96, {1252, 420}, ) == 0x0
 00788   896   NtQueryInformationThread  (96, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=420,}, 0x0, ) == 0x0
 00789   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\244\1\0\0" ...  ...
 00790  2016   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 00791  2016   NtClose  (88, ... ) == 0x0
 00792  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00789   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81838, 0}  ... {28, 56, reply, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\244\1\0\0" )  ) == 0x0
 00793   896   NtResumeThread  (96, ... 1, ) == 0x0
 00794   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14221312, 1048576, ) == 0x0
 00795   896   NtAllocateVirtualMemory  (-1, 15261696, 0, 8192, 4096, 4, ... 15261696, 8192, ) == 0x0
 00796   896   NtProtectVirtualMemory  (-1, (0xe8e000), 4096, 260, ... (0xe8e000), 4096, 4, ) == 0x0
 00797   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 88, {1252, 384}, ) == 0x0
 00798   896   NtQueryInformationThread  (88, Basic, 28, ...
 00799  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ...
 00800   420   NtWaitForSingleObject  (100, 0, 0x0, ...
 00799  2016   NtProtectVirtualMemory  ... (0x71a51000), 4096, 4, ) == 0x0
 00801  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00802  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00803  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00804  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00798   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 00805   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 00806   896   NtResumeThread  (88, ... 1, ) == 0x0
 00807   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15269888, 1048576, ) == 0x0
 00808   896   NtAllocateVirtualMemory  (-1, 16310272, 0, 8192, 4096, 4, ... 16310272, 8192, ) == 0x0
 00809   896   NtProtectVirtualMemory  (-1, (0xf8e000), 4096, 260, ... (0xf8e000), 4096, 4, ) == 0x0
 00810  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 00811   384   NtWaitForSingleObject  (100, 0, 0x0, ...
 00810  2016   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 00812  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00813  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00814   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 104, {1252, 1028}, ) == 0x0
 00815   896   NtQueryInformationThread  (104, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 00816   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\4\4\0\0" ...  ...
 00817  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00818  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00816   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81840, 0}  ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 00819   896   NtResumeThread  (104, ... 1, ) == 0x0
 00820   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 16318464, 1048576, ) == 0x0
 00821   896   NtAllocateVirtualMemory  (-1, 17358848, 0, 8192, 4096, 4, ... 17358848, 8192, ) == 0x0
 00822   896   NtProtectVirtualMemory  (-1, (0x108e000), 4096, 260, ... (0x108e000), 4096, 4, ) == 0x0
 00823   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 108, {1252, 2012}, ) == 0x0
 00824   896   NtQueryInformationThread  (108, Basic, 28, ...
 00825  2016   NtQuerySystemInformation  (Processor, 12, ...
 00826  1028   NtWaitForSingleObject  (100, 0, 0x0, ...
 00825  2016   NtQuerySystemInformation  ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00827  2016   NtSetEventBoostPriority  (100, ...
 00772   596   NtWaitForSingleObject  ... ) == 0x0
 00828   596   NtSetEventBoostPriority  (100, ...
 00778   376   NtWaitForSingleObject  ... ) == 0x0
 00829   376   NtSetEventBoostPriority  (100, ...
 00800   420   NtWaitForSingleObject  ... ) == 0x0
 00830   420   NtSetEventBoostPriority  (100, ...
 00811   384   NtWaitForSingleObject  ... ) == 0x0
 00831   384   NtSetEventBoostPriority  (100, ...
 00826  1028   NtWaitForSingleObject  ... ) == 0x0
 00832  1028   NtTestAlert  (... ) == 0x0
 00831   384   NtSetEventBoostPriority  ... ) == 0x0
 00830   420   NtSetEventBoostPriority  ... ) == 0x0
 00829   376   NtSetEventBoostPriority  ... ) == 0x0
 00828   596   NtSetEventBoostPriority  ... ) == 0x0
 00827  2016   NtSetEventBoostPriority  ... ) == 0x0
 00824   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 00833  1028   NtContinue  (16317744, 1, ...
 00834   384   NtTestAlert  (...
 00835   420   NtTestAlert  (...
 00836   376   NtTestAlert  (...
 00837  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00838   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\0\0\0\344\4\0\0\334\7\0\0" ...  ...
 00839  1028   NtRegisterThreadTerminatePort  (24, ...
 00834   384   NtTestAlert  ... ) == 0x0
 00835   420   NtTestAlert  ... ) == 0x0
 00836   376   NtTestAlert  ... ) == 0x0
 00837  2016   NtCreateEvent  ... 112, ) == 0x0
 00838   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\0\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 00839  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 00840   384   NtContinue  (15269168, 1, ...
 00841   420   NtContinue  (14220592, 1, ...
 00842   376   NtContinue  (13172016, 1, ...
 00843   596   NtTestAlert  (...
 00844   896   NtResumeThread  (108, ...
 00845  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00846   384   NtRegisterThreadTerminatePort  (24, ...
 00847   420   NtRegisterThreadTerminatePort  (24, ...
 00848   376   NtRegisterThreadTerminatePort  (24, ...
 00843   596   NtTestAlert  ... ) == 0x0
 00844   896   NtResumeThread  ... 1, ) == 0x0
 00845  1028   NtDuplicateObject  ... 116, ) == 0x0
 00846   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 00847   420   NtRegisterThreadTerminatePort  ... ) == 0x0
 00848   376   NtRegisterThreadTerminatePort  ... ) == 0x0
 00849   596   NtContinue  (12123440, 1, ...
 00850  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 00851  2012   NtWaitForSingleObject  (100, 0, 0x0, ...
 00852  1028   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00853   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00854   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00855   376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00856   596   NtRegisterThreadTerminatePort  (24, ...
 00850  2016   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00857   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00852  1028   NtWaitForSingleObject  ... ) == 0x102
 00853   384   NtDuplicateObject  ... 120, ) == 0x0
 00854   420   NtDuplicateObject  ... 124, ) == 0x0
 00856   596   NtRegisterThreadTerminatePort  ... ) == 0x0
 00858  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11071908, ... }, 11071908, ...
 00857   896   NtAllocateVirtualMemory  ... 17367040, 1048576, ) == 0x0
 00859  1028   NtAllocateVirtualMemory  (-1, 16306176, 0, 4096, 4096, 260, ...
 00860   384   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00861   420   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00862   596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00863   896   NtAllocateVirtualMemory  (-1, 18407424, 0, 8192, 4096, 4, ...
 00859  1028   NtAllocateVirtualMemory  ... 16306176, 4096, ) == 0x0
 00860   384   NtWaitForSingleObject  ... ) == 0x102
 00861   420   NtWaitForSingleObject  ... ) == 0x102
 00855   376   NtDuplicateObject  ... 128, ) == 0x0
 00863   896   NtAllocateVirtualMemory  ... 18407424, 8192, ) == 0x0
 00864  1028   NtWaitForSingleObject  (100, 0, 0x0, ...
 00865   384   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00866   420   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00867   376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00868   896   NtProtectVirtualMemory  (-1, (0x118e000), 4096, 260, ...
 00865   384   NtCreateEvent  ... 132, ) == 0x0
 00866   420   NtCreateEvent  ... 136, ) == 0x0
 00867   376   NtWaitForSingleObject  ... ) == 0x102
 00868   896   NtProtectVirtualMemory  ... (0x118e000), 4096, 4, ) == 0x0
 00862   596   NtDuplicateObject  ... 140, ) == 0x0
 00869   384   NtWaitForSingleObject  (132, 0, 0x0, ...
 00870   376   NtWaitForSingleObject  (132, 0, 0x0, ...
 00871   420   NtClose  (136, ...
 00872   596   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00871   420   NtClose  ... ) == 0x0
 00872   596   NtWaitForSingleObject  ... ) == 0x102
 00873   420   NtWaitForSingleObject  (132, 0, 0x0, ...
 00874   596   NtWaitForSingleObject  (132, 0, 0x0, ...
 00875   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 136, {1252, 1168}, ) == 0x0
 00876   896   NtQueryInformationThread  (136, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 00877   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\220\4\0\0" ...  ...
 00858  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00878  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11071908, ... ) }, 11071908, ... ) == 0x0
 00879  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... 144, {status=0x0, info=1}, ) }, 5, 96, ... 144, {status=0x0, info=1}, ) == 0x0
 00880  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 144, ...
 00877   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81842, 0}  ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 00881   896   NtResumeThread  (136, ... 1, ) == 0x0
 00882   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18415616, 1048576, ) == 0x0
 00883   896   NtAllocateVirtualMemory  (-1, 19456000, 0, 8192, 4096, 4, ... 19456000, 8192, ) == 0x0
 00884   896   NtProtectVirtualMemory  (-1, (0x128e000), 4096, 260, ... (0x128e000), 4096, 4, ) == 0x0
 00885   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00880  2016   NtCreateSection  ... 148, ) == 0x0
 00886  2016   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00887  2016   NtClose  (144, ... ) == 0x0
 00888  2016   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 00889  1168   NtWaitForSingleObject  (100, 0, 0x0, ...
 00885   896   NtCreateThread  ... 144, {1252, 1180}, ) == 0x0
 00890   896   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 00891   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 00892   896   NtResumeThread  (144, ... 1, ) == 0x0
 00893   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19464192, 1048576, ) == 0x0
 00894   896   NtAllocateVirtualMemory  (-1, 20504576, 0, 8192, 4096, 4, ... 20504576, 8192, ) == 0x0
 00888  2016   NtMapViewOfSection  ... (0x662b0000), 0x0, 360448, ) == 0x0
 00895  1180   NtWaitForSingleObject  (100, 0, 0x0, ...
 00896  2016   NtClose  (148, ... ) == 0x0
 00897  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00898  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00899  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00900  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00901  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 00902   896   NtProtectVirtualMemory  (-1, (0x138e000), 4096, 260, ... (0x138e000), 4096, 4, ) == 0x0
 00903   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 148, {1252, 928}, ) == 0x0
 00904   896   NtQueryInformationThread  (148, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 00905   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\240\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 00906   896   NtResumeThread  (148, ... 1, ) == 0x0
 00907   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00901  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 00908   928   NtWaitForSingleObject  (100, 0, 0x0, ...
 00909  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00910  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00911  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00912  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00913  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00914  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 00907   896   NtAllocateVirtualMemory  ... 20512768, 1048576, ) == 0x0
 00915   896   NtAllocateVirtualMemory  (-1, 21553152, 0, 8192, 4096, 4, ... 21553152, 8192, ) == 0x0
 00916   896   NtProtectVirtualMemory  (-1, (0x148e000), 4096, 260, ... (0x148e000), 4096, 4, ) == 0x0
 00917   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 152, {1252, 428}, ) == 0x0
 00918   896   NtQueryInformationThread  (152, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 00919   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 00914  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 00920  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00921  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00922  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00923  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00924  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00925  2016   NtSetEventBoostPriority  (100, ...
 00926   896   NtResumeThread  (152, ... 1, ) == 0x0
 00927   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21561344, 1048576, ) == 0x0
 00928   896   NtAllocateVirtualMemory  (-1, 22601728, 0, 8192, 4096, 4, ... 22601728, 8192, ) == 0x0
 00929   896   NtProtectVirtualMemory  (-1, (0x158e000), 4096, 260, ... (0x158e000), 4096, 4, ) == 0x0
 00930   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 156, {1252, 1732}, ) == 0x0
 00931   896   NtQueryInformationThread  (156, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 00851  2012   NtWaitForSingleObject  ... ) == 0x0
 00925  2016   NtSetEventBoostPriority  ... ) == 0x0
 00932   428   NtWaitForSingleObject  (100, 0, 0x0, ...
 00933  2012   NtSetEventBoostPriority  (100, ...
 00934  2016   NtWaitForSingleObject  (100, 0, 0x0, ...
 00864  1028   NtWaitForSingleObject  ... ) == 0x0
 00933  2012   NtSetEventBoostPriority  ... ) == 0x0
 00935  1028   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 16313296, ... }, 16313296, ...
 00936   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\0\0\0\344\4\0\0\304\6\0\0" ...  ...
 00935  1028   NtQueryAttributesFile  ... ) == 0x0
 00936   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\0\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 00937  2012   NtTestAlert  (...
 00938   896   NtResumeThread  (156, ...
 00937  2012   NtTestAlert  ... ) == 0x0
 00938   896   NtResumeThread  ... 1, ) == 0x0
 00939  2012   NtContinue  (17366320, 1, ...
 00940   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00941  2012   NtRegisterThreadTerminatePort  (24, ...
 00942  1028   NtSetEventBoostPriority  (100, ...
 00943  1732   NtWaitForSingleObject  (100, 0, 0x0, ...
 00941  2012   NtRegisterThreadTerminatePort  ... ) == 0x0
 00889  1168   NtWaitForSingleObject  ... ) == 0x0
 00942  1028   NtSetEventBoostPriority  ... ) == 0x0
 00944  1168   NtSetEventBoostPriority  (100, ...
 00945  2012   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00895  1180   NtWaitForSingleObject  ... ) == 0x0
 00944  1168   NtSetEventBoostPriority  ... ) == 0x0
 00946  1028   NtWaitForSingleObject  (100, 0, 0x0, ...
 00940   896   NtAllocateVirtualMemory  ... 22609920, 1048576, ) == 0x0
 00947  1180   NtSetEventBoostPriority  (100, ...
 00945  2012   NtDuplicateObject  ... 160, ) == 0x0
 00908   928   NtWaitForSingleObject  ... ) == 0x0
 00947  1180   NtSetEventBoostPriority  ... ) == 0x0
 00948   896   NtAllocateVirtualMemory  (-1, 23650304, 0, 8192, 4096, 4, ...
 00949   928   NtSetEventBoostPriority  (100, ...
 00950  2012   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00951  1168   NtTestAlert  (...
 00932   428   NtWaitForSingleObject  ... ) == 0x0
 00949   928   NtSetEventBoostPriority  ... ) == 0x0
 00948   896   NtAllocateVirtualMemory  ... 23650304, 8192, ) == 0x0
 00950  2012   NtWaitForSingleObject  ... ) == 0x102
 00952   428   NtSetEventBoostPriority  (100, ...
 00951  1168   NtTestAlert  ... ) == 0x0
 00953  1180   NtTestAlert  (...
 00954   896   NtProtectVirtualMemory  (-1, (0x168e000), 4096, 260, ...
 00934  2016   NtWaitForSingleObject  ... ) == 0x0
 00952   428   NtSetEventBoostPriority  ... ) == 0x0
 00955  2012   NtWaitForSingleObject  (132, 0, 0x0, ...
 00956  1168   NtContinue  (18414896, 1, ...
 00953  1180   NtTestAlert  ... ) == 0x0
 00957  2016   NtSetEventBoostPriority  (100, ...
 00954   896   NtProtectVirtualMemory  ... (0x168e000), 4096, 4, ) == 0x0
 00958   928   NtTestAlert  (...
 00959  1168   NtRegisterThreadTerminatePort  (24, ...
 00943  1732   NtWaitForSingleObject  ... ) == 0x0
 00957  2016   NtSetEventBoostPriority  ... ) == 0x0
 00960  1180   NtContinue  (19463472, 1, ...
 00961   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00958   928   NtTestAlert  ... ) == 0x0
 00962  1732   NtSetEventBoostPriority  (100, ...
 00959  1168   NtRegisterThreadTerminatePort  ... ) == 0x0
 00963   428   NtTestAlert  (...
 00964  1180   NtRegisterThreadTerminatePort  (24, ...
 00965  2016   NtWaitForSingleObject  (100, 0, 0x0, ...
 00946  1028   NtWaitForSingleObject  ... ) == 0x0
 00962  1732   NtSetEventBoostPriority  ... ) == 0x0
 00966   928   NtContinue  (20512048, 1, ...
 00967  1168   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00963   428   NtTestAlert  ... ) == 0x0
 00964  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 00968  1028   NtSetEventBoostPriority  (100, ...
 00961   896   NtCreateThread  ... 164, {1252, 748}, ) == 0x0
 00969   928   NtRegisterThreadTerminatePort  (24, ...
 00970  1732   NtTestAlert  (...
 00971   428   NtContinue  (21560624, 1, ...
 00965  2016   NtWaitForSingleObject  ... ) == 0x0
 00968  1028   NtSetEventBoostPriority  ... ) == 0x0
 00972  1180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00973   896   NtQueryInformationThread  (164, Basic, 28, ...
 00969   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 00970  1732   NtTestAlert  ... ) == 0x0
 00974  2016   NtQuerySystemInformation  (Basic, 44, ...
 00975   428   NtRegisterThreadTerminatePort  (24, ...
 00967  1168   NtDuplicateObject  ... 168, ) == 0x0
 00976  1028   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00973   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 00977   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00974  2016   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00978  1732   NtContinue  (22609200, 1, ...
 00975   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 00979  1168   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00976  1028   NtCreateEvent  ... 172, ) == 0x0
 00980   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\354\2\0\0" ...  ...
 00972  1180   NtDuplicateObject  ... 176, ) == 0x0
 00981  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... }, ...
 00982  1732   NtRegisterThreadTerminatePort  (24, ...
 00983   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00979  1168   NtWaitForSingleObject  ... ) == 0x102
 00984  1028   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 00980   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81847, 0}  ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 00985  1180   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00977   928   NtDuplicateObject  ... 180, ) == 0x0
 00982  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 00981  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00986  1168   NtWaitForSingleObject  (132, 0, 0x0, ...
 00984  1028   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00983   428   NtDuplicateObject  ... 184, ) == 0x0
 00985  1180   NtWaitForSingleObject  ... ) == 0x102
 00987   928   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00988  1732   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00989  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... }, ...
 00990  1028   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 16313400, ... }, 16313400, ...
 00991   428   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00992  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 00987   928   NtWaitForSingleObject  ... ) == 0x102
 00993   896   NtResumeThread  (164, ...
 00989  2016   NtOpenKey  ... 188, ) == 0x0
 00991   428   NtWaitForSingleObject  ... ) == 0x102
 00994   928   NtWaitForSingleObject  (132, 0, 0x0, ...
 00993   896   NtResumeThread  ... 1, ) == 0x0
 00995  2016   NtQueryValueKey  (188,  (188, "MaxRpcSize", Partial, 144, ... , Partial, 144, ...
 00996   428   NtWaitForSingleObject  (132, 0, 0x0, ...
 00997   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00995  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00997   896   NtAllocateVirtualMemory  ... 23658496, 1048576, ) == 0x0
 00998  2016   NtClose  (188, ...
 00999   896   NtAllocateVirtualMemory  (-1, 24698880, 0, 8192, 4096, 4, ...
 00988  1732   NtDuplicateObject  ... 192, ) == 0x0
 01000   748   NtWaitForSingleObject  (100, 0, 0x0, ...
 00999   896   NtAllocateVirtualMemory  ... 24698880, 8192, ) == 0x0
 01001  1732   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00998  2016   NtClose  ... ) == 0x0
 01001  1732   NtWaitForSingleObject  ... ) == 0x102
 01002  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... }, ...
 01003  1732   NtWaitForSingleObject  (132, 0, 0x0, ...
 01002  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01004  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 188, ) == 0x0
 01005  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 196, ) == 0x0
 01006  2016   NtQuerySystemTime  (... {1417735414, 29929616}, ) == 0x0
 01007  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 200, ) == 0x0
 01008  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... }, ...
 01009   896   NtProtectVirtualMemory  (-1, (0x178e000), 4096, 260, ... (0x178e000), 4096, 4, ) == 0x0
 01010   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 204, {1252, 900}, ) == 0x0
 01011   896   NtQueryInformationThread  (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 01012   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 01013   896   NtResumeThread  (204, ... 1, ) == 0x0
 01014   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01008  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015   900   NtWaitForSingleObject  (100, 0, 0x0, ...
 01016  2016   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01017  2016   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01018  2016   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01019  2016   NtWaitForSingleObject  (100, 0, 0x0, ...
 01014   896   NtAllocateVirtualMemory  ... 24707072, 1048576, ) == 0x0
 01020   896   NtAllocateVirtualMemory  (-1, 25747456, 0, 8192, 4096, 4, ... 25747456, 8192, ) == 0x0
 01021   896   NtProtectVirtualMemory  (-1, (0x188e000), 4096, 260, ... (0x188e000), 4096, 4, ) == 0x0
 01022   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00990  1028   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01023  1028   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 16313400, ... ) }, 16313400, ... ) == 0x0
 01024  1028   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... 208, {status=0x0, info=1}, ) }, 5, 96, ... 208, {status=0x0, info=1}, ) == 0x0
 01025  1028   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 208, ... 212, ) == 0x0
 01026  1028   NtQuerySection  (212, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01027  1028   NtClose  (208, ...
 01022   896   NtCreateThread  ... 216, {1252, 1388}, ) == 0x0
 01028   896   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 01029   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0l\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 01030   896   NtResumeThread  (216, ... 1, ) == 0x0
 01031   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25755648, 1048576, ) == 0x0
 01032   896   NtAllocateVirtualMemory  (-1, 26796032, 0, 8192, 4096, 4, ... 26796032, 8192, ) == 0x0
 01027  1028   NtClose  ... ) == 0x0
 01033  1388   NtWaitForSingleObject  (100, 0, 0x0, ...
 01034  1028   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 01035  1028   NtClose  (212, ... ) == 0x0
 01036  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01037  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01038  1028   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01039  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ...
 01040   896   NtProtectVirtualMemory  (-1, (0x198e000), 4096, 260, ... (0x198e000), 4096, 4, ) == 0x0
 01041   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 212, {1252, 2036}, ) == 0x0
 01042   896   NtQueryInformationThread  (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 01043   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\364\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 01044   896   NtResumeThread  (212, ... 1, ) == 0x0
 01045   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01039  1028   NtProtectVirtualMemory  ... (0x76f21000), 4096, 32, ) == 0x0
 01046  2036   NtWaitForSingleObject  (100, 0, 0x0, ...
 01047  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01048  1028   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01049  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01050  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01051  1028   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01052  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ...
 01045   896   NtAllocateVirtualMemory  ... 26804224, 1048576, ) == 0x0
 01053   896   NtAllocateVirtualMemory  (-1, 27844608, 0, 8192, 4096, 4, ... 27844608, 8192, ) == 0x0
 01054   896   NtProtectVirtualMemory  (-1, (0x1a8e000), 4096, 260, ... (0x1a8e000), 4096, 4, ) == 0x0
 01055   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 208, {1252, 1372}, ) == 0x0
 01056   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 01052  1028   NtProtectVirtualMemory  ... (0x76f21000), 4096, 32, ) == 0x0
 01057  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01058  1028   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01059  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01060  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01061  1028   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01062  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ...
 01063   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 01064   896   NtResumeThread  (208, ... 1, ) == 0x0
 01065   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 01066   896   NtAllocateVirtualMemory  (-1, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 01067   896   NtProtectVirtualMemory  (-1, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 01068   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01062  1028   NtProtectVirtualMemory  ... (0x76f21000), 4096, 32, ) == 0x0
 01069  1372   NtWaitForSingleObject  (100, 0, 0x0, ...
 01070  1028   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01071  1028   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01072  1028   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01073  1028   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 220, 2, ) }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 220, 2, ) , 0, ... 220, 2, ) == 0x0
 01074  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01075  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01068   896   NtCreateThread  ... 228, {1252, 1600}, ) == 0x0
 01076   896   NtQueryInformationThread  (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 01077   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 01078   896   NtResumeThread  (228, ... 1, ) == 0x0
 01079   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28901376, 1048576, ) == 0x0
 01080   896   NtAllocateVirtualMemory  (-1, 29941760, 0, 8192, 4096, 4, ... 29941760, 8192, ) == 0x0
 01075  1028   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01081  1600   NtWaitForSingleObject  (100, 0, 0x0, ...
 01082  1028   NtQueryValueKey  (224,  (224, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01083  1028   NtQueryValueKey  (220,  (220, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01084  1028   NtQueryValueKey  (224,  (224, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01085  1028   NtQueryValueKey  (220,  (220, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01086  1028   NtQueryValueKey  (224,  (224, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087  1028   NtQueryValueKey  (220,  (220, "PrioritizeRecordData", Partial, 144, ... , Partial, 144, ...
 01088   896   NtProtectVirtualMemory  (-1, (0x1c8e000), 4096, 260, ... (0x1c8e000), 4096, 4, ) == 0x0
 01089   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 232, {1252, 1948}, ) == 0x0
 01090   896   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 01091   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 01092   896   NtResumeThread  (232, ... 1, ) == 0x0
 01093   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01087  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01094  1948   NtWaitForSingleObject  (100, 0, 0x0, ...
 01095  1028   NtQueryValueKey  (224,  (224, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01096  1028   NtQueryValueKey  (220,  (220, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01097  1028   NtQueryValueKey  (224,  (224, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01098  1028   NtQueryValueKey  (224,  (224, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01099  1028   NtQueryValueKey  (224,  (224, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01100  1028   NtQueryValueKey  (224,  (224, "FilterClusterIp", Partial, 144, ... , Partial, 144, ...
 01093   896   NtAllocateVirtualMemory  ... 29949952, 1048576, ) == 0x0
 01101   896   NtAllocateVirtualMemory  (-1, 30990336, 0, 8192, 4096, 4, ... 30990336, 8192, ) == 0x0
 01102   896   NtProtectVirtualMemory  (-1, (0x1d8e000), 4096, 260, ... (0x1d8e000), 4096, 4, ) == 0x0
 01103   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 236, {1252, 252}, ) == 0x0
 01104   896   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 01105   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 01100  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01106  1028   NtQueryValueKey  (224,  (224, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01107  1028   NtQueryValueKey  (224,  (224, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01108  1028   NtQueryValueKey  (224,  (224, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01109  1028   NtQueryValueKey  (224,  (224, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01110  1028   NtQueryValueKey  (224,  (224, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01111  1028   NtQueryValueKey  (220,  (220, "DisableDynamicUpdate", Partial, 144, ... , Partial, 144, ...
 01112   896   NtResumeThread  (236, ... 1, ) == 0x0
 01113   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30998528, 1048576, ) == 0x0
 01114   896   NtAllocateVirtualMemory  (-1, 32038912, 0, 8192, 4096, 4, ... 32038912, 8192, ) == 0x0
 01115   896   NtProtectVirtualMemory  (-1, (0x1e8e000), 4096, 260, ... (0x1e8e000), 4096, 4, ) == 0x0
 01116   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 240, {1252, 1300}, ) == 0x0
 01117   896   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 01111  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01118   252   NtWaitForSingleObject  (100, 0, 0x0, ...
 01119  1028   NtQueryValueKey  (224,  (224, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01120  1028   NtQueryValueKey  (224,  (224, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01121  1028   NtQueryValueKey  (220,  (220, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01122  1028   NtQueryValueKey  (224,  (224, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01123  1028   NtQueryValueKey  (220,  (220, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01124  1028   NtQueryValueKey  (224,  (224, "RegisterWanAdapters", Partial, 144, ... , Partial, 144, ...
 01125   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 01126   896   NtResumeThread  (240, ... 1, ) == 0x0
 01127   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32047104, 1048576, ) == 0x0
 01128   896   NtAllocateVirtualMemory  (-1, 33087488, 0, 8192, 4096, 4, ... 33087488, 8192, ) == 0x0
 01129   896   NtProtectVirtualMemory  (-1, (0x1f8e000), 4096, 260, ... (0x1f8e000), 4096, 4, ) == 0x0
 01130   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01124  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01131  1300   NtWaitForSingleObject  (100, 0, 0x0, ...
 01132  1028   NtQueryValueKey  (220,  (220, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01133  1028   NtQueryValueKey  (224,  (224, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134  1028   NtQueryValueKey  (220,  (220, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01135  1028   NtQueryValueKey  (224,  (224, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01136  1028   NtQueryValueKey  (220,  (220, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01137  1028   NtQueryValueKey  (224,  (224, "RegistrationMaxAddressCount", Partial, 144, ... , Partial, 144, ...
 01130   896   NtCreateThread  ... 244, {1252, 1096}, ) == 0x0
 01138   896   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 01139   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 01140   896   NtResumeThread  (244, ... 1, ) == 0x0
 01141   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 33095680, 1048576, ) == 0x0
 01142   896   NtAllocateVirtualMemory  (-1, 34136064, 0, 8192, 4096, 4, ... 34136064, 8192, ) == 0x0
 01137  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01143  1096   NtWaitForSingleObject  (100, 0, 0x0, ...
 01144  1028   NtQueryValueKey  (220,  (220, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01145  1028   NtQueryValueKey  (224,  (224, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01146  1028   NtQueryValueKey  (220,  (220, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01147  1028   NtQueryValueKey  (224,  (224, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01148  1028   NtQueryValueKey  (224,  (224, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01149  1028   NtQueryValueKey  (224,  (224, "DnsTest", Partial, 144, ... , Partial, 144, ...
 01150   896   NtProtectVirtualMemory  (-1, (0x208e000), 4096, 260, ... (0x208e000), 4096, 4, ) == 0x0
 01151   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 248, {1252, 1708}, ) == 0x0
 01152   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 01153   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 01154   896   NtResumeThread  (248, ... 1, ) == 0x0
 01155   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01149  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01156  1708   NtWaitForSingleObject  (100, 0, 0x0, ...
 01157  1028   NtQueryValueKey  (224,  (224, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01158  1028   NtQueryValueKey  (224,  (224, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01159  1028   NtQueryValueKey  (224,  (224, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01160  1028   NtQueryValueKey  (224,  (224, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01161  1028   NtQueryValueKey  (224,  (224, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01162  1028   NtQueryValueKey  (224,  (224, "MaxCachedSockets", Partial, 144, ... , Partial, 144, ...
 01155   896   NtAllocateVirtualMemory  ... 34144256, 1048576, ) == 0x0
 01163   896   NtAllocateVirtualMemory  (-1, 35184640, 0, 8192, 4096, 4, ... 35184640, 8192, ) == 0x0
 01164   896   NtProtectVirtualMemory  (-1, (0x218e000), 4096, 260, ... (0x218e000), 4096, 4, ) == 0x0
 01165   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 252, {1252, 1024}, ) == 0x0
 01166   896   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 01167   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 01162  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01168  1028   NtQueryValueKey  (224,  (224, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01169  1028   NtQueryValueKey  (224,  (224, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01170  1028   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 256, ) }, ... 256, ) == 0x0
 01171  1028   NtQueryValueKey  (256,  (256, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (256, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01172  1028   NtClose  (256, ... ) == 0x0
 01173  1028   NtClose  (220, ...
 01174   896   NtResumeThread  (252, ... 1, ) == 0x0
 01175   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 35192832, 1048576, ) == 0x0
 01176   896   NtAllocateVirtualMemory  (-1, 36233216, 0, 8192, 4096, 4, ... 36233216, 8192, ) == 0x0
 01177   896   NtProtectVirtualMemory  (-1, (0x228e000), 4096, 260, ... (0x228e000), 4096, 4, ) == 0x0
 01178   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 256, {1252, 1324}, ) == 0x0
 01179   896   NtQueryInformationThread  (256, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=1324,}, 0x0, ) == 0x0
 01173  1028   NtClose  ... ) == 0x0
 01180  1024   NtWaitForSingleObject  (100, 0, 0x0, ...
 01181  1028   NtClose  (224, ... ) == 0x0
 01182  1028   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01183  1028   NtQueryValueKey  (224,  (224, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01184  1028   NtQueryValueKey  (224,  (224, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01185  1028   NtQueryValueKey  (224,  (224, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01186  1028   NtClose  (224, ...
 01187   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0,\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0,\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0,\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0,\5\0\0" )  ) == 0x0
 01188   896   NtResumeThread  (256, ... 1, ) == 0x0
 01189   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 36241408, 1048576, ) == 0x0
 01190   896   NtAllocateVirtualMemory  (-1, 37281792, 0, 8192, 4096, 4, ... 37281792, 8192, ) == 0x0
 01191   896   NtProtectVirtualMemory  (-1, (0x238e000), 4096, 260, ... (0x238e000), 4096, 4, ) == 0x0
 01192   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01186  1028   NtClose  ... ) == 0x0
 01193  1324   NtWaitForSingleObject  (100, 0, 0x0, ...
 01194  1028   NtSetEventBoostPriority  (100, ...
 01000   748   NtWaitForSingleObject  ... ) == 0x0
 01195   748   NtSetEventBoostPriority  (100, ...
 01015   900   NtWaitForSingleObject  ... ) == 0x0
 01196   900   NtSetEventBoostPriority  (100, ...
 01019  2016   NtWaitForSingleObject  ... ) == 0x0
 01197  2016   NtSetEventBoostPriority  (100, ...
 01033  1388   NtWaitForSingleObject  ... ) == 0x0
 01198  1388   NtSetEventBoostPriority  (100, ...
 01046  2036   NtWaitForSingleObject  ... ) == 0x0
 01199  2036   NtSetEventBoostPriority  (100, ...
 01069  1372   NtWaitForSingleObject  ... ) == 0x0
 01200  1372   NtSetEventBoostPriority  (100, ...
 01081  1600   NtWaitForSingleObject  ... ) == 0x0
 01201  1600   NtSetEventBoostPriority  (100, ...
 01094  1948   NtWaitForSingleObject  ... ) == 0x0
 01202  1948   NtSetEventBoostPriority  (100, ...
 01118   252   NtWaitForSingleObject  ... ) == 0x0
 01203   252   NtSetEventBoostPriority  (100, ...
 01131  1300   NtWaitForSingleObject  ... ) == 0x0
 01204  1300   NtSetEventBoostPriority  (100, ...
 01143  1096   NtWaitForSingleObject  ... ) == 0x0
 01205  1096   NtSetEventBoostPriority  (100, ...
 01156  1708   NtWaitForSingleObject  ... ) == 0x0
 01206  1708   NtSetEventBoostPriority  (100, ...
 01180  1024   NtWaitForSingleObject  ... ) == 0x0
 01207  1024   NtSetEventBoostPriority  (100, ...
 01193  1324   NtWaitForSingleObject  ... ) == 0x0
 01208  1324   NtAllocateVirtualMemory  (-1, 8867840, 0, 4096, 4096, 4, ... 8867840, 4096, ) == 0x0
 01207  1024   NtSetEventBoostPriority  ... ) == 0x0
 01206  1708   NtSetEventBoostPriority  ... ) == 0x0
 01205  1096   NtSetEventBoostPriority  ... ) == 0x0
 01204  1300   NtSetEventBoostPriority  ... ) == 0x0
 01203   252   NtSetEventBoostPriority  ... ) == 0x0
 01202  1948   NtSetEventBoostPriority  ... ) == 0x0
 01201  1600   NtSetEventBoostPriority  ... ) == 0x0
 01200  1372   NtSetEventBoostPriority  ... ) == 0x0
 01199  2036   NtSetEventBoostPriority  ... ) == 0x0
 01198  1388   NtSetEventBoostPriority  ... ) == 0x0
 01196   900   NtSetEventBoostPriority  ... ) == 0x0
 01195   748   NtSetEventBoostPriority  ... ) == 0x0
 01194  1028   NtSetEventBoostPriority  ... ) == 0x0
 01197  2016   NtSetEventBoostPriority  ... ) == 0x0
 01192   896   NtCreateThread  ... 224, {1252, 1776}, ) == 0x0
 01209  1324   NtTestAlert  (...
 01210  1024   NtTestAlert  (...
 01211  1708   NtTestAlert  (...
 01212  1096   NtTestAlert  (...
 01213  1300   NtTestAlert  (...
 01214   252   NtTestAlert  (...
 01215  1948   NtTestAlert  (...
 01216  1600   NtTestAlert  (...
 01217  1372   NtTestAlert  (...
 01218  2036   NtTestAlert  (...
 01219  1388   NtTestAlert  (...
 01220   900   NtTestAlert  (...
 01221  1028   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01222   748   NtTestAlert  (...
 01223   896   NtQueryInformationThread  (224, Basic, 28, ...
 01209  1324   NtTestAlert  ... ) == 0x0
 01210  1024   NtTestAlert  ... ) == 0x0
 01211  1708   NtTestAlert  ... ) == 0x0
 01212  1096   NtTestAlert  ... ) == 0x0
 01213  1300   NtTestAlert  ... ) == 0x0
 01214   252   NtTestAlert  ... ) == 0x0
 01215  1948   NtTestAlert  ... ) == 0x0
 01216  1600   NtTestAlert  ... ) == 0x0
 01217  1372   NtTestAlert  ... ) == 0x0
 01218  2036   NtTestAlert  ... ) == 0x0
 01219  1388   NtTestAlert  ... ) == 0x0
 01220   900   NtTestAlert  ... ) == 0x0
 01221  1028   NtCreateEvent  ... 220, ) == 0x0
 01222   748   NtTestAlert  ... ) == 0x0
 01223   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa0000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 01224  1324   NtContinue  (36240688, 1, ...
 01225  1024   NtContinue  (35192112, 1, ...
 01226  1708   NtContinue  (34143536, 1, ...
 01227  1096   NtContinue  (33094960, 1, ...
 01228  1300   NtContinue  (32046384, 1, ...
 01229   252   NtContinue  (30997808, 1, ...
 01230  1948   NtContinue  (29949232, 1, ...
 01231  1600   NtContinue  (28900656, 1, ...
 01232  1372   NtContinue  (27852080, 1, ...
 01233  2036   NtContinue  (26803504, 1, ...
 01234  1388   NtContinue  (25754928, 1, ...
 01235   900   NtContinue  (24706352, 1, ...
 01236  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01237   748   NtContinue  (23657776, 1, ...
 01238   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\360\6\0\0" ...  ...
 01239  1324   NtRegisterThreadTerminatePort  (24, ...
 01240  1024   NtRegisterThreadTerminatePort  (24, ...
 01241  1708   NtRegisterThreadTerminatePort  (24, ...
 01242  1096   NtRegisterThreadTerminatePort  (24, ...
 01243  1300   NtRegisterThreadTerminatePort  (24, ...
 01244   252   NtRegisterThreadTerminatePort  (24, ...
 01245  1948   NtRegisterThreadTerminatePort  (24, ...
 01246  1600   NtRegisterThreadTerminatePort  (24, ...
 01247  1372   NtRegisterThreadTerminatePort  (24, ...
 01248  2036   NtRegisterThreadTerminatePort  (24, ...
 01249  1388   NtRegisterThreadTerminatePort  (24, ...
 01250   900   NtRegisterThreadTerminatePort  (24, ...
 01251  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01252   748   NtRegisterThreadTerminatePort  (24, ...
 01238   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81862, 0}  ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 01239  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 01240  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 01241  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 01242  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 01243  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 01244   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 01245  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01246  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 01247  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 01248  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01249  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 01250   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 01251  2016   NtCreateEvent  ... 260, ) == 0x0
 01252   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 01236  1028   NtDuplicateObject  ... 264, ) == 0x0
 01253  1324   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01254  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01255  1708   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01256  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01257  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01258   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01259  1948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01260  1600   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ...
 01261  1372   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01262  2036   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01263  1388   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01264   900   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01265  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01266   748   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01267  1028   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01268   896   NtResumeThread  (224, ...
 01253  1324   NtDuplicateObject  ... 268, ) == 0x0
 01254  1024   NtDuplicateObject  ... 272, ) == 0x0
 01255  1708   NtDuplicateObject  ... 276, ) == 0x0
 01256  1096   NtDuplicateObject  ... 280, ) == 0x0
 01257  1300   NtDuplicateObject  ... 284, ) == 0x0
 01258   252   NtDuplicateObject  ... 288, ) == 0x0
 01259  1948   NtDuplicateObject  ... 292, ) == 0x0
 01260  1600   NtAllocateVirtualMemory  ... 1368064, 4096, ) == 0x0
 01261  1372   NtCreateEvent  ... 296, ) == 0x0
 01262  2036   NtCreateEvent  ... 300, ) == 0x0
 01263  1388   NtCreateEvent  ... 304, ) == 0x0
 01265  2016   NtDuplicateObject  ... 308, ) == 0x0
 01264   900   NtCreateEvent  ... 312, ) == 0x0
 01267  1028   NtCreateEvent  ... 316, ) == 0x0
 01268   896   NtResumeThread  ... 1, ) == 0x0
 01269  1324   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01270  1024   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01271  1708   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01272  1096   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01273  1300   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01274   252   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01275  1948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01276  1600   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01277  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 01278  2036   NtClose  (300, ...
 01279  1388   NtClose  (304, ...
 01280  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01281   900   NtClose  (312, ...
 01282  1028   NtClose  (316, ...
 01283   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01269  1324   NtCreateEvent  ... 320, ) == 0x0
 01270  1024   NtCreateEvent  ... 324, ) == 0x0
 01271  1708   NtCreateEvent  ... 328, ) == 0x0
 01272  1096   NtCreateEvent  ... 332, ) == 0x0
 01273  1300   NtCreateEvent  ... 336, ) == 0x0
 01274   252   NtCreateEvent  ... 340, ) == 0x0
 01275  1948   NtCreateEvent  ... 344, ) == 0x0
 01276  1600   NtCreateEvent  ... 348, ) == 0x0
 01278  2036   NtClose  ... ) == 0x0
 01279  1388   NtClose  ... ) == 0x0
 01281   900   NtClose  ... ) == 0x0
 01282  1028   NtClose  ... ) == 0x0
 01283   896   NtAllocateVirtualMemory  ... 37289984, 1048576, ) == 0x0
 01284  1324   NtClose  (320, ...
 01285  1024   NtClose  (324, ...
 01286  1708   NtClose  (328, ...
 01287  1096   NtClose  (332, ...
 01288  1300   NtClose  (336, ...
 01289   252   NtClose  (340, ...
 01290  1948   NtClose  (344, ...
 01291  1600   NtClose  (348, ...
 01292  2036   NtWaitForSingleObject  (296, 0, 0x0, ...
 01293  1388   NtWaitForSingleObject  (296, 0, 0x0, ...
 01294   900   NtWaitForSingleObject  (296, 0, 0x0, ...
 01295  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 01296   896   NtAllocateVirtualMemory  (-1, 38330368, 0, 8192, 4096, 4, ...
 01284  1324   NtClose  ... ) == 0x0
 01285  1024   NtClose  ... ) == 0x0
 01286  1708   NtClose  ... ) == 0x0
 01287  1096   NtClose  ... ) == 0x0
 01288  1300   NtClose  ... ) == 0x0
 01289   252   NtClose  ... ) == 0x0
 01290  1948   NtClose  ... ) == 0x0
 01291  1600   NtClose  ... ) == 0x0
 01266   748   NtCreateEvent  ... 348, ) == 0x0
 01297  1776   NtTestAlert  (...
 01296   896   NtAllocateVirtualMemory  ... 38330368, 8192, ) == 0x0
 01298  1324   NtWaitForSingleObject  (296, 0, 0x0, ...
 01299  1024   NtWaitForSingleObject  (296, 0, 0x0, ...
 01300  1708   NtWaitForSingleObject  (296, 0, 0x0, ...
 01301  1096   NtWaitForSingleObject  (296, 0, 0x0, ...
 01302  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 01303   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 01304  1948   NtWaitForSingleObject  (296, 0, 0x0, ...
 01305  1600   NtSetEventBoostPriority  (296, ...
 01306   748   NtClose  (348, ...
 01297  1776   NtTestAlert  ... ) == 0x0
 01307   896   NtProtectVirtualMemory  (-1, (0x248e000), 4096, 260, ...
 01306   748   NtClose  ... ) == 0x0
 01308  1776   NtContinue  (37289264, 1, ...
 01307   896   NtProtectVirtualMemory  ... (0x248e000), 4096, 4, ) == 0x0
 01309   748   NtWaitForSingleObject  (296, 0, 0x0, ...
 01310  1776   NtRegisterThreadTerminatePort  (24, ...
 01311   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01310  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 01311   896   NtCreateThread  ... 348, {1252, 500}, ) == 0x0
 01277  1372   NtWaitForSingleObject  ... ) == 0x0
 01305  1600   NtSetEventBoostPriority  ... ) == 0x0
 01312   896   NtQueryInformationThread  (348, Basic, 28, ...
 01313  1372   NtSetEventBoostPriority  (296, ...
 01314  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01312   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 01280  2016   NtWaitForSingleObject  ... ) == 0x0
 01313  1372   NtSetEventBoostPriority  ... ) == 0x0
 01314  1600   NtDuplicateObject  ... 344, ) == 0x0
 01315  1776   NtWaitForSingleObject  (296, 0, 0x0, ...
 01316  2016   NtSetEventBoostPriority  (296, ...
 01317   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\0\364\1\0\0" ...  ...
 01318  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 01292  2036   NtWaitForSingleObject  ... ) == 0x0
 01316  2016   NtSetEventBoostPriority  ... ) == 0x0
 01317   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81863, 0}  ... {28, 56, reply, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 01319  2036   NtSetEventBoostPriority  (296, ...
 01320  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01293  1388   NtWaitForSingleObject  ... ) == 0x0
 01319  2036   NtSetEventBoostPriority  ... ) == 0x0
 01321   896   NtResumeThread  (348, ...
 01322  1388   NtSetEventBoostPriority  (296, ...
 01320  1372   NtDuplicateObject  ... 340, ) == 0x0
 01323  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01294   900   NtWaitForSingleObject  ... ) == 0x0
 01322  1388   NtSetEventBoostPriority  ... ) == 0x0
 01321   896   NtResumeThread  ... 1, ) == 0x0
 01324  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 01325   900   NtSetEventBoostPriority  (296, ...
 01326  2036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01327   500   NtTestAlert  (...
 01328   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01295  1028   NtWaitForSingleObject  ... ) == 0x0
 01325   900   NtSetEventBoostPriority  ... ) == 0x0
 01326  2036   NtDuplicateObject  ... 336, ) == 0x0
 01327   500   NtTestAlert  ... ) == 0x0
 01329  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01330  1028   NtSetEventBoostPriority  (296, ...
 01328   896   NtAllocateVirtualMemory  ... 38338560, 1048576, ) == 0x0
 01331  2036   NtWaitForSingleObject  (296, 0, 0x0, ...
 01332   500   NtContinue  (38337840, 1, ...
 01298  1324   NtWaitForSingleObject  ... ) == 0x0
 01329  1388   NtDuplicateObject  ... 332, ) == 0x0
 01333   896   NtAllocateVirtualMemory  (-1, 39378944, 0, 8192, 4096, 4, ...
 01334   500   NtRegisterThreadTerminatePort  (24, ...
 01335  1324   NtSetEventBoostPriority  (296, ...
 01336  1388   NtWaitForSingleObject  (296, 0, 0x0, ...
 01333   896   NtAllocateVirtualMemory  ... 39378944, 8192, ) == 0x0
 01334   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 01299  1024   NtWaitForSingleObject  ... ) == 0x0
 01337   896   NtProtectVirtualMemory  (-1, (0x258e000), 4096, 260, ...
 01335  1324   NtSetEventBoostPriority  ... ) == 0x0
 01330  1028   NtSetEventBoostPriority  ... ) == 0x0
 01338   900   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01339  1024   NtSetEventBoostPriority  (296, ...
 01337   896   NtProtectVirtualMemory  ... (0x258e000), 4096, 4, ) == 0x0
 01340  1324   NtWaitForSingleObject  (296, 0, 0x0, ...
 01341  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 01338   900   NtDuplicateObject  ... 328, ) == 0x0
 01300  1708   NtWaitForSingleObject  ... ) == 0x0
 01342   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01343   900   NtWaitForSingleObject  (296, 0, 0x0, ...
 01344  1708   NtSetEventBoostPriority  (296, ...
 01339  1024   NtSetEventBoostPriority  ... ) == 0x0
 01345   500   NtWaitForSingleObject  (296, 0, 0x0, ...
 01301  1096   NtWaitForSingleObject  ... ) == 0x0
 01346  1024   NtWaitForSingleObject  (296, 0, 0x0, ...
 01347  1096   NtSetEventBoostPriority  (296, ...
 01302  1300   NtWaitForSingleObject  ... ) == 0x0
 01348  1300   NtSetEventBoostPriority  (296, ...
 01303   252   NtWaitForSingleObject  ... ) == 0x0
 01349   252   NtSetEventBoostPriority  (296, ...
 01304  1948   NtWaitForSingleObject  ... ) == 0x0
 01350  1948   NtSetEventBoostPriority  (296, ...
 01309   748   NtWaitForSingleObject  ... ) == 0x0
 01351   748   NtSetEventBoostPriority  (296, ...
 01315  1776   NtWaitForSingleObject  ... ) == 0x0
 01352  1776   NtSetEventBoostPriority  (296, ...
 01318  1600   NtWaitForSingleObject  ... ) == 0x0
 01353  1600   NtSetEventBoostPriority  (296, ...
 01323  2016   NtWaitForSingleObject  ... ) == 0x0
 01354  2016   NtSetEventBoostPriority  (296, ...
 01324  1372   NtWaitForSingleObject  ... ) == 0x0
 01355  1372   NtSetEventBoostPriority  (296, ...
 01331  2036   NtWaitForSingleObject  ... ) == 0x0
 01356  2036   NtSetEventBoostPriority  (296, ...
 01336  1388   NtWaitForSingleObject  ... ) == 0x0
 01357  1388   NtSetEventBoostPriority  (296, ...
 01340  1324   NtWaitForSingleObject  ... ) == 0x0
 01358  1324   NtSetEventBoostPriority  (296, ...
 01341  1028   NtWaitForSingleObject  ... ) == 0x0
 01359  1028   NtSetEventBoostPriority  (296, ...
 01343   900   NtWaitForSingleObject  ... ) == 0x0
 01360   900   NtSetEventBoostPriority  (296, ...
 01345   500   NtWaitForSingleObject  ... ) == 0x0
 01361   500   NtSetEventBoostPriority  (296, ...
 01346  1024   NtWaitForSingleObject  ... ) == 0x0
 01362  1024   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01361   500   NtSetEventBoostPriority  ... ) == 0x0
 01363   500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01360   900   NtSetEventBoostPriority  ... ) == 0x0
 01359  1028   NtSetEventBoostPriority  ... ) == 0x0
 01358  1324   NtSetEventBoostPriority  ... ) == 0x0
 01357  1388   NtSetEventBoostPriority  ... ) == 0x0
 01356  2036   NtSetEventBoostPriority  ... ) == 0x0
 01355  1372   NtSetEventBoostPriority  ... ) == 0x0
 01354  2016   NtSetEventBoostPriority  ... ) == 0x0
 01353  1600   NtSetEventBoostPriority  ... ) == 0x0
 01352  1776   NtSetEventBoostPriority  ... ) == 0x0
 01351   748   NtSetEventBoostPriority  ... ) == 0x0
 01350  1948   NtSetEventBoostPriority  ... ) == 0x0
 01349   252   NtSetEventBoostPriority  ... ) == 0x0
 01348  1300   NtSetEventBoostPriority  ... ) == 0x0
 01347  1096   NtSetEventBoostPriority  ... ) == 0x0
 01344  1708   NtSetEventBoostPriority  ... ) == 0x0
 01342   896   NtCreateThread  ... 324, {1252, 248}, ) == 0x0
 01362  1024   NtWaitForSingleObject  ... ) == 0x102
 01363   500   NtDuplicateObject  ... 320, ) == 0x0
 01364   900   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01365  1028   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ...
 01366  1324   NtWaitForSingleObject  (296, 0, 0x0, ...
 01367  1388   NtWaitForSingleObject  (296, 0, 0x0, ...
 01368  2036   NtWaitForSingleObject  (296, 0, 0x0, ...
 01369  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01370  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 01371  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01372  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 01373  1948   NtWaitForSingleObject  (296, 0, 0x0, ...
 01374   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 01375  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 01376  1096   NtWaitForSingleObject  (296, 0, 0x0, ...
 01377  1708   NtWaitForSingleObject  (296, 0, 0x0, ...
 01378   896   NtQueryInformationThread  (324, Basic, 28, ...
 01379  1024   NtWaitForSingleObject  (132, 0, 0x0, ...
 01380   500   NtWaitForSingleObject  (296, 0, 0x0, ...
 01364   900   NtWaitForSingleObject  ... ) == 0x102
 01365  1028   NtAllocateVirtualMemory  ... 1372160, 4096, ) == 0x0
 01381   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01378   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 01382   900   NtWaitForSingleObject  (296, 0, 0x0, ...
 01383  1028   NtSetEventBoostPriority  (296, ...
 01381   748   NtDuplicateObject  ... 316, ) == 0x0
 01384   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\1\0\0\344\4\0\0\370\0\0\0" ...  ...
 01366  1324   NtWaitForSingleObject  ... ) == 0x0
 01383  1028   NtSetEventBoostPriority  ... ) == 0x0
 01385   748   NtWaitForSingleObject  (296, 0, 0x0, ...
 01386  1324   NtSetEventBoostPriority  (296, ...
 01384   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81864, 0}  ... {28, 56, reply, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 01387  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 01367  1388   NtWaitForSingleObject  ... ) == 0x0
 01386  1324   NtSetEventBoostPriority  ... ) == 0x0
 01371  1776   NtDuplicateObject  ... 312, ) == 0x0
 01388  1388   NtSetEventBoostPriority  (296, ...
 01389  1324   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01368  2036   NtWaitForSingleObject  ... ) == 0x0
 01388  1388   NtSetEventBoostPriority  ... ) == 0x0
 01390  1776   NtWaitForSingleObject  (296, 0, 0x0, ...
 01391   896   NtResumeThread  (324, ...
 01392  2036   NtSetEventBoostPriority  (296, ...
 01393  1388   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01370  1372   NtWaitForSingleObject  ... ) == 0x0
 01392  2036   NtSetEventBoostPriority  ... ) == 0x0
 01391   896   NtResumeThread  ... 1, ) == 0x0
 01389  1324   NtCreateEvent  ... 304, ) == 0x0
 01394  1372   NtSetEventBoostPriority  (296, ...
 01395  2036   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01396   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01369  2016   NtWaitForSingleObject  ... ) == 0x0
 01394  1372   NtSetEventBoostPriority  ... ) == 0x0
 01397  1324   NtWaitForSingleObject  (304, 0, 0x0, ...
 01393  1388   NtCreateEvent  ... 300, ) == 0x0
 01398   248   NtTestAlert  (...
 01399  2016   NtSetEventBoostPriority  (296, ...
 01396   896   NtAllocateVirtualMemory  ... 39387136, 1048576, ) == 0x0
 01400  1372   NtWaitForSingleObject  (304, 0, 0x0, ...
 01401  1388   NtClose  (300, ...
 01372  1600   NtWaitForSingleObject  ... ) == 0x0
 01398   248   NtTestAlert  ... ) == 0x0
 01402   896   NtAllocateVirtualMemory  (-1, 40427520, 0, 8192, 4096, 4, ...
 01399  2016   NtSetEventBoostPriority  ... ) == 0x0
 01395  2036   NtCreateEvent  ... 352, ) == 0x0
 01401  1388   NtClose  ... ) == 0x0
 01403  1600   NtSetEventBoostPriority  (296, ...
 01404   248   NtContinue  (39386416, 1, ...
 01402   896   NtAllocateVirtualMemory  ... 40427520, 8192, ) == 0x0
 01405  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01406  2036   NtClose  (352, ...
 01407  1388   NtWaitForSingleObject  (304, 0, 0x0, ...
 01373  1948   NtWaitForSingleObject  ... ) == 0x0
 01403  1600   NtSetEventBoostPriority  ... ) == 0x0
 01408   248   NtRegisterThreadTerminatePort  (24, ...
 01406  2036   NtClose  ... ) == 0x0
 01409  1948   NtSetEventBoostPriority  (296, ...
 01410  1600   NtWaitForSingleObject  (304, 0, 0x0, ...
 01408   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 01374   252   NtWaitForSingleObject  ... ) == 0x0
 01409  1948   NtSetEventBoostPriority  ... ) == 0x0
 01411  2036   NtWaitForSingleObject  (304, 0, 0x0, ...
 01412   896   NtProtectVirtualMemory  (-1, (0x268e000), 4096, 260, ...
 01413   252   NtSetEventBoostPriority  (296, ...
 01414   248   NtWaitForSingleObject  (296, 0, 0x0, ...
 01375  1300   NtWaitForSingleObject  ... ) == 0x0
 01413   252   NtSetEventBoostPriority  ... ) == 0x0
 01412   896   NtProtectVirtualMemory  ... (0x268e000), 4096, 4, ) == 0x0
 01415  1300   NtSetEventBoostPriority  (296, ...
 01416  1948   NtWaitForSingleObject  (304, 0, 0x0, ...
 01376  1096   NtWaitForSingleObject  ... ) == 0x0
 01415  1300   NtSetEventBoostPriority  ... ) == 0x0
 01417   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01418  1096   NtSetEventBoostPriority  (296, ...
 01419   252   NtWaitForSingleObject  (304, 0, 0x0, ...
 01377  1708   NtWaitForSingleObject  ... ) == 0x0
 01418  1096   NtSetEventBoostPriority  ... ) == 0x0
 01417   896   NtCreateThread  ... 352, {1252, 1884}, ) == 0x0
 01420  1708   NtSetEventBoostPriority  (296, ...
 01421  1300   NtWaitForSingleObject  (304, 0, 0x0, ...
 01380   500   NtWaitForSingleObject  ... ) == 0x0
 01420  1708   NtSetEventBoostPriority  ... ) == 0x0
 01422   896   NtQueryInformationThread  (352, Basic, 28, ...
 01423   500   NtSetEventBoostPriority  (296, ...
 01424  1096   NtWaitForSingleObject  (304, 0, 0x0, ...
 01382   900   NtWaitForSingleObject  ... ) == 0x0
 01423   500   NtSetEventBoostPriority  ... ) == 0x0
 01422   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 01425   900   NtSetEventBoostPriority  (296, ...
 01426  1708   NtWaitForSingleObject  (304, 0, 0x0, ...
 01427   500   NtWaitForSingleObject  (296, 0, 0x0, ...
 01385   748   NtWaitForSingleObject  ... ) == 0x0
 01425   900   NtSetEventBoostPriority  ... ) == 0x0
 01428   748   NtSetEventBoostPriority  (296, ...
 01429   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0\344\4\0\0\\7\0\0" ...  ...
 01387  1028   NtWaitForSingleObject  ... ) == 0x0
 01428   748   NtSetEventBoostPriority  ... ) == 0x0
 01430  1028   NtSetEventBoostPriority  (296, ...
 01429   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81865, 0}  ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 01431   900   NtWaitForSingleObject  (132, 0, 0x0, ...
 01390  1776   NtWaitForSingleObject  ... ) == 0x0
 01430  1028   NtSetEventBoostPriority  ... ) == 0x0
 01432   896   NtResumeThread  (352, ...
 01433  1776   NtSetEventBoostPriority  (296, ...
 01434   748   NtWaitForSingleObject  (296, 0, 0x0, ...
 01405  2016   NtWaitForSingleObject  ... ) == 0x0
 01433  1776   NtSetEventBoostPriority  ... ) == 0x0
 01432   896   NtResumeThread  ... 1, ) == 0x0
 01435  2016   NtSetEventBoostPriority  (296, ...
 01436  1028   NtSetEventBoostPriority  (304, ...
 01437  1884   NtTestAlert  (...
 01414   248   NtWaitForSingleObject  ... ) == 0x0
 01435  2016   NtSetEventBoostPriority  ... ) == 0x0
 01438   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01397  1324   NtWaitForSingleObject  ... ) == 0x0
 01436  1028   NtSetEventBoostPriority  ... ) == 0x0
 01439   248   NtSetEventBoostPriority  (296, ...
 01437  1884   NtTestAlert  ... ) == 0x0
 01440  1776   NtWaitForSingleObject  (296, 0, 0x0, ...
 01441  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01442  1324   NtWaitForSingleObject  (296, 0, 0x0, ...
 01427   500   NtWaitForSingleObject  ... ) == 0x0
 01439   248   NtSetEventBoostPriority  ... ) == 0x0
 01443  1028   NtWaitForSingleObject  (304, 0, 0x0, ...
 01444  1884   NtContinue  (40434992, 1, ...
 01445   500   NtSetEventBoostPriority  (296, ...
 01446   248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01434   748   NtWaitForSingleObject  ... ) == 0x0
 01445   500   NtSetEventBoostPriority  ... ) == 0x0
 01447  1884   NtRegisterThreadTerminatePort  (24, ...
 01438   896   NtAllocateVirtualMemory  ... 40435712, 1048576, ) == 0x0
 01448   748   NtSetEventBoostPriority  (296, ...
 01449   500   NtWaitForSingleObject  (304, 0, 0x0, ...
 01447  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 01440  1776   NtWaitForSingleObject  ... ) == 0x0
 01448   748   NtSetEventBoostPriority  ... ) == 0x0
 01450   896   NtAllocateVirtualMemory  (-1, 41476096, 0, 8192, 4096, 4, ...
 01446   248   NtDuplicateObject  ... 300, ) == 0x0
 01451  1776   NtSetEventBoostPriority  (296, ...
 01452   748   NtWaitForSingleObject  (304, 0, 0x0, ...
 01450   896   NtAllocateVirtualMemory  ... 41476096, 8192, ) == 0x0
 01442  1324   NtWaitForSingleObject  ... ) == 0x0
 01451  1776   NtSetEventBoostPriority  ... ) == 0x0
 01453   248   NtWaitForSingleObject  (296, 0, 0x0, ...
 01454  1884   NtWaitForSingleObject  (296, 0, 0x0, ...
 01455  1324   NtSetEventBoostPriority  (296, ...
 01456   896   NtProtectVirtualMemory  (-1, (0x278e000), 4096, 260, ...
 01457  1776   NtWaitForSingleObject  (304, 0, 0x0, ...
 01441  2016   NtWaitForSingleObject  ... ) == 0x0
 01455  1324   NtSetEventBoostPriority  ... ) == 0x0
 01456   896   NtProtectVirtualMemory  ... (0x278e000), 4096, 4, ) == 0x0
 01458  2016   NtSetEventBoostPriority  (296, ...
 01453   248   NtWaitForSingleObject  ... ) == 0x0
 01459   248   NtSetEventBoostPriority  (296, ...
 01454  1884   NtWaitForSingleObject  ... ) == 0x0
 01460  1884   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 356, ) == 0x0
 01461  1884   NtWaitForSingleObject  (304, 0, 0x0, ...
 01459   248   NtSetEventBoostPriority  ... ) == 0x0
 01458  2016   NtSetEventBoostPriority  ... ) == 0x0
 01462   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01463  1324   NtSetEventBoostPriority  (304, ...
 01464  2016   NtWaitForSingleObject  (304, 0, 0x0, ...
 01465   248   NtWaitForSingleObject  (304, 0, 0x0, ...
 01400  1372   NtWaitForSingleObject  ... ) == 0x0
 01463  1324   NtSetEventBoostPriority  ... ) == 0x0
 01462   896   NtCreateThread  ... 360, {1252, 1308}, ) == 0x0
 01466  1372   NtSetEventBoostPriority  (304, ...
 01467  1324   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01407  1388   NtWaitForSingleObject  ... ) == 0x0
 01468   896   NtQueryInformationThread  (360, Basic, 28, ...
 01467  1324   NtWaitForSingleObject  ... ) == 0x102
 01469  1388   NtSetEventBoostPriority  (304, ...
 01468   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 01470  1324   NtWaitForSingleObject  (132, 0, 0x0, ...
 01410  1600   NtWaitForSingleObject  ... ) == 0x0
 01469  1388   NtSetEventBoostPriority  ... ) == 0x0
 01471   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\34\5\0\0" ...  ...
 01466  1372   NtSetEventBoostPriority  ... ) == 0x0
 01472  1600   NtSetEventBoostPriority  (304, ...
 01471   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81866, 0}  ... {28, 56, reply, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 01411  2036   NtWaitForSingleObject  ... ) == 0x0
 01473  1372   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01472  1600   NtSetEventBoostPriority  ... ) == 0x0
 01474  1388   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01475  2036   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01476  1600   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01474  1388   NtWaitForSingleObject  ... ) == 0x102
 01475  2036   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01477  1388   NtWaitForSingleObject  (132, 0, 0x0, ...
 01478   896   NtResumeThread  (360, ...
 01473  1372   NtWaitForSingleObject  ... ) == 0x102
 01476  1600   NtWaitForSingleObject  ... ) == 0x102
 01478   896   NtResumeThread  ... 1, ) == 0x0
 01479  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 01480  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 01481   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 41484288, 1048576, ) == 0x0
 01482   896   NtAllocateVirtualMemory  (-1, 42524672, 0, 8192, 4096, 4, ... 42524672, 8192, ) == 0x0
 01483   896   NtProtectVirtualMemory  (-1, (0x288e000), 4096, 260, ... (0x288e000), 4096, 4, ) == 0x0
 01484   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 364, {1252, 1676}, ) == 0x0
 01485   896   NtQueryInformationThread  (364, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 01486  2036   NtSetEventBoostPriority  (296, ...
 01487  1308   NtTestAlert  (...
 01479  1372   NtWaitForSingleObject  ... ) == 0x0
 01486  2036   NtSetEventBoostPriority  ... ) == 0x0
 01488  1372   NtSetEventBoostPriority  (296, ...
 01487  1308   NtTestAlert  ... ) == 0x0
 01480  1600   NtWaitForSingleObject  ... ) == 0x0
 01488  1372   NtSetEventBoostPriority  ... ) == 0x0
 01489  2036   NtSetEventBoostPriority  (304, ...
 01490  1600   NtWaitForSingleObject  (132, 0, 0x0, ...
 01491  1308   NtContinue  (41483568, 1, ...
 01492   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\214\6\0\0" ...  ...
 01416  1948   NtWaitForSingleObject  ... ) == 0x0
 01489  2036   NtSetEventBoostPriority  ... ) == 0x0
 01493  1308   NtRegisterThreadTerminatePort  (24, ...
 01494  1948   NtSetEventBoostPriority  (304, ...
 01492   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81867, 0}  ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 01495  2036   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01419   252   NtWaitForSingleObject  ... ) == 0x0
 01494  1948   NtSetEventBoostPriority  ... ) == 0x0
 01493  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 01496   896   NtResumeThread  (364, ...
 01497   252   NtSetEventBoostPriority  (304, ...
 01498  1948   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01499  1372   NtWaitForSingleObject  (132, 0, 0x0, ...
 01495  2036   NtWaitForSingleObject  ... ) == 0x102
 01421  1300   NtWaitForSingleObject  ... ) == 0x0
 01497   252   NtSetEventBoostPriority  ... ) == 0x0
 01496   896   NtResumeThread  ... 1, ) == 0x0
 01500  1308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01501  1300   NtSetEventBoostPriority  (304, ...
 01502  2036   NtWaitForSingleObject  (132, 0, 0x0, ...
 01503   252   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01504   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01424  1096   NtWaitForSingleObject  ... ) == 0x0
 01501  1300   NtSetEventBoostPriority  ... ) == 0x0
 01500  1308   NtDuplicateObject  ... 368, ) == 0x0
 01498  1948   NtWaitForSingleObject  ... ) == 0x102
 01505  1676   NtTestAlert  (...
 01503   252   NtWaitForSingleObject  ... ) == 0x102
 01506  1096   NtSetEventBoostPriority  (304, ...
 01507  1300   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01508  1308   NtWaitForSingleObject  (304, 0, 0x0, ...
 01509  1948   NtWaitForSingleObject  (132, 0, 0x0, ...
 01505  1676   NtTestAlert  ... ) == 0x0
 01426  1708   NtWaitForSingleObject  ... ) == 0x0
 01506  1096   NtSetEventBoostPriority  ... ) == 0x0
 01510   252   NtWaitForSingleObject  (132, 0, 0x0, ...
 01504   896   NtAllocateVirtualMemory  ... 42532864, 1048576, ) == 0x0
 01511  1708   NtSetEventBoostPriority  (304, ...
 01512  1676   NtContinue  (42532144, 1, ...
 01513  1096   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01443  1028   NtWaitForSingleObject  ... ) == 0x0
 01511  1708   NtSetEventBoostPriority  ... ) == 0x0
 01514   896   NtAllocateVirtualMemory  (-1, 43573248, 0, 8192, 4096, 4, ...
 01515  1676   NtRegisterThreadTerminatePort  (24, ...
 01507  1300   NtWaitForSingleObject  ... ) == 0x102
 01516  1028   NtSetEventBoostPriority  (304, ...
 01517  1708   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01514   896   NtAllocateVirtualMemory  ... 43573248, 8192, ) == 0x0
 01515  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 01449   500   NtWaitForSingleObject  ... ) == 0x0
 01516  1028   NtSetEventBoostPriority  ... ) == 0x0
 01518  1300   NtWaitForSingleObject  (132, 0, 0x0, ...
 01513  1096   NtWaitForSingleObject  ... ) == 0x102
 01519   896   NtProtectVirtualMemory  (-1, (0x298e000), 4096, 260, ...
 01517  1708   NtWaitForSingleObject  ... ) == 0x102
 01520   500   NtSetEventBoostPriority  (304, ...
 01521  1676   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01522  1096   NtWaitForSingleObject  (132, 0, 0x0, ...
 01519   896   NtProtectVirtualMemory  ... (0x298e000), 4096, 4, ) == 0x0
 01452   748   NtWaitForSingleObject  ... ) == 0x0
 01523  1708   NtWaitForSingleObject  (132, 0, 0x0, ...
 01521  1676   NtDuplicateObject  ... 372, ) == 0x0
 01524   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01525   748   NtSetEventBoostPriority  (304, ...
 01526  1676   NtWaitForSingleObject  (304, 0, 0x0, ...
 01520   500   NtSetEventBoostPriority  ... ) == 0x0
 01527  1028   NtWaitForSingleObject  (304, 0, 0x0, ...
 01457  1776   NtWaitForSingleObject  ... ) == 0x0
 01528   500   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01529  1776   NtSetEventBoostPriority  (304, ...
 01461  1884   NtWaitForSingleObject  ... ) == 0x0
 01530  1884   NtSetEventBoostPriority  (304, ...
 01465   248   NtWaitForSingleObject  ... ) == 0x0
 01531   248   NtSetEventBoostPriority  (304, ...
 01464  2016   NtWaitForSingleObject  ... ) == 0x0
 01532  2016   NtSetEventBoostPriority  (304, ...
 01508  1308   NtWaitForSingleObject  ... ) == 0x0
 01533  1308   NtSetEventBoostPriority  (304, ...
 01526  1676   NtWaitForSingleObject  ... ) == 0x0
 01534  1676   NtSetEventBoostPriority  (304, ...
 01527  1028   NtWaitForSingleObject  ... ) == 0x0
 01535  1028   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01534  1676   NtSetEventBoostPriority  ... ) == 0x0
 01533  1308   NtSetEventBoostPriority  ... ) == 0x0
 01531   248   NtSetEventBoostPriority  ... ) == 0x0
 01532  2016   NtSetEventBoostPriority  ... ) == 0x0
 01530  1884   NtSetEventBoostPriority  ... ) == 0x0
 01529  1776   NtSetEventBoostPriority  ... ) == 0x0
 01525   748   NtSetEventBoostPriority  ... ) == 0x0
 01524   896   NtCreateThread  ... 376, {1252, 1620}, ) == 0x0
 01528   500   NtWaitForSingleObject  ... ) == 0x102
 01535  1028   NtOpenFile  ... 380, {status=0x0, info=0}, ) == 0x0
 01536  1676   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01537   248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01538  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01539  1884   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01540  1776   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01541   748   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01542   896   NtQueryInformationThread  (376, Basic, 28, ...
 01543   500   NtWaitForSingleObject  (132, 0, 0x0, ...
 01544  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\343\34u\27\13\210\332 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01536  1676   NtWaitForSingleObject  ... ) == 0x102
 01545  1308   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01538  2016   NtOpenKey  ... 384, ) == 0x0
 01542   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 01546  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01547  1676   NtWaitForSingleObject  (132, 0, 0x0, ...
 01545  1308   NtWaitForSingleObject  ... ) == 0x102
 01537   248   NtWaitForSingleObject  ... ) == 0x102
 01539  1884   NtWaitForSingleObject  ... ) == 0x102
 01540  1776   NtWaitForSingleObject  ... ) == 0x102
 01541   748   NtWaitForSingleObject  ... ) == 0x102
 01548   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0T\6\0\0" ...  ...
 01546  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01549  1308   NtWaitForSingleObject  (132, 0, 0x0, ...
 01550   248   NtWaitForSingleObject  (132, 0, 0x0, ...
 01551  1884   NtWaitForSingleObject  (132, 0, 0x0, ...
 01552  1776   NtWaitForSingleObject  (132, 0, 0x0, ...
 01553   748   NtWaitForSingleObject  (132, 0, 0x0, ...
 01548   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81868, 0}  ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 01554  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01555  2016   NtQueryValueKey  (384,  (384, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01554  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01555  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01556   896   NtResumeThread  (376, ...
 01557  2016   NtClose  (384, ...
 01556   896   NtResumeThread  ... 1, ) == 0x0
 01557  2016   NtClose  ... ) == 0x0
 01558   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01559  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01558   896   NtAllocateVirtualMemory  ... 43581440, 1048576, ) == 0x0
 01559  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01560   896   NtAllocateVirtualMemory  (-1, 44621824, 0, 8192, 4096, 4, ...
 01561  1028   NtQuerySystemInformation  (Performance, 312, ...
 01562  1620   NtTestAlert  (...
 01560   896   NtAllocateVirtualMemory  ... 44621824, 8192, ) == 0x0
 01561  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01562  1620   NtTestAlert  ... ) == 0x0
 01563  2016   NtOpenThreadToken  (-2, 0x20008, 1, ...
 01564  1028   NtQuerySystemInformation  (Exception, 16, ...
 01565  1620   NtContinue  (43580720, 1, ...
 01563  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01564  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01566  1620   NtRegisterThreadTerminatePort  (24, ...
 01567  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11071600, ... }, 11071600, ...
 01568  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01566  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 01567  2016   NtQueryAttributesFile  ... ) == 0x0
 01568  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01569   896   NtProtectVirtualMemory  (-1, (0x2a8e000), 4096, 260, ...
 01570  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01571  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01569   896   NtProtectVirtualMemory  ... (0x2a8e000), 4096, 4, ) == 0x0
 01570  2016   NtOpenKey  ... 384, ) == 0x0
 01571  1620   NtDuplicateObject  ... 388, ) == 0x0
 01572   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01573  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01574  1620   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01572   896   NtCreateThread  ... 392, {1252, 1296}, ) == 0x0
 01573  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01574  1620   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01575   896   NtQueryInformationThread  (392, Basic, 28, ...
 01576  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01577  1620   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01575   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 01576  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01577  1620   NtWaitForSingleObject  ... ) == 0x102
 01578  2016   NtQueryValueKey  (384,  (384, "Transports", Partial, 144, ... , Partial, 144, ...
 01579  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01580  1620   NtWaitForSingleObject  (132, 0, 0x0, ...
 01578  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01579  1028   NtCreateKey  ... -2147481368, 2, ) == 0x0
 01581  2016   NtQueryValueKey  (384,  (384, "Transports", Partial, 144, ... , Partial, 144, ...
 01582   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\20\5\0\0" ...  ...
 01581  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01582   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81869, 0}  ... {28, 56, reply, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 01583  2016   NtClose  (384, ...
 01584   896   NtResumeThread  (392, ...
 01583  2016   NtClose  ... ) == 0x0
 01584   896   NtResumeThread  ... 1, ) == 0x0
 01585  1028   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\3551I\360&`\316\224\31\246/\210\315R\265(\350Q\242\12\277\367\31\316\240SW\210\200\315\22Jo\275\351*\6\300\266\371\216\4!\234\0\1\235Ci\242#\375\377\335\314\3524\255{\270\224\22\306\276\266\244\331nN\253\251\20\35\302gT\277\340\241\335", 80, ... , 0, 3,  (-2147481368, "Seed", 0, 3, "\3551I\360&`\316\224\31\246/\210\315R\265(\350Q\242\12\277\367\31\316\240SW\210\200\315\22Jo\275\351*\6\300\266\371\216\4!\234\0\1\235Ci\242#\375\377\335\314\3524\255{\270\224\22\306\276\266\244\331nN\253\251\20\35\302gT\277\340\241\335", 80, ... , 80, ...
 01586   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01585  1028   NtSetValueKey  ... ) == 0x0
 01587  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01588  1296   NtTestAlert  (...
 01589  1028   NtClose  (-2147481368, ...
 01587  2016   NtOpenKey  ... 384, ) == 0x0
 01588  1296   NtTestAlert  ... ) == 0x0
 01589  1028   NtClose  ... ) == 0x0
 01590  2016   NtQueryValueKey  (384,  (384, "Mapping", Partial, 144, ... , Partial, 144, ...
 01591  1296   NtContinue  (44629296, 1, ...
 01544  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\247m\346\3335\353Ur5\351M\320\37F%\264o\12\323hS\1#I\333m\1d"\271\204\226\12Xp\212\203\317\214\205>\261\216\276\263d\215\365\340n\344:\345.(\262,u\211\247\263;\35\312\262\272\237$\15\320V\275\36BQ\336\300\230\204\361wN?u!*\373>}q\244\231\366\16\376\237.M\215\3735_R\3745r\250&)\3779\360<\335Vy\233"Y\376\234\224\244J\325\20rm\221\2342\304\255\12\243?\240\14@#x\307\336\177\304\317\234\240s\342\346\215\307\216\206M\6\370\224e\217\270\321\205\354_\15\256\\365Vj6\326PX\351\374\271\23;\335\212\263\256\177)\2742|\251\270\36d4\306\367\247\324\321\225 \250_\277\352\307\177nFE\345\257\334M,", ) \271\204\226\12Xp\212\203\317\214\205>\261\216\276\263d\215\365\340n\344:\345.(\262,u\211\247\263;\35\312\262\272\237$\15\320V\275\36BQ\336\300\230\204\361wN?u!*\373>}q\244\231\366\16\376\237.M\215\3735_R\3745r\250&)\3779\360<\335Vy\233 ... {status=0x0, info=256}, "\247m\346\3335\353Ur5\351M\320\37F%\264o\12\323hS\1#I\333m\1d"\271\204\226\12Xp\212\203\317\214\205>\261\216\276\263d\215\365\340n\344:\345.(\262,u\211\247\263;\35\312\262\272\237$\15\320V\275\36BQ\336\300\230\204\361wN?u!*\373>}q\244\231\366\16\376\237.M\215\3735_R\3745r\250&)\3779\360<\335Vy\233"Y\376\234\224\244J\325\20rm\221\2342\304\255\12\243?\240\14@#x\307\336\177\304\317\234\240s\342\346\215\307\216\206M\6\370\224e\217\270\321\205\354_\15\256\\365Vj6\326PX\351\374\271\23;\335\212\263\256\177)\2742|\251\270\36d4\306\367\247\324\321\225 \250_\277\352\307\177nFE\345\257\334M,", ) \376\234\224\244J\325\20rm\221\2342\304\255\12\243?\240\14@#x\307\336\177\304\317\234\240s\342\346\215\307\216\206M\6\370\224e\217\270\321\205\354_\15\256\\365Vj6\326PX\351\374\271\23;\335\212\263\256\177)\2742|\251\270\36d4\306\367\247\324\321\225 \250_\277\352\307\177nFE\345\257\334M,", ) == 0x0
 01590  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01592  1296   NtRegisterThreadTerminatePort  (24, ...
 01593  1028   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01594  2016   NtQueryValueKey  (384,  (384, "Mapping", Partial, 144, ... , Partial, 144, ...
 01592  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 01586   896   NtAllocateVirtualMemory  ... 44630016, 1048576, ) == 0x0
 01594  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01593  1028   NtCreateEvent  ... 396, ) == 0x0
 01595   896   NtAllocateVirtualMemory  (-1, 45670400, 0, 8192, 4096, 4, ...
 01596  1296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01597  1028   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 16313860, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 16313860, 188, ...
 01595   896   NtAllocateVirtualMemory  ... 45670400, 8192, ) == 0x0
 01596  1296   NtDuplicateObject  ... 400, ) == 0x0
 01598   896   NtProtectVirtualMemory  (-1, (0x2b8e000), 4096, 260, ...
 01599  1296   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01598   896   NtProtectVirtualMemory  ... (0x2b8e000), 4096, 4, ) == 0x0
 01599  1296   NtWaitForSingleObject  ... ) == 0x102
 01600   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01601  1296   NtWaitForSingleObject  (132, 0, 0x0, ...
 01602  2016   NtQueryValueKey  (384,  (384, "Mapping", Partial, 152, ... , Partial, 152, ...
 01597  1028   NtConnectPort  ... 404, 0x0, 0x0, 0x0, 188, ) == 0x0
 01600   896   NtCreateThread  ... 408, {1252, 440}, ) == 0x0
 01602  2016   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01603  1028   NtRequestWaitReplyPort  (404, {200, 224, new_msg, 0, 1381216, 12, 2, 1310721}  (404, {200, 224, new_msg, 0, 1381216, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230\20\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\302:\6f\13J\322m\20\23\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\350\22\25\0\256\353\237\371x\1\24\0\10\23\25\0h\1\24\0\0\0\0\0\0\0\0\0\10\23\25\0P\0\0\0\20\23\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\370\0\372\31\221|\30\364\370\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01604   896   NtQueryInformationThread  (408, Basic, 28, ...
 01605  2016   NtClose  (384, ...
 01604   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 01605  2016   NtClose  ... ) == 0x0
 01603  1028   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1028, 81871, 0}  ... {200, 224, reply, 0, 1252, 1028, 81871, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\302:\6f\13J\322m\20\23\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\350\22\25\0\256\353\237\371x\1\24\0\10\23\25\0h\1\24\0\0\0\0\0\0\0\0\0\10\23\25\0P\0\0\0\20\23\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\370\0\372\31\221|\30\364\370\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01606   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\0\270\1\0\0" ...  ...
 01607  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01608  1028   NtRequestWaitReplyPort  (404, {64, 88, new_msg, 0, 0, 0, 0, 0}  (404, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 01606   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81872, 0}  ... {28, 56, reply, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 01607  2016   NtOpenKey  ... 384, ) == 0x0
 01609   896   NtResumeThread  (408, ... 1, ) == 0x0
 01610   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 45678592, 1048576, ) == 0x0
 01611   896   NtAllocateVirtualMemory  (-1, 46718976, 0, 8192, 4096, 4, ... 46718976, 8192, ) == 0x0
 01612   896   NtProtectVirtualMemory  (-1, (0x2c8e000), 4096, 260, ... (0x2c8e000), 4096, 4, ) == 0x0
 01613   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01614  2016   NtQueryValueKey  (384,  (384, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01608  1028   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 1028, 81873, 0}  ... {52, 76, reply, 0, 1252, 1028, 81873, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 01615   440   NtTestAlert  (...
 01614  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01616  1028   NtClose  (396, ...
 01615   440   NtTestAlert  ... ) == 0x0
 01617  2016   NtQueryValueKey  (384,  (384, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01616  1028   NtClose  ... ) == 0x0
 01618   440   NtContinue  (45677872, 1, ...
 01617  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01619  1028   NtClose  (404, ...
 01620   440   NtRegisterThreadTerminatePort  (24, ...
 01621  2016   NtQueryValueKey  (384,  (384, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 01619  1028   NtClose  ... ) == 0x0
 01620   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 01621  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01622  1028   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01613   896   NtCreateThread  ... 404, {1252, 1588}, ) == 0x0
 01623   440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01624  2016   NtQueryValueKey  (384,  (384, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01625   896   NtQueryInformationThread  (404, Basic, 28, ...
 01623   440   NtDuplicateObject  ... 396, ) == 0x0
 01624  2016   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01625   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 01626   440   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01627  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11072556, ... }, 11072556, ...
 01628   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\04\6\0\0" ...  ...
 01626   440   NtWaitForSingleObject  ... ) == 0x102
 01627  2016   NtQueryAttributesFile  ... ) == 0x0
 01628   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81875, 0}  ... {28, 56, reply, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 01629   440   NtWaitForSingleObject  (132, 0, 0x0, ...
 01630  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01622  1028   NtCreateKey  ... 412, 2, ) == 0x0
 01631   896   NtResumeThread  (404, ...
 01630  2016   NtOpenFile  ... 416, {status=0x0, info=1}, ) == 0x0
 01632  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01631   896   NtResumeThread  ... 1, ) == 0x0
 01632  1028   NtOpenKey  ... 420, ) == 0x0
 01633   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01634  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01633   896   NtAllocateVirtualMemory  ... 46727168, 1048576, ) == 0x0
 01634  1028   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01635   896   NtAllocateVirtualMemory  (-1, 47767552, 0, 8192, 4096, 4, ...
 01636  1028   NtQueryValueKey  (412,  (412, "Hostname", Partial, 144, ... , Partial, 144, ...
 01635   896   NtAllocateVirtualMemory  ... 47767552, 8192, ) == 0x0
 01637  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 416, ...
 01638  1588   NtWaitForSingleObject  (100, 0, 0x0, ...
 01636  1028   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01637  2016   NtCreateSection  ... 424, ) == 0x0
 01639  1028   NtQueryValueKey  (412,  (412, "Hostname", Partial, 144, ... , Partial, 144, ...
 01640  2016   NtClose  (416, ...
 01639  1028   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01640  2016   NtClose  ... ) == 0x0
 01641  1028   NtClose  (412, ...
 01642  2016   NtMapViewOfSection  (424, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01641  1028   NtClose  ... ) == 0x0
 01642  2016   NtMapViewOfSection  ... (0x860000), 0x0, 20480, ) == 0x0
 01643  1028   NtClose  (420, ...
 01644   896   NtProtectVirtualMemory  (-1, (0x2d8e000), 4096, 260, ...
 01645  2016   NtClose  (424, ...
 01644   896   NtProtectVirtualMemory  ... (0x2d8e000), 4096, 4, ) == 0x0
 01645  2016   NtClose  ... ) == 0x0
 01646   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 424, {1252, 2044}, ) == 0x0
 01647   896   NtQueryInformationThread  (424, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 01648  2016   NtUnmapViewOfSection  (-1, 0x860000, ...
 01643  1028   NtClose  ... ) == 0x0
 01648  2016   NtUnmapViewOfSection  ... ) == 0x0
 01649  1028   NtWaitForSingleObject  (100, 0, 0x0, ...
 01650   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\374\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81876, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 01651   896   NtResumeThread  (424, ... 1, ) == 0x0
 01652   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 47775744, 1048576, ) == 0x0
 01653   896   NtAllocateVirtualMemory  (-1, 48816128, 0, 8192, 4096, 4, ... 48816128, 8192, ) == 0x0
 01654   896   NtProtectVirtualMemory  (-1, (0x2e8e000), 4096, 260, ... (0x2e8e000), 4096, 4, ) == 0x0
 01655   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01656  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11072864, ... }, 11072864, ...
 01657  2044   NtWaitForSingleObject  (100, 0, 0x0, ...
 01656  2016   NtQueryAttributesFile  ... ) == 0x0
 01658  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 420, {status=0x0, info=1}, ) }, 5, 96, ... 420, {status=0x0, info=1}, ) == 0x0
 01659  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 420, ... 412, ) == 0x0
 01660  2016   NtQuerySection  (412, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01661  2016   NtClose  (420, ... ) == 0x0
 01662  2016   NtMapViewOfSection  (412, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01655   896   NtCreateThread  ... 420, {1252, 588}, ) == 0x0
 01663   896   NtQueryInformationThread  (420, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 01664   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0L\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0L\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81877, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0L\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 01665   896   NtResumeThread  (420, ... 1, ) == 0x0
 01666   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 48824320, 1048576, ) == 0x0
 01667   896   NtAllocateVirtualMemory  (-1, 49864704, 0, 8192, 4096, 4, ... 49864704, 8192, ) == 0x0
 01668  2016   NtClose  (412, ...
 01669   588   NtWaitForSingleObject  (100, 0, 0x0, ...
 01668  2016   NtClose  ... ) == 0x0
 01670  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ... (0x71a91000), 4096, 32, ) == 0x0
 01671  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 01672  2016   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 01673   896   NtProtectVirtualMemory  (-1, (0x2f8e000), 4096, 260, ... (0x2f8e000), 4096, 4, ) == 0x0
 01674   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 412, {1252, 1652}, ) == 0x0
 01675   896   NtQueryInformationThread  (412, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 01676  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01677  2016   NtSetEventBoostPriority  (100, ...
 01638  1588   NtWaitForSingleObject  ... ) == 0x0
 01678  1588   NtSetEventBoostPriority  (100, ...
 01649  1028   NtWaitForSingleObject  ... ) == 0x0
 01679  1028   NtSetEventBoostPriority  (100, ...
 01657  2044   NtWaitForSingleObject  ... ) == 0x0
 01680  2044   NtSetEventBoostPriority  (100, ...
 01669   588   NtWaitForSingleObject  ... ) == 0x0
 01681   588   NtTestAlert  (... ) == 0x0
 01680  2044   NtSetEventBoostPriority  ... ) == 0x0
 01679  1028   NtSetEventBoostPriority  ... ) == 0x0
 01678  1588   NtSetEventBoostPriority  ... ) == 0x0
 01677  2016   NtSetEventBoostPriority  ... ) == 0x0
 01682   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0t\6\0\0" ...  ...
 01683   588   NtContinue  (48823600, 1, ...
 01684  2044   NtTestAlert  (...
 01685  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\2377\376\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01686  2016   NtClose  (384, ...
 01682   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81878, 0}  ... {28, 56, reply, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 01687   588   NtRegisterThreadTerminatePort  (24, ...
 01684  2044   NtTestAlert  ... ) == 0x0
 01688  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01686  2016   NtClose  ... ) == 0x0
 01689   896   NtResumeThread  (412, ...
 01687   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01690  2044   NtContinue  (47775024, 1, ...
 01688  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01691  1588   NtTestAlert  (...
 01689   896   NtResumeThread  ... 1, ) == 0x0
 01692   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01693  2044   NtRegisterThreadTerminatePort  (24, ...
 01694  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01691  1588   NtTestAlert  ... ) == 0x0
 01695   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01692   588   NtDuplicateObject  ... 384, ) == 0x0
 01693  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 01694  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01696  1588   NtContinue  (46726448, 1, ...
 01697  2016   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11075200, 67, ... }, 0x0, 0, 3, 3, 0, 11075200, 67, ...
 01698  1652   NtTestAlert  (...
 01699   588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01700  2044   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01701  1028   NtQuerySystemInformation  (Performance, 312, ...
 01702  1588   NtRegisterThreadTerminatePort  (24, ...
 01697  2016   NtCreateFile  ... 416, {status=0x0, info=0}, ) == 0x0
 01698  1652   NtTestAlert  ... ) == 0x0
 01695   896   NtAllocateVirtualMemory  ... 49872896, 1048576, ) == 0x0
 01699   588   NtWaitForSingleObject  ... ) == 0x102
 01700  2044   NtDuplicateObject  ... 428, ) == 0x0
 01702  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01703  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x1207b,  (416, 112, 0x0, 0x0, 0x1207b, "\7\0\0\0\260\4\24\0\340\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 01704  1652   NtContinue  (49872176, 1, ...
 01705   896   NtAllocateVirtualMemory  (-1, 50913280, 0, 8192, 4096, 4, ...
 01706   588   NtWaitForSingleObject  (132, 0, 0x0, ...
 01707  2044   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 01708  1588   NtWaitForSingleObject  (296, 0, 0x0, ...
 01701  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01709  1652   NtRegisterThreadTerminatePort  (24, ...
 01705   896   NtAllocateVirtualMemory  ... 50913280, 8192, ) == 0x0
 01707  2044   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 01703  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01710  1028   NtQuerySystemInformation  (Exception, 16, ...
 01709  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 01711   896   NtProtectVirtualMemory  (-1, (0x308e000), 4096, 260, ...
 01712  2044   NtSetEventBoostPriority  (296, ...
 01713  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x1207b,  (416, 112, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", 16, 16, ... , 16, 16, ...
 01710  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01711   896   NtProtectVirtualMemory  ... (0x308e000), 4096, 4, ) == 0x0
 01708  1588   NtWaitForSingleObject  ... ) == 0x0
 01712  2044   NtSetEventBoostPriority  ... ) == 0x0
 01713  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01714  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01715  1588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01716   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01717  2044   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01718  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x12047,  (416, 112, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 01715  1588   NtDuplicateObject  ... 432, ) == 0x0
 01714  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01719  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01716   896   NtCreateThread  ... 436, {1252, 1376}, ) == 0x0
 01720  1588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01718  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 01721  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01719  1652   NtDuplicateObject  ... 440, ) == 0x0
 01722   896   NtQueryInformationThread  (436, Basic, 28, ...
 01723  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ...
 01717  2044   NtWaitForSingleObject  ... ) == 0x102
 01720  1588   NtWaitForSingleObject  ... ) == 0x102
 01724  1652   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01722   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 01721  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01725  2044   NtWaitForSingleObject  (132, 0, 0x0, ...
 01726  1588   NtWaitForSingleObject  (132, 0, 0x0, ...
 01724  1652   NtWaitForSingleObject  ... ) == 0x102
 01727   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0`\5\0\0" ...  ...
 01728  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01729  1652   NtWaitForSingleObject  (132, 0, 0x0, ...
 01727   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 01728  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01723  2016   NtWaitForSingleObject  ... ) == 0x102
 01730  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01731  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x12003,  (416, 112, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 01730  1028   NtCreateKey  ... -2147481368, 2, ) == 0x0
 01732  1028   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\264\20+\376\6[\250\250\276\10:n>\3\352b\7\225*q\226\312\340\27\332\324\265\377\257\27-\277\203(\274\15\350QW\233\370G\266\255qS\2>I/L\377DU\277\264\331kN\360E\23\335.X\360J`\226\353 Xo\213B\360d;!9", 80, ... ) , 0, 3,  (-2147481368, "Seed", 0, 3, "\264\20+\376\6[\250\250\276\10:n>\3\352b\7\225*q\226\312\340\27\332\324\265\377\257\27-\277\203(\274\15\350QW\233\370G\266\255qS\2>I/L\377DU\277\264\331kN\360E\23\335.X\360J`\226\353 Xo\213B\360d;!9", 80, ... ) , 80, ... ) == 0x0
 01733  1028   NtClose  (-2147481368, ... ) == 0x0
 01685  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\353\255\353\3z\271\323J\323o\370\270\25\13\3134\4\\355V\364\11w\244\324w\217\324\301\201\6\272\\317\264\232\264\243?\255\226\234\334\223\307\3721\224v,\216R\374\6\25\252!\254/[p\227\26\216n#f;\247\250\346\14\211\326\250\315\263\32/\214|\224\356S$\365\23\17\317\362\304\374PU\336\16\221\341\362i\10\206\347\362\370\341\250(\362@\241{\236\302#\210\35n\325v\220\220>Ji\363\2429\231\202\372\242&~~\212\211\354\373Id\267\374\376\212\273U0)E)\350\177\2602\2\23p\253\273t8n\17\240X\331\37(U\255nP\0\203#\23;\33\211\13''F\233\314\332&j\0\337Gz\315\303\26\241\216\335\257I\347M-\226/\320f\203\362%\231\3\23E\373\33\355\243;\4\232\340.79\7\317\236\2\3\356T$CZ\371\12r\2634\311f\377\206q\177?D\315\23^\335\264c", ) , ) == 0x0
 01734  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\237'\205\372\3242\214\277\30\5\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01735  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01736   896   NtResumeThread  (436, ...
 01731  2016   NtDeviceIoControlFile  ... {status=0x0, info=444},  ... {status=0x0, info=444}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01736   896   NtResumeThread  ... 1, ) == 0x0
 01737  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x12047,  (416, 112, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01738   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01737  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01738   896   NtAllocateVirtualMemory  ... 50921472, 1048576, ) == 0x0
 01739  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x12037,  (416, 112, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 01740   896   NtAllocateVirtualMemory  (-1, 51961856, 0, 8192, 4096, 4, ...
 01739  2016   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01740   896   NtAllocateVirtualMemory  ... 51961856, 8192, ) == 0x0
 01741  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x1200b,  (416, 112, 0x0, 0x0, 0x1200b, "\0\376\250\0\5\0\0\0\0\255\24\0", 12, 0, ... , 12, 0, ...
 01735  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01742  1376   NtTestAlert  (...
 01743   896   NtProtectVirtualMemory  (-1, (0x318e000), 4096, 260, ...
 01744  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01742  1376   NtTestAlert  ... ) == 0x0
 01743   896   NtProtectVirtualMemory  ... (0x318e000), 4096, 4, ) == 0x0
 01744  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01745  1376   NtContinue  (50920752, 1, ...
 01746   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01747  1028   NtQuerySystemInformation  (Performance, 312, ...
 01748  1376   NtRegisterThreadTerminatePort  (24, ...
 01746   896   NtCreateThread  ... 448, {1252, 1436}, ) == 0x0
 01747  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01748  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 01749   896   NtQueryInformationThread  (448, Basic, 28, ...
 01750  1028   NtQuerySystemInformation  (Exception, 16, ...
 01741  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01749   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 01751  1376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01752  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x12047,  (416, 112, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\250\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01750  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01751  1376   NtDuplicateObject  ... 452, ) == 0x0
 01752  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01753  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01754  1376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01755  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 01753  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01754  1376   NtWaitForSingleObject  ... ) == 0x102
 01755  2016   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01756  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01757  1376   NtWaitForSingleObject  (132, 0, 0x0, ...
 01758  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01756  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01759   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0\234\5\0\0" ...  ...
 01760  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01759   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81880, 0}  ... {28, 56, reply, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 01758  2016   NtCreateEvent  ... 456, ) == 0x0
 01761   896   NtResumeThread  (448, ...
 01762  2016   NtWaitForSingleObject  (456, 0, 0x0, ...
 01761   896   NtResumeThread  ... 1, ) == 0x0
 01763   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 51970048, 1048576, ) == 0x0
 01764   896   NtAllocateVirtualMemory  (-1, 53010432, 0, 8192, 4096, 4, ... 53010432, 8192, ) == 0x0
 01765   896   NtProtectVirtualMemory  (-1, (0x328e000), 4096, 260, ... (0x328e000), 4096, 4, ) == 0x0
 01766   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01760  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01767  1436   NtTestAlert  (...
 01768  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01767  1436   NtTestAlert  ... ) == 0x0
 01768  1028   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01769  1436   NtContinue  (51969328, 1, ...
 01770  1028   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\2667\361\355\316_\237p\212\316\13\240o!\273c\310e\31L\302\4\336\262\231\254\212\30\200~Z\230q\302\356\345\4\337\36+~\261\357\313\355b\202RgL\230\374\2276\2034)\265\16\201R\177 w}%g\300\347\330\202\25e!\233\345\324\31\247\335", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\2667\361\355\316_\237p\212\316\13\240o!\273c\310e\31L\302\4\336\262\231\254\212\30\200~Z\230q\302\356\345\4\337\36+~\261\357\313\355b\202RgL\230\374\2276\2034)\265\16\201R\177 w}%g\300\347\330\202\25e!\233\345\324\31\247\335", 80, ... , 80, ...
 01771  1436   NtRegisterThreadTerminatePort  (24, ...
 01770  1028   NtSetValueKey  ... ) == 0x0
 01771  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 01772  1028   NtClose  (-2147481484, ...
 01766   896   NtCreateThread  ... 460, {1252, 1368}, ) == 0x0
 01773  1436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01774   896   NtQueryInformationThread  (460, Basic, 28, ...
 01773  1436   NtDuplicateObject  ... 464, ) == 0x0
 01774   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 01775  1436   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01776   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0X\5\0\0" ...  ...
 01775  1436   NtWaitForSingleObject  ... ) == 0x102
 01776   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 01777  1436   NtWaitForSingleObject  (132, 0, 0x0, ...
 01772  1028   NtClose  ... ) == 0x0
 01778   896   NtResumeThread  (460, ...
 01734  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\350T\231\256Z\337\243kc\10\323\254&\217\233E\3667d\210\325\224\165\30\335\323h\273\212lt13\332B\202\340\346#'?q0\213\236*\230\7\267P\12\246)\215\317\242]\260\16\251n\212\314K\310\2363\4\21\226i\375S}\23\4\362a\30>`\6\2506\316\317\342\345?N\305W\264,\234\5\21|R\326z\221o\277\220j\347\235\316\11b\240$\231\7\343\16\270\152\352\253k\242Dl\217\355\350A\217\346A\321g\354n-\337]#\4o\7z\221\27E\31{\33\216\254@\333\362\337\3157\276\210y\271\371\25Z\307\206 \257\352\250\235\357:@\207\273\2106\304\12Y'%"q\274\343\200;[\345?P\346y\366\8\252F\333\233\241@\202G\351\372p\24\302\265\277#\2602\311\305\322'\350\261#/\220\207\250\177\15B\264\205\246\24\256\367K\25\244z5n\356\377%\205\'\320L\326", ) q\274\343\200;[\345?P\346y\366\8\252F\333\233\241@\202G\351\372p\24\302\265\277#\2602\311\305\322'\350\261#/\220\207\250\177\15B\264\205\246\24\256\367K\25\244z5n\356\377%\205\'\320L\326", ) == 0x0
 01778   896   NtResumeThread  ... 1, ) == 0x0
 01779  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\237'\205\372\3242\214\277\10~\372\3242\214\277\30\5\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01780   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01781  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01780   896   NtAllocateVirtualMemory  ... 53018624, 1048576, ) == 0x0
 01781  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01782   896   NtAllocateVirtualMemory  (-1, 54059008, 0, 8192, 4096, 4, ...
 01783  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01782   896   NtAllocateVirtualMemory  ... 54059008, 8192, ) == 0x0
 01784  1368   NtTestAlert  (...
 01783  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01784  1368   NtTestAlert  ... ) == 0x0
 01785  1028   NtQuerySystemInformation  (Performance, 312, ...
 01786  1368   NtContinue  (53017904, 1, ...
 01785  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01787  1368   NtRegisterThreadTerminatePort  (24, ...
 01788  1028   NtQuerySystemInformation  (Exception, 16, ...
 01787  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 01788  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01789   896   NtProtectVirtualMemory  (-1, (0x338e000), 4096, 260, ...
 01790  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01789   896   NtProtectVirtualMemory  ... (0x338e000), 4096, 4, ) == 0x0
 01791  1368   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01792   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01791  1368   NtDuplicateObject  ... 468, ) == 0x0
 01792   896   NtCreateThread  ... 472, {1252, 724}, ) == 0x0
 01793  1368   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01794   896   NtQueryInformationThread  (472, Basic, 28, ...
 01793  1368   NtWaitForSingleObject  ... ) == 0x102
 01794   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 01795  1368   NtWaitForSingleObject  (132, 0, 0x0, ...
 01790  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01796   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0\324\2\0\0" ...  ...
 01797  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01796   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 01797  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01798   896   NtResumeThread  (472, ...
 01799  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01798   896   NtResumeThread  ... 1, ) == 0x0
 01799  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01800   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01801  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01802   724   NtTestAlert  (...
 01800   896   NtAllocateVirtualMemory  ... 54067200, 1048576, ) == 0x0
 01802   724   NtTestAlert  ... ) == 0x0
 01803   896   NtAllocateVirtualMemory  (-1, 55107584, 0, 8192, 4096, 4, ...
 01804   724   NtContinue  (54066480, 1, ...
 01803   896   NtAllocateVirtualMemory  ... 55107584, 8192, ) == 0x0
 01805   724   NtRegisterThreadTerminatePort  (24, ...
 01806   896   NtProtectVirtualMemory  (-1, (0x348e000), 4096, 260, ...
 01805   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 01806   896   NtProtectVirtualMemory  ... (0x348e000), 4096, 4, ) == 0x0
 01801  1028   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01807   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01808  1028   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\304<\373X\324C\347\3540a,\266E\20\2460\314maYcIU\247^\342QX\352\353\364n\307\27-\35c\2407\320\367\307%O\353\177\256\34B\337P\27\366\23K\177\306q\325\33\246\321dR\24\327\3453t\206\276^\371b'\2\262\36\241\314", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\304<\373X\324C\347\3540a,\266E\20\2460\314maYcIU\247^\342QX\352\353\364n\307\27-\35c\2407\320\367\307%O\353\177\256\34B\337P\27\366\23K\177\306q\325\33\246\321dR\24\327\3453t\206\276^\371b'\2\262\36\241\314", 80, ... , 80, ...
 01809   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01808  1028   NtSetValueKey  ... ) == 0x0
 01809   724   NtDuplicateObject  ... 476, ) == 0x0
 01810  1028   NtClose  (-2147481484, ...
 01811   724   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01810  1028   NtClose  ... ) == 0x0
 01811   724   NtWaitForSingleObject  ... ) == 0x102
 01779  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\313\374\\2626\225\302#A\361v\221'\36\261\275~s\247.\261>bv\21\202\361\272'\372\302@\231\245\332\177RF\326\365\262$\254\313\257\316\230E\211s\334\201\341\344\13I#\376\375\205\306\360\257`\215\353Qr\331\226\315X\256\200>\320\4\267*\231\6\307\213\177\357\3421Yo.\255\275mV\3337\235\330\312\371>\344\204\255\320;Q\334d\11\15f\323\2132\32\214\254u\335\230;*H\17\206\201\207r\346\274\30\210VX\36\276]\177\211\221n\323\7\236b.1\334\33\305$V\!\266\356\255q\16\345\304\321\362P]U\35Z\6\203d?\212\27\247\222[\276e\230\232\260\13\2\317^f\26\307`u\30\363\353&\235[*\372m\211F^\211\250\1^\256A\270\307\341y-\27539(\230\364\27\272\325\376\343\346\3364iD\3543\34\353I\306\257\321Q\277\313\343\306htd\373\22ly\375L\220\301", ) , ) == 0x0
 01812   724   NtWaitForSingleObject  (132, 0, 0x0, ...
 01807   896   NtCreateThread  ... 480, {1252, 1276}, ) == 0x0
 01813  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\237'\205\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\30\5\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01814   896   NtQueryInformationThread  (480, Basic, 28, ...
 01815  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01814   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 01815  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01816   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" ...  ...
 01817  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01816   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 01817  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01818  1028   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01819  1028   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01820  1028   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01821  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01822   896   NtResumeThread  (480, ... 1, ) == 0x0
 01823   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 55115776, 1048576, ) == 0x0
 01824   896   NtAllocateVirtualMemory  (-1, 56156160, 0, 8192, 4096, 4, ... 56156160, 8192, ) == 0x0
 01825   896   NtProtectVirtualMemory  (-1, (0x358e000), 4096, 260, ... (0x358e000), 4096, 4, ) == 0x0
 01826   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 484, {1252, 220}, ) == 0x0
 01827   896   NtQueryInformationThread  (484, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 01821  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01828  1276   NtTestAlert  (...
 01829  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01828  1276   NtTestAlert  ... ) == 0x0
 01829  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01830  1276   NtContinue  (55115056, 1, ...
 01831  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01832  1276   NtRegisterThreadTerminatePort  (24, ...
 01831  1028   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01832  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 01833  1028   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\315\314\215\241\205\236\222\337W]\356\250\20V\232\247\230<+S1\303_\221;\343\363>\36\223\276\33d\3527\372\216\244\2506\345\244\327\324,\177\301\21dXhD\331\240W\253\2217\210\357\374\316V\2402#\244'&~:\340\341\34\31>\203\355C\375", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\315\314\215\241\205\236\222\337W]\356\250\20V\232\247\230<+S1\303_\221;\343\363>\36\223\276\33d\3527\372\216\244\2506\345\244\327\324,\177\301\21dXhD\331\240W\253\2217\210\357\374\316V\2402#\244'&~:\340\341\34\31>\203\355C\375", 80, ... , 80, ...
 01834   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0\334\0\0\0" ...  ...
 01835  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01834   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 01835  1276   NtDuplicateObject  ... 488, ) == 0x0
 01836   896   NtResumeThread  (484, ...
 01837  1276   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01836   896   NtResumeThread  ... 1, ) == 0x0
 01837  1276   NtWaitForSingleObject  ... ) == 0x102
 01838   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01839  1276   NtWaitForSingleObject  (132, 0, 0x0, ...
 01833  1028   NtSetValueKey  ... ) == 0x0
 01840   220   NtTestAlert  (...
 01838   896   NtAllocateVirtualMemory  ... 56164352, 1048576, ) == 0x0
 01841  1028   NtClose  (-2147481484, ...
 01840   220   NtTestAlert  ... ) == 0x0
 01842   896   NtAllocateVirtualMemory  (-1, 57204736, 0, 8192, 4096, 4, ...
 01841  1028   NtClose  ... ) == 0x0
 01843   220   NtContinue  (56163632, 1, ...
 01842   896   NtAllocateVirtualMemory  ... 57204736, 8192, ) == 0x0
 01813  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\236\227x\\242%\323P-S\5\274\31\221\332o\253"1\332\340\363\301\206\305\2\2423\270\247\374\227\323H\300\373\244\303\217U\267\351\226DG\251A\365\333\215te\375V\317F!\211=\\365V\335\200a\377*\334\306\270\340Zo\260\215TP\304\304u\245\274\3773+\251\340\373\277O\354\301\215\342\261jiA\5_=\325i[\3751\352=\11\37Q\300\203\31\210-Cx\270\246\313\231\305a\332u\270\2008\221>,U\314\370\313.W:=\234\240a\1\327\200\4\14\27\371\366\227\346\225D/-\367\0\314\250\370\240\234lO\360\364.\342\263\361\357\267h\374\374\327N\375%0\345\10\225A\263\224\247\24h\202\243q=\335\370D\267\325#\7E\273\2303\10\324\253\244\334\s\370;\32\362\260R\200'M\322\353\377\313l\242`\317\371\333\222\365~\255\217\365\321\10*J\223\23\15??\22\254r\336\225\325\303\312_", ) 1\332\340\363\301\206\305\2\2423\270\247\374\227\323H\300\373\244\303\217U\267\351\226DG\251A\365\333\215te\375V\317F!\211=\\365V\335\200a\377*\334\306\270\340Zo\260\215TP\304\304u\245\274\3773+\251\340\373\277O\354\301\215\342\261jiA\5_=\325i[\3751\352=\11\37Q\300\203\31\210-Cx\270\246\313\231\305a\332u\270\2008\221>,U\314\370\313.W:=\234\240a\1\327\200\4\14\27\371\366\227\346\225D/-\367\0\314\250\370\240\234lO\360\364.\342\263\361\357\267h\374\374\327N\375%0\345\10\225A\263\224\247\24h\202\243q=\335\370D\267\325#\7E\273\2303\10\324\253\244\334\s\370;\32\362\260R\200'M\322\353\377\313l\242`\317\371\333\222\365~\255\217\365\321\10*J\223\23\15??\22\254r\336\225\325\303\312_", ) == 0x0
 01844   220   NtRegisterThreadTerminatePort  (24, ...
 01845   896   NtProtectVirtualMemory  (-1, (0x368e000), 4096, 260, ...
 01846  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\237'\205\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\30\5\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01844   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 01845   896   NtProtectVirtualMemory  ... (0x368e000), 4096, 4, ) == 0x0
 01847  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01848   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01849   220   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01847  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01849   220   NtDuplicateObject  ... 492, ) == 0x0
 01850  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01851   220   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01850  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01851   220   NtWaitForSingleObject  ... ) == 0x102
 01852  1028   NtQuerySystemInformation  (Performance, 312, ...
 01853   220   NtWaitForSingleObject  (132, 0, 0x0, ...
 01852  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01848   896   NtCreateThread  ... 496, {1252, 1328}, ) == 0x0
 01854  1028   NtQuerySystemInformation  (Exception, 16, ...
 01855   896   NtQueryInformationThread  (496, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 01856   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\00\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 01857   896   NtResumeThread  (496, ... 1, ) == 0x0
 01858   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01854  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01859  1328   NtTestAlert  (...
 01860  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01859  1328   NtTestAlert  ... ) == 0x0
 01860  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01861  1328   NtContinue  (57212208, 1, ...
 01862  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01863  1328   NtRegisterThreadTerminatePort  (24, ...
 01862  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01863  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 01864  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01858   896   NtAllocateVirtualMemory  ... 57212928, 1048576, ) == 0x0
 01865  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01866   896   NtAllocateVirtualMemory  (-1, 58253312, 0, 8192, 4096, 4, ...
 01865  1328   NtDuplicateObject  ... 500, ) == 0x0
 01866   896   NtAllocateVirtualMemory  ... 58253312, 8192, ) == 0x0
 01867  1328   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 01868   896   NtProtectVirtualMemory  (-1, (0x378e000), 4096, 260, ...
 01867  1328   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 01868   896   NtProtectVirtualMemory  ... (0x378e000), 4096, 4, ) == 0x0
 01869  1328   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01870   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01869  1328   NtWaitForSingleObject  ... ) == 0x102
 01864  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01871  1328   NtWaitForSingleObject  (132, 0, 0x0, ...
 01872  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01873  1028   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\362D\313\11\372\244\317\210\252\315\213jY\365\251\272M\13\234Y\372\234\304u\274Pb\307\22=A?wE\214h\315Z\24P\2214\307u/\221\356\211%\313Q\261\222\357\347\200\30\321\217\3\16\267\10\253\365\2729 \365'9\246M\2408TZ=\31\347", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\362D\313\11\372\244\317\210\252\315\213jY\365\251\272M\13\234Y\372\234\304u\274Pb\307\22=A?wE\214h\315Z\24P\2214\307u/\221\356\211%\313Q\261\222\357\347\200\30\321\217\3\16\267\10\253\365\2729 \365'9\246M\2408TZ=\31\347", 80, ... ) , 80, ... ) == 0x0
 01874  1028   NtClose  (-2147481484, ... ) == 0x0
 01846  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\301\253"G\361M\325_\373\364\227\335\275\366\27\241\227\266\353\351\177\212g\351\301\365\10<\322\2\226\11\240\273T\232\312"\366\345>\331a\366\355\314\37\226\2\334-\346L\315\277\374\304\265$z\27bN\257\363\234A\341\252\14\202\367\331\313\207YL\21/pc\363\317\327\36\254:\363\346>\325\241:\20\350f\21\214\355\7y\370)5$\273\252D\305\20\363\33\361\360\214\272\214\305\230\300Th\202\252(\216%\371|SaH\271d\202\266\325\327;MR\235\360\10{\316<\266\220\365e\217{7\331%\362\2206\2T\216\P`i\227$\350\240z;y\16\1M\370\316\207\3\347\247\277\2287[*\37=\3438\237\311n/\215\32.\331\234\30t\351.\376\\3\275t\220\367?\365}\27\311\352S\327o>\307\11\233^\251\35\324L\7\243R\5\14\263\317\211\33\227.\36\271W\304\2653\252[\261\346sY\310s", ) G\361M\325_\373\364\227\335\275\366\27\241\227\266\353\351\177\212g\351\301\365\10<\322\2\226\11\240\273T\232\312 ... {status=0x0, info=256}, "\301\253"G\361M\325_\373\364\227\335\275\366\27\241\227\266\353\351\177\212g\351\301\365\10<\322\2\226\11\240\273T\232\312"\366\345>\331a\366\355\314\37\226\2\334-\346L\315\277\374\304\265$z\27bN\257\363\234A\341\252\14\202\367\331\313\207YL\21/pc\363\317\327\36\254:\363\346>\325\241:\20\350f\21\214\355\7y\370)5$\273\252D\305\20\363\33\361\360\214\272\214\305\230\300Th\202\252(\216%\371|SaH\271d\202\266\325\327;MR\235\360\10{\316<\266\220\365e\217{7\331%\362\2206\2T\216\P`i\227$\350\240z;y\16\1M\370\316\207\3\347\247\277\2287[*\37=\3438\237\311n/\215\32.\331\234\30t\351.\376\\3\275t\220\367?\365}\27\311\352S\327o>\307\11\233^\251\35\324L\7\243R\5\14\263\317\211\33\227.\36\271W\304\2653\252[\261\346sY\310s", ) , ) == 0x0
 01875  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\237'\205\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\30\5\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01876  1028   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01877  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01870   896   NtCreateThread  ... 504, {1252, 1636}, ) == 0x0
 01878   896   NtQueryInformationThread  (504, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 01879   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0d\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 01880   896   NtResumeThread  (504, ... 1, ) == 0x0
 01881   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 58261504, 1048576, ) == 0x0
 01882   896   NtAllocateVirtualMemory  (-1, 59301888, 0, 8192, 4096, 4, ... 59301888, 8192, ) == 0x0
 01877  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01883  1636   NtTestAlert  (...
 01884  1028   NtQuerySystemInformation  (Performance, 312, ...
 01883  1636   NtTestAlert  ... ) == 0x0
 01884  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01885  1636   NtContinue  (58260784, 1, ...
 01886  1028   NtQuerySystemInformation  (Exception, 16, ...
 01887  1636   NtRegisterThreadTerminatePort  (24, ...
 01886  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01887  1636   NtRegisterThreadTerminatePort  ... ) == 0x0
 01888  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01889   896   NtProtectVirtualMemory  (-1, (0x388e000), 4096, 260, ...
 01890  1636   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01889   896   NtProtectVirtualMemory  ... (0x388e000), 4096, 4, ) == 0x0
 01890  1636   NtDuplicateObject  ... 508, ) == 0x0
 01891   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01892  1636   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01891   896   NtCreateThread  ... 512, {1252, 704}, ) == 0x0
 01892  1636   NtWaitForSingleObject  ... ) == 0x102
 01893   896   NtQueryInformationThread  (512, Basic, 28, ...
 01894  1636   NtWaitForSingleObject  (132, 0, 0x0, ...
 01893   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=704,}, 0x0, ) == 0x0
 01888  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01895  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01896  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01897  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01898  1028   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, ""\367\25\307\235\325\225?|qI\270\35\340\221\256Dk\361\324\220g\265\247\371!\27\231\255\244A\261\256\31\274\24\334\316\244F\31\330\324\216\323\3618\241T\327, wZ\273\17W\307[QU*?cL\206\330\233%\223\372\276N"U\311\322\272g", 80, ... ) , 0, 3, " (-2147481484, "Seed", 0, 3, ""\367\25\307\235\325\225?|qI\270\35\340\221\256Dk\361\324\220g\265\247\371!\27\231\255\244A\261\256\31\274\24\334\316\244F\31\330\324\216\323\3618\241T\327, wZ\273\17W\307[QU*?cL\206\330\233%\223\372\276N"U\311\322\272g", 80, ... ) U\311\322\272g", 80, ... ) == 0x0
 01899  1028   NtClose  (-2147481484, ... ) == 0x0
 01875  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "-\301wtq\245K\22t\3168\301\325T\241/\0p\214\323\23\24\307\247\376ldp\347x\244\7\346\201\266d<\256\321\234\206\236u\343\242\207\1\213%\223\346\25\231\356,\20\4\14\6\17z\243\265\366Fz\17\242\203}\365&\230\2158\246Ss\303\7\207\335S\320\331\222q\221"\1Xvf1\371\31r\20\251\225\217z\364\376\375D\216!\336\353\334\376\371\322kQ\214\12\272Hx\2208V\263Ac\36\322\337\267\263\341\224\230\373\336`+B8\214\352\321]\262s\371%\277z\270\336\4^\27;\224|*\3\242\22\205\220\373\26\215d\103w\263\252\236\245\354\343y\226(\316\270c\1<\353t\375J/RK,\210\245_\255>\377w\17\256j\21\345\27\36\3668\253p\301\227_\301\254b\271S"d\201\256h\340\233\312\377\320e\226u\277\236}\340@\345\344`\314#\324\373\379\355\301\177\221\355J\336Q", ) \1Xvf1\371\31r\20\251\225\217z\364\376\375D\216!\336\353\334\376\371\322kQ\214\12\272Hx\2208V\263Ac\36\322\337\267\263\341\224\230\373\336`+B8\214\352\321]\262s\371%\277z\270\336\4^\27;\224|*\3\242\22\205\220\373\26\215d\103w\263\252\236\245\354\343y\226(\316\270c\1<\353t\375J/RK,\210\245_\255>\377w\17\256j\21\345\27\36\3668\253p\301\227_\301\254b\271S ... {status=0x0, info=256}, "-\301wtq\245K\22t\3168\301\325T\241/\0p\214\323\23\24\307\247\376ldp\347x\244\7\346\201\266d<\256\321\234\206\236u\343\242\207\1\213%\223\346\25\231\356,\20\4\14\6\17z\243\265\366Fz\17\242\203}\365&\230\2158\246Ss\303\7\207\335S\320\331\222q\221"\1Xvf1\371\31r\20\251\225\217z\364\376\375D\216!\336\353\334\376\371\322kQ\214\12\272Hx\2208V\263Ac\36\322\337\267\263\341\224\230\373\336`+B8\214\352\321]\262s\371%\277z\270\336\4^\27;\224|*\3\242\22\205\220\373\26\215d\103w\263\252\236\245\354\343y\226(\316\270c\1<\353t\375J/RK,\210\245_\255>\377w\17\256j\21\345\27\36\3668\253p\301\227_\301\254b\271S"d\201\256h\340\233\312\377\320e\226u\277\236}\340@\345\344`\314#\324\373\379\355\301\177\221\355J\336Q", ) , ) == 0x0
 01900   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\300\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\300\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\300\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\300\2\0\0" )  ) == 0x0
 01901   896   NtResumeThread  (512, ... 1, ) == 0x0
 01902   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 59310080, 1048576, ) == 0x0
 01903   896   NtAllocateVirtualMemory  (-1, 60350464, 0, 8192, 4096, 4, ... 60350464, 8192, ) == 0x0
 01904   896   NtProtectVirtualMemory  (-1, (0x398e000), 4096, 260, ... (0x398e000), 4096, 4, ) == 0x0
 01905   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01906  1028   NtDeviceIoControlFile  (380, 0, 0x0, 0x0, 0x390008,  (380, 0, 0x0, 0x0, 0x390008, "\377\237%\255wT\365\14H\344\230\220\6\237'\205\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\10~\372\3242\214\277\30\5\29\265\201\250\365\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01907   704   NtTestAlert  (...
 01908  1028   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01907   704   NtTestAlert  ... ) == 0x0
 01908  1028   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01909   704   NtContinue  (59309360, 1, ...
 01910  1028   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01911   704   NtRegisterThreadTerminatePort  (24, ...
 01910  1028   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01911   704   NtRegisterThreadTerminatePort  ... ) == 0x0
 01912  1028   NtQuerySystemInformation  (Performance, 312, ...
 01905   896   NtCreateThread  ... 516, {1252, 1152}, ) == 0x0
 01913   704   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01914   896   NtQueryInformationThread  (516, Basic, 28, ...
 01913   704   NtDuplicateObject  ... 520, ) == 0x0
 01914   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 01915   704   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01916   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0\200\4\0\0" ...  ...
 01915   704   NtWaitForSingleObject  ... ) == 0x102
 01916   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 01917   704   NtWaitForSingleObject  (132, 0, 0x0, ...
 01912  1028   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01918   896   NtResumeThread  (516, ...
 01919  1028   NtQuerySystemInformation  (Exception, 16, ...
 01918   896   NtResumeThread  ... 1, ) == 0x0
 01919  1028   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01920   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01921  1028   NtQuerySystemInformation  (Lookaside, 32, ...
 01920   896   NtAllocateVirtualMemory  ... 60358656, 1048576, ) == 0x0
 01921  1028   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01922   896   NtAllocateVirtualMemory  (-1, 61399040, 0, 8192, 4096, 4, ...
 01923  1028   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01922   896   NtAllocateVirtualMemory  ... 61399040, 8192, ) == 0x0
 01924  1152   NtTestAlert  (...
 01923  1028   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01924  1152   NtTestAlert  ... ) == 0x0
 01925  1028   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01926  1152   NtContinue  (60357936, 1, ...
 01925  1028   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01927  1152   NtRegisterThreadTerminatePort  (24, ...
 01928  1028   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01927  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 01928  1028   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01929   896   NtProtectVirtualMemory  (-1, (0x3a8e000), 4096, 260, ...
 01930  1028   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\3602\224\325L\372\206\345Crk/\200.L\263\330\236\266%\351`:\37B)\\357GO\240\341\25d\26\24\2\275\371\341\343\371?\235\0\16w1\3060\3\344}\16J\22\2`\351K\265}*\326e].\304\377M\302`\356\15an\317R\316", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\3602\224\325L\372\206\345Crk/\200.L\263\330\236\266%\351`:\37B)\\357GO\240\341\25d\26\24\2\275\371\341\343\371?\235\0\16w1\3060\3\344}\16J\22\2`\351K\265}*\326e].\304\377M\302`\356\15an\317R\316", 80, ... , 80, ...
 01929   896   NtProtectVirtualMemory  ... (0x3a8e000), 4096, 4, ) == 0x0
 01931  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01932   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01931  1152   NtDuplicateObject  ... 524, ) == 0x0
 01932   896   NtCreateThread  ... 528, {1252, 1228}, ) == 0x0
 01933  1152   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01934   896   NtQueryInformationThread  (528, Basic, 28, ...
 01933  1152   NtWaitForSingleObject  ... ) == 0x102
 01934   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 01935  1152   NtWaitForSingleObject  (132, 0, 0x0, ...
 01930  1028   NtSetValueKey  ... ) == 0x0
 01936   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0\314\4\0\0" ...  ...
 01937  1028   NtClose  (-2147481484, ...
 01936   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 01937  1028   NtClose  ... ) == 0x0
 01938   896   NtResumeThread  (528, ...
 01906  1028   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\306\257u\352\305\10[\332\221p\362\30\37\7"N7\21~|F\215k\15\325S\22\177b\14\234\1\220'\200\201\275\224\335\237/\15A\2541\263\353\261\27\225\211\327\23\336oV\206\221@+\211s\233\252\324m\351\370\336t\2\350\273\227\236\305Mx{\\324S\270\25\3210\211\241s\261\353\370;'\201\356\313O\217\271I\30\242\241\215\356\250\312\222\371\377\220\177\301\345DY7S\207\261\372\257\217~\267\214\330\3226}\24\30489\251N\2135e\362\245\355\260&\251\362xt\347n\247\304\8\371L\34\271l\323\313}u\227\215x\225\222\14W\33\303a\362\137\241\237\317uc\4\12r\321a\341.~*\303\332\213\360\277#\222Of\333Ws\1%\342S\304\331\371\213\34.\25\220\374`\233\232iMMJ\231x\274\305C\236\243\260\300\211\351\253\14\377\241=\305C\15\220\33p\20\224h\206\362\217?\347u ", ) N7\21~|F\215k\15\325S\22\177b\14\234\1\220'\200\201\275\224\335\237/\15A\2541\263\353\261\27\225\211\327\23\336oV\206\221@+\211s\233\252\324m\351\370\336t\2\350\273\227\236\305Mx{\\324S\270\25\3210\211\241s\261\353\370;'\201\356\313O\217\271I\30\242\241\215\356\250\312\222\371\377\220\177\301\345DY7S\207\261\372\257\217~\267\214\330\3226}\24\30489\251N\2135e\362\245\355\260&\251\362xt\347n\247\304\8\371L\34\271l\323\313}u\227\215x\225\222\14W\33\303a\362\137\241\237\317uc\4\12r\321a\341.~*\303\332\213\360\277#\222Of\333Ws\1%\342S\304\331\371\213\34.\25\220\374`\233\232iMMJ\231x\274\305C\236\243\260\300\211\351\253\14\377\241=\305C\15\220\33p\20\224h\206\362\217?\347u ", ) == 0x0
 01938   896   NtResumeThread  ... 1, ) == 0x0
 01939  1028   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01940   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01939  1028   NtCreateEvent  ... 532, ) == 0x0
 01941  1228   NtTestAlert  (...
 01940   896   NtAllocateVirtualMemory  ... 61407232, 1048576, ) == 0x0
 01941  1228   NtTestAlert  ... ) == 0x0
 01942   896   NtAllocateVirtualMemory  (-1, 62447616, 0, 8192, 4096, 4, ...
 01943  1228   NtContinue  (61406512, 1, ...
 01942   896   NtAllocateVirtualMemory  ... 62447616, 8192, ) == 0x0
 01944  1228   NtRegisterThreadTerminatePort  (24, ...
 01945   896   NtProtectVirtualMemory  (-1, (0x3b8e000), 4096, 260, ...
 01944  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 01945   896   NtProtectVirtualMemory  ... (0x3b8e000), 4096, 4, ) == 0x0
 01946  1028   NtSetEventBoostPriority  (456, ...
 01947   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01762  2016   NtWaitForSingleObject  ... ) == 0x0
 01946  1028   NtSetEventBoostPriority  ... ) == 0x0
 01948  1228   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01949  2016   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 01950  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 01949  2016   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 01948  1228   NtDuplicateObject  ... 536, ) == 0x0
 01947   896   NtCreateThread  ... 540, {1252, 792}, ) == 0x0
 01951  1228   NtWaitForSingleObject  (296, 0, 0x0, ...
 01952   896   NtQueryInformationThread  (540, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 01953   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\30\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\30\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\30\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 01954   896   NtResumeThread  (540, ... 1, ) == 0x0
 01955   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 62455808, 1048576, ) == 0x0
 01956   896   NtAllocateVirtualMemory  (-1, 63496192, 0, 8192, 4096, 4, ... 63496192, 8192, ) == 0x0
 01957  2016   NtSetEventBoostPriority  (296, ...
 01958   792   NtTestAlert  (...
 01950  1028   NtWaitForSingleObject  ... ) == 0x0
 01957  2016   NtSetEventBoostPriority  ... ) == 0x0
 01959  1028   NtSetEventBoostPriority  (296, ...
 01958   792   NtTestAlert  ... ) == 0x0
 01951  1228   NtWaitForSingleObject  ... ) == 0x0
 01959  1028   NtSetEventBoostPriority  ... ) == 0x0
 01960  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01961  1228   NtSetEventBoostPriority  (296, ...
 01962   792   NtContinue  (62455088, 1, ...
 01963   896   NtProtectVirtualMemory  (-1, (0x3c8e000), 4096, 260, ...
 01961  1228   NtSetEventBoostPriority  ... ) == 0x0
 01960  2016   NtWaitForSingleObject  ... ) == 0x0
 01964   792   NtRegisterThreadTerminatePort  (24, ...
 01963   896   NtProtectVirtualMemory  ... (0x3c8e000), 4096, 4, ) == 0x0
 01965  1028   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 16313708, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 16313708, 188, ...
 01966  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01964   792   NtRegisterThreadTerminatePort  ... ) == 0x0
 01967   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01965  1028   NtConnectPort  ... 544, 0x0, 0x0, 0x0, 188, ) == 0x0
 01968  1228   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01966  2016   NtCreateEvent  ... 548, ) == 0x0
 01967   896   NtCreateThread  ... 552, {1252, 1484}, ) == 0x0
 01969  1028   NtRequestWaitReplyPort  (544, {200, 224, new_msg, 0, 1381216, 12, 2, 1310721}  (544, {200, 224, new_msg, 0, 1381216, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\16\320\305eKS9w\270A\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\2705\25\0N\353~\302x\1\24\0\260A\25\0h\1\24\0\0\0\0\0\0\0\0\0\260A\25\0P\0\0\0\270A\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\370\0\372\31\221|\200\363\370\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01968  1228   NtWaitForSingleObject  ... ) == 0x102
 01970  2016   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11072120, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11072120, 188, ...
 01971   896   NtQueryInformationThread  (552, Basic, 28, ...
 01972  1228   NtWaitForSingleObject  (132, 0, 0x0, ...
 01969  1028   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1028, 81892, 0}  ... {200, 224, reply, 0, 1252, 1028, 81892, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\16\320\305eKS9w\270A\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\2705\25\0N\353~\302x\1\24\0\260A\25\0h\1\24\0\0\0\0\0\0\0\0\0\260A\25\0P\0\0\0\270A\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\370\0\372\31\221|\200\363\370\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01971   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 01970  2016   NtConnectPort  ... 556, 0x0, 0x0, 0x0, 188, ) == 0x0
 01973   792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01974  1028   NtRequestWaitReplyPort  (544, {44, 68, new_msg, 0, 1252, 1028, 81873, 0}  (544, {44, 68, new_msg, 0, 1252, 1028, 81873, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 01975  2016   NtRequestWaitReplyPort  (556, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2}  (556, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2} "\0\1\0\0`\3\24\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\240<\24\0\3\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0>\177z\357\257$\276\213\30N\25\0`\1\24\0\12\0\0\0\0\0\0\0\0\0\0\1(\0\0\0 N\25\0\247*\211\376`\3\24\0@N\25\0`\1\24\0\0\0\0\0\0\0\0\0@N\25\0P\0\0\0HN\25\0\360\6\221|8\3\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\250\0\372\31\221|\214\370\250\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 01973   792   NtDuplicateObject  ... 560, ) == 0x0
 01976   792   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 01977   792   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01974  1028   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1028, 81894, 0}  ... {40, 64, reply, 0, 1252, 1028, 81894, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\1\0\0X-\12\0" )  ) == 0x0
 01978  1028   NtRequestWaitReplyPort  (544, {64, 88, new_msg, 56, 1370688, 16314220, 16314320, 0}  (544, {64, 88, new_msg, 56, 1370688, 16314220, 16314320, 0} "\10\357\370\0@\0\24\0\346\277\347w\320\357\370\0l\357\370\0\20\0\0\0\250.\362v\264\352\24\0\1\0\0\0HR\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\330\314\24\0" ...  ...
 01979   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 01980   896   NtResumeThread  (552, ... 1, ) == 0x0
 01981   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01977   792   NtWaitForSingleObject  ... ) == 0x102
 01975  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81895, 0}  ... {200, 224, reply, 0, 1252, 2016, 81895, 0} "\7\1\0\0`\3\24\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\240<\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0>\177z\357\257$\276\213\30N\25\0`\1\24\0\12\0\0\0\0\0\0\0\0\0\0\1(\0\0\0 N\25\0\247*\211\376`\3\24\0@N\25\0`\1\24\0\0\0\0\0\0\0\0\0@N\25\0P\0\0\0HN\25\0\360\6\221|8\3\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\250\0\372\31\221|\214\370\250\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 01978  1028   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1028, 81896, 0}  ... {64, 88, reply, 56, 1252, 1028, 81896, 0} "\10\357\370\0@\0\24\0\346\277\347w\320\357\370\0l\357\370\0\20\0\0\0\250.\362v\264\352\24\0\1\0\0\0HR\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\330\314\24\0" )  ) == 0x0
 01982  1484   NtTestAlert  (...
 01983   792   NtWaitForSingleObject  (132, 0, 0x0, ...
 01984  2016   NtRequestWaitReplyPort  (556, {44, 68, new_msg, 56, 0, 0, 0, 0}  (556, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\00U\25\0\322\0\0\0" ...  ...
 01981   896   NtAllocateVirtualMemory  ... 63504384, 1048576, ) == 0x0
 01982  1484   NtTestAlert  ... ) == 0x0
 01985   896   NtAllocateVirtualMemory  (-1, 64544768, 0, 8192, 4096, 4, ...
 01986  1484   NtContinue  (63503664, 1, ...
 01984  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81898, 0}  ... {40, 64, reply, 0, 1252, 2016, 81898, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 01985   896   NtAllocateVirtualMemory  ... 64544768, 8192, ) == 0x0
 01987  1484   NtRegisterThreadTerminatePort  (24, ...
 01988  2016   NtRequestWaitReplyPort  (556, {64, 88, new_msg, 56, 1310720, 11071988, 1398056, 0}  (556, {64, 88, new_msg, 56, 1310720, 11071988, 1398056, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0(V\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01989   896   NtProtectVirtualMemory  (-1, (0x3d8e000), 4096, 260, ...
 01987  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 01989   896   NtProtectVirtualMemory  ... (0x3d8e000), 4096, 4, ) == 0x0
 01990  1028   NtClose  (532, ...
 01991   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01990  1028   NtClose  ... ) == 0x0
 01992  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01988  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81899, 0}  ... {64, 88, reply, 56, 1252, 2016, 81899, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0(V\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01993  1028   NtClose  (544, ...
 01992  1484   NtDuplicateObject  ... 532, ) == 0x0
 01994  2016   NtRequestWaitReplyPort  (556, {44, 68, new_msg, 56, 1252, 2016, 81898, 0}  (556, {44, 68, new_msg, 56, 1252, 2016, 81898, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\00U\25\0\322\0\0\0" ...  ...
 01993  1028   NtClose  ... ) == 0x0
 01995  1484   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01996  1028   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01995  1484   NtWaitForSingleObject  ... ) == 0x102
 01994  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81901, 0}  ... {40, 64, reply, 0, 1252, 2016, 81901, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 01996  1028   NtCreateKey  ... 544, 2, ) == 0x0
 01997  1484   NtWaitForSingleObject  (132, 0, 0x0, ...
 01998  2016   NtRequestWaitReplyPort  (556, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0}  (556, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\370]\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01991   896   NtCreateThread  ... 564, {1252, 888}, ) == 0x0
 01999  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02000   896   NtQueryInformationThread  (564, Basic, 28, ...
 01999  1028   NtOpenKey  ... 568, ) == 0x0
 02000   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=888,}, 0x0, ) == 0x0
 02001  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02002   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0x\3\0\0" ...  ...
 02001  1028   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02002   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0x\3\0\0" )  ) == 0x0
 02003  1028   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 01998  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81902, 0}  ... {64, 88, reply, 56, 1252, 2016, 81902, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\370]\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02003  1028   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02004  2016   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 02005   896   NtResumeThread  (564, ...
 02004  2016   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 02005   896   NtResumeThread  ... 1, ) == 0x0
 02006  2016   NtRequestWaitReplyPort  (556, {44, 68, new_msg, 56, 1252, 2016, 81901, 0}  (556, {44, 68, new_msg, 56, 1252, 2016, 81901, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\00U\25\0\322\0\0\0" ...  ...
 02007   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 64552960, 1048576, ) == 0x0
 02008   896   NtAllocateVirtualMemory  (-1, 65593344, 0, 8192, 4096, 4, ... 65593344, 8192, ) == 0x0
 02006  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81904, 0}  ... {40, 64, reply, 0, 1252, 2016, 81904, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 02009  1028   NtQueryValueKey  (544,  (544, "Domain", Partial, 144, ... , Partial, 144, ...
 02010   888   NtTestAlert  (...
 02011   896   NtProtectVirtualMemory  (-1, (0x3e8e000), 4096, 260, ...
 02009  1028   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02010   888   NtTestAlert  ... ) == 0x0
 02011   896   NtProtectVirtualMemory  ... (0x3e8e000), 4096, 4, ) == 0x0
 02012  1028   NtQueryValueKey  (544,  (544, "Domain", Partial, 144, ... , Partial, 144, ...
 02013   888   NtContinue  (64552240, 1, ...
 02014   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02012  1028   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02015   888   NtRegisterThreadTerminatePort  (24, ...
 02014   896   NtCreateThread  ... 572, {1252, 1120}, ) == 0x0
 02016  1028   NtClose  (544, ...
 02015   888   NtRegisterThreadTerminatePort  ... ) == 0x0
 02017   896   NtQueryInformationThread  (572, Basic, 28, ...
 02016  1028   NtClose  ... ) == 0x0
 02018  2016   NtRequestWaitReplyPort  (556, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0}  (556, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\210h\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02017   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 02019   888   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02018  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81905, 0}  ... {64, 88, reply, 56, 1252, 2016, 81905, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\210h\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02020  1028   NtClose  (568, ...
 02019   888   NtDuplicateObject  ... 544, ) == 0x0
 02021  2016   NtClose  (548, ...
 02020  1028   NtClose  ... ) == 0x0
 02022   888   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02021  2016   NtClose  ... ) == 0x0
 02023  1028   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 02022   888   NtWaitForSingleObject  ... ) == 0x102
 02024  2016   NtClose  (556, ...
 02023  1028   NtOpenKey  ... 548, ) == 0x0
 02025   888   NtWaitForSingleObject  (132, 0, 0x0, ...
 02026   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0`\4\0\0" ...  ...
 02027  1028   NtQueryValueKey  (548,  (548, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 02024  2016   NtClose  ... ) == 0x0
 02026   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 02027  1028   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02028  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02029   896   NtResumeThread  (572, ...
 02028  2016   NtCreateEvent  ... 556, ) == 0x0
 02029   896   NtResumeThread  ... 1, ) == 0x0
 02030  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ...
 02031   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02030  2016   NtOpenKey  ... 568, ) == 0x0
 02032  1028   NtClose  (548, ...
 02033  1120   NtAllocateVirtualMemory  (-1, 8871936, 0, 4096, 4096, 4, ...
 02034  2016   NtOpenKey  (0x20019, {24, 568, 0x40, 0, 0,  (0x20019, {24, 568, 0x40, 0, 0, "ActiveComputerName"}, ... }, ...
 02032  1028   NtClose  ... ) == 0x0
 02033  1120   NtAllocateVirtualMemory  ... 8871936, 4096, ) == 0x0
 02031   896   NtAllocateVirtualMemory  ... 65601536, 1048576, ) == 0x0
 02035  1028   NtWaitForSingleObject  (100, 0, 0x0, ...
 02036  1120   NtSetEventBoostPriority  (100, ...
 02037   896   NtAllocateVirtualMemory  (-1, 66641920, 0, 8192, 4096, 4, ...
 02035  1028   NtWaitForSingleObject  ... ) == 0x0
 02036  1120   NtSetEventBoostPriority  ... ) == 0x0
 02038  1028   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 16313296, ... }, 16313296, ...
 02037   896   NtAllocateVirtualMemory  ... 66641920, 8192, ) == 0x0
 02038  1028   NtQueryAttributesFile  ... ) == 0x0
 02039  1120   NtTestAlert  (...
 02040   896   NtProtectVirtualMemory  (-1, (0x3f8e000), 4096, 260, ...
 02034  2016   NtOpenKey  ... 548, ) == 0x0
 02041  1028   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02040   896   NtProtectVirtualMemory  ... (0x3f8e000), 4096, 4, ) == 0x0
 02042  2016   NtQueryValueKey  (548,  (548, "ComputerName", Full, 108, ... , Full, 108, ...
 02041  1028   NtOpenFile  ... 576, {status=0x0, info=1}, ) == 0x0
 02043   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02042  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02044  1028   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 576, ...
 02039  1120   NtTestAlert  ... ) == 0x0
 02045  2016   NtClose  (548, ...
 02044  1028   NtCreateSection  ... 580, ) == 0x0
 02046  1120   NtContinue  (65600816, 1, ...
 02045  2016   NtClose  ... ) == 0x0
 02047  1028   NtClose  (576, ...
 02048  1120   NtRegisterThreadTerminatePort  (24, ...
 02049  2016   NtClose  (568, ...
 02047  1028   NtClose  ... ) == 0x0
 02048  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 02043   896   NtCreateThread  ... 576, {1252, 840}, ) == 0x0
 02049  2016   NtClose  ... ) == 0x0
 02050  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02051   896   NtQueryInformationThread  (576, Basic, 28, ...
 02052  2016   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ...
 02050  1120   NtDuplicateObject  ... 568, ) == 0x0
 02051   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 02052  2016   NtCreateIoCompletion  ... 548, ) == 0x0
 02053  1028   NtMapViewOfSection  (580, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02054   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0H\3\0\0" ...  ...
 02055  2016   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ...
 02053  1028   NtMapViewOfSection  ... (0x860000), 0x0, 20480, ) == 0x0
 02054   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 02055  2016   NtCreateIoCompletion  ... 584, ) == 0x0
 02056  1028   NtClose  (580, ...
 02057  1120   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02058  2016   NtDuplicateObject  (-1, 548, -1, 0x0, 0, 2, ...
 02056  1028   NtClose  ... ) == 0x0
 02057  1120   NtWaitForSingleObject  ... ) == 0x102
 02059   896   NtResumeThread  (576, ...
 02060  1120   NtWaitForSingleObject  (132, 0, 0x0, ...
 02059   896   NtResumeThread  ... 1, ) == 0x0
 02061   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02062  1028   NtUnmapViewOfSection  (-1, 0x860000, ... ) == 0x0
 02063  1028   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 16313604, ... ) }, 16313604, ... ) == 0x0
 02064  1028   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 580, {status=0x0, info=1}, ) }, 5, 96, ... 580, {status=0x0, info=1}, ) == 0x0
 02058  2016   NtDuplicateObject  ... 588, ) == 0x0
 02065   840   NtWaitForSingleObject  (100, 0, 0x0, ...
 02061   896   NtAllocateVirtualMemory  ... 66650112, 1048576, ) == 0x0
 02066  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 02067   896   NtAllocateVirtualMemory  (-1, 67690496, 0, 8192, 4096, 4, ...
 02066  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02067   896   NtAllocateVirtualMemory  ... 67690496, 8192, ) == 0x0
 02068  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02069   896   NtProtectVirtualMemory  (-1, (0x408e000), 4096, 260, ...
 02068  2016   NtCreateEvent  ... 592, ) == 0x0
 02069   896   NtProtectVirtualMemory  ... (0x408e000), 4096, 4, ) == 0x0
 02070  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 02071   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02072  1028   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 580, ...
 02070  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02072  1028   NtCreateSection  ... 596, ) == 0x0
 02073  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02074  1028   NtQuerySection  (596, Image, 48, ...
 02073  2016   NtSetInformationThread  ... ) == 0x0
 02074  1028   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02075  2016   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11071680,  (0xc0100080, {24, 0, 0x40, 0, 11071680, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02076  1028   NtClose  (580, ...
 02075  2016   NtCreateFile  ... 600, {status=0x0, info=1}, ) == 0x0
 02076  1028   NtClose  ... ) == 0x0
 02077  2016   NtSetInformationFile  (600, 11071736, 8, Pipe, ...
 02071   896   NtCreateThread  ... 580, {1252, 876}, ) == 0x0
 02078  1028   NtMapViewOfSection  (596, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02079   896   NtQueryInformationThread  (580, Basic, 28, ...
 02078  1028   NtMapViewOfSection  ... (0x76fb0000), 0x0, 32768, ) == 0x0
 02079   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 02080  1028   NtClose  (596, ...
 02081   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" ...  ...
 02080  1028   NtClose  ... ) == 0x0
 02081   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81909, 0}  ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 02082  1028   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02077  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02082  1028   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02083  2016   NtSetInformationFile  (600, 11071724, 8, Completion, ...
 02084   896   NtResumeThread  (580, ...
 02083  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02084   896   NtResumeThread  ... 1, ) == 0x0
 02085  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02086   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02085  2016   NtSetInformationThread  ... ) == 0x0
 02086   896   NtAllocateVirtualMemory  ... 67698688, 1048576, ) == 0x0
 02087  2016   NtWriteFile  (600, 261, 0, 0,  (600, 261, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 02088   896   NtAllocateVirtualMemory  (-1, 68739072, 0, 8192, 4096, 4, ...
 02089  1028   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02090   876   NtWaitForSingleObject  (100, 0, 0x0, ...
 02088   896   NtAllocateVirtualMemory  ... 68739072, 8192, ) == 0x0
 02089  1028   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02087  2016   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 02091  1028   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02092  2016   NtReadFile  (600, 261, 0, 0, 1024, {0, 0}, 0, ...
 02091  1028   NtFlushInstructionCache  ... ) == 0x0
 02092  2016   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02093   896   NtProtectVirtualMemory  (-1, (0x418e000), 4096, 260, ...
 02094  2016   NtFsControlFile  (600, 261, 0x0, 0x0, 0x11c017,  (600, 261, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\250\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 02093   896   NtProtectVirtualMemory  ... (0x418e000), 4096, 4, ) == 0x0
 02094  2016   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02095   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02096  2016   NtFsControlFile  (600, 261, 0x0, 0x0, 0x11c017,  (600, 261, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\1\0\0\0\1\0\0\0&\0(\0`7\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 02095   896   NtCreateThread  ... 596, {1252, 1104}, ) == 0x0
 02097  1028   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02098   896   NtQueryInformationThread  (596, Basic, 28, ...
 02097  1028   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02098   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 02099  1028   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02096  2016   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , ) == 0x103
 02099  1028   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02100  2016   NtFsControlFile  (600, 261, 0x0, 0x0, 0x11c017,  (600, 261, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... , 44, 1024, ...
 02101  1028   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02100  2016   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\220f\25\0\1\0\0\0\234f\25\0 \0\0\0\1\0\0\0\30\0\32\0\250f\25\0\304f\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\370f\25\0\1\0\0\0\5\0i\0\10g\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02101  1028   NtFlushInstructionCache  ... ) == 0x0
 02102  2016   NtClose  (592, ...
 02103   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0P\4\0\0" ...  ...
 02102  2016   NtClose  ... ) == 0x0
 02103   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 02104  2016   NtClose  (600, ...
 02105   896   NtResumeThread  (596, ...
 02106  1028   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... }, ...
 02105   896   NtResumeThread  ... 1, ) == 0x0
 02106  1028   NtOpenSection  ... 592, ) == 0x0
 02107   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02108  1028   NtMapViewOfSection  (592, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02104  2016   NtClose  ... ) == 0x0
 02109  1104   NtWaitForSingleObject  (100, 0, 0x0, ...
 02108  1028   NtMapViewOfSection  ... (0x76f60000), 0x0, 180224, ) == 0x0
 02110  2016   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1381216, 0x0, 11073604, 188, ... , {12, 2, 1, 1}, 0x0, 1381216, 0x0, 11073604, 188, ...
 02111  1028   NtClose  (592, ...
 02110  2016   NtSecureConnectPort  ... 600, 0x0, 0x0, 0x0, 188, ) == 0x0
 02111  1028   NtClose  ... ) == 0x0
 02112  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 02107   896   NtAllocateVirtualMemory  ... 68747264, 1048576, ) == 0x0
 02112  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02113   896   NtAllocateVirtualMemory  (-1, 69787648, 0, 8192, 4096, 4, ...
 02114  1028   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ...
 02113   896   NtAllocateVirtualMemory  ... 69787648, 8192, ) == 0x0
 02114  1028   NtProtectVirtualMemory  ... (0x76f61000), 4096, 32, ) == 0x0
 02115   896   NtProtectVirtualMemory  (-1, (0x428e000), 4096, 260, ... (0x428e000), 4096, 4, ) == 0x0
 02116   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02117  1028   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02118  1028   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02119  1028   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02120  1028   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02116   896   NtCreateThread  ... 592, {1252, 860}, ) == 0x0
 02121  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02122   896   NtQueryInformationThread  (592, Basic, 28, ...
 02121  2016   NtSetInformationThread  ... ) == 0x0
 02122   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02123  2016   NtRequestWaitReplyPort  (600, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977}  (600, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\02\37\262\35\256`\256h\177^S\210\260%\2572\12\0\0\0\255\310\251\315\320\364^v\0\0\0\0\210\354\24\0~\247\326V\264t\234\326(\0\0\0yl\0k\0\0\24\0\240\366\250\0\25p\365\273\0\0\0\089\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\250\0\372\31\221|X\376\250\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02124   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02123  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81912, 0}  ... {200, 224, reply, 0, 1252, 2016, 81912, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\02\37\262\35\256`\256h\177^S\210\260%\2572\12\0\0\0\255\310\251\315\320\364^v\0\0\0\0\210\354\24\0~\247\326V\264t\234\326(\0\0\0yl\0k\0\0\24\0\240\366\250\0\25p\365\273\0\0\0\089\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\250\0\372\31\221|X\376\250\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02125  1028   NtFlushInstructionCache  (-1, 1995837440, 228, ...
 02126  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02125  1028   NtFlushInstructionCache  ... ) == 0x0
 02127   896   NtResumeThread  (592, ...
 02128  1028   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02127   896   NtResumeThread  ... 1, ) == 0x0
 02128  1028   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02129   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02130  1028   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02129   896   NtAllocateVirtualMemory  ... 69795840, 1048576, ) == 0x0
 02130  1028   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02131   896   NtAllocateVirtualMemory  (-1, 70836224, 0, 8192, 4096, 4, ...
 02126  2016   NtSetInformationThread  ... ) == 0x0
 02132   860   NtWaitForSingleObject  (100, 0, 0x0, ...
 02131   896   NtAllocateVirtualMemory  ... 70836224, 8192, ) == 0x0
 02133  2016   NtRequestWaitReplyPort  (600, {56, 80, new_msg, 0, 44, 3, 20, 0}  (600, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0gS\263F\252\227\2L\355h\28\1\0\0\0\0\0\0\0&\0(\0\240\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02134  1028   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02135  1028   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02136  1028   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 604, ) == 0x0
 02137  1028   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 608, ) }, ... 608, ) == 0x0
 02138  1028   NtQueryValueKey  (608,  (608, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (608, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02139   896   NtProtectVirtualMemory  (-1, (0x438e000), 4096, 260, ... (0x438e000), 4096, 4, ) == 0x0
 02140   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 612, {1252, 1516}, ) == 0x0
 02141   896   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 02142   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\354\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 02143   896   NtResumeThread  (612, ... 1, ) == 0x0
 02144   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02145  1028   NtClose  (608, ...
 02146  1516   NtWaitForSingleObject  (100, 0, 0x0, ...
 02145  1028   NtClose  ... ) == 0x0
 02147  1028   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02144   896   NtAllocateVirtualMemory  ... 70844416, 1048576, ) == 0x0
 02148   896   NtAllocateVirtualMemory  (-1, 71884800, 0, 8192, 4096, 4, ... 71884800, 8192, ) == 0x0
 02149   896   NtProtectVirtualMemory  (-1, (0x448e000), 4096, 260, ... (0x448e000), 4096, 4, ) == 0x0
 02150   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 608, {1252, 780}, ) == 0x0
 02151   896   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02152   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02153   896   NtResumeThread  (608, ... 1, ) == 0x0
 02154   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 71892992, 1048576, ) == 0x0
 02155   896   NtAllocateVirtualMemory  (-1, 72933376, 0, 8192, 4096, 4, ... 72933376, 8192, ) == 0x0
 02156   780   NtWaitForSingleObject  (100, 0, 0x0, ...
 02157   896   NtProtectVirtualMemory  (-1, (0x458e000), 4096, 260, ... (0x458e000), 4096, 4, ) == 0x0
 02158   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 616, {1252, 940}, ) == 0x0
 02159   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 02160   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 02161   896   NtResumeThread  (616, ... 1, ) == 0x0
 02162   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02163   940   NtWaitForSingleObject  (100, 0, 0x0, ...
 02162   896   NtAllocateVirtualMemory  ... 72941568, 1048576, ) == 0x0
 02164   896   NtAllocateVirtualMemory  (-1, 73981952, 0, 8192, 4096, 4, ... 73981952, 8192, ) == 0x0
 02165   896   NtProtectVirtualMemory  (-1, (0x468e000), 4096, 260, ... (0x468e000), 4096, 4, ) == 0x0
 02166   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 1268}, ) == 0x0
 02167   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02168   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 02169   896   NtResumeThread  (620, ... 1, ) == 0x0
 02170   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 73990144, 1048576, ) == 0x0
 02171   896   NtAllocateVirtualMemory  (-1, 75030528, 0, 8192, 4096, 4, ... 75030528, 8192, ) == 0x0
 02172  1268   NtWaitForSingleObject  (100, 0, 0x0, ...
 02173   896   NtProtectVirtualMemory  (-1, (0x478e000), 4096, 260, ... (0x478e000), 4096, 4, ) == 0x0
 02174   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 644}, ) == 0x0
 02175   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 02176   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\204\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 02177   896   NtResumeThread  (624, ... 1, ) == 0x0
 02178   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02179   644   NtWaitForSingleObject  (100, 0, 0x0, ...
 02178   896   NtAllocateVirtualMemory  ... 75038720, 1048576, ) == 0x0
 02180   896   NtAllocateVirtualMemory  (-1, 76079104, 0, 8192, 4096, 4, ... 76079104, 8192, ) == 0x0
 02181   896   NtProtectVirtualMemory  (-1, (0x488e000), 4096, 260, ... (0x488e000), 4096, 4, ) == 0x0
 02182   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 628, {1252, 1736}, ) == 0x0
 02183   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02184   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02185   896   NtResumeThread  (628, ... 1, ) == 0x0
 02186   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 76087296, 1048576, ) == 0x0
 02187   896   NtAllocateVirtualMemory  (-1, 77127680, 0, 8192, 4096, 4, ... 77127680, 8192, ) == 0x0
 02188  1736   NtWaitForSingleObject  (100, 0, 0x0, ...
 02189   896   NtProtectVirtualMemory  (-1, (0x498e000), 4096, 260, ... (0x498e000), 4096, 4, ) == 0x0
 02190   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 320}, ) == 0x0
 02191   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 02192   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 02193   896   NtResumeThread  (632, ... 1, ) == 0x0
 02194   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02195   320   NtWaitForSingleObject  (100, 0, 0x0, ...
 02194   896   NtAllocateVirtualMemory  ... 77135872, 1048576, ) == 0x0
 02196   896   NtAllocateVirtualMemory  (-1, 78176256, 0, 8192, 4096, 4, ... 78176256, 8192, ) == 0x0
 02197   896   NtProtectVirtualMemory  (-1, (0x4a8e000), 4096, 260, ... (0x4a8e000), 4096, 4, ) == 0x0
 02198   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1252, 380}, ) == 0x0
 02199   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 02200   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 02201   896   NtResumeThread  (636, ... 1, ) == 0x0
 02202   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78184448, 1048576, ) == 0x0
 02203   896   NtAllocateVirtualMemory  (-1, 79224832, 0, 8192, 4096, 4, ... 79224832, 8192, ) == 0x0
 02204   380   NtWaitForSingleObject  (100, 0, 0x0, ...
 02205   896   NtProtectVirtualMemory  (-1, (0x4b8e000), 4096, 260, ... (0x4b8e000), 4096, 4, ) == 0x0
 02206   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 1332}, ) == 0x0
 02207   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 02208   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 02209   896   NtResumeThread  (640, ... 1, ) == 0x0
 02210   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02211  1332   NtWaitForSingleObject  (100, 0, 0x0, ...
 02210   896   NtAllocateVirtualMemory  ... 79233024, 1048576, ) == 0x0
 02212   896   NtAllocateVirtualMemory  (-1, 80273408, 0, 8192, 4096, 4, ... 80273408, 8192, ) == 0x0
 02213   896   NtProtectVirtualMemory  (-1, (0x4c8e000), 4096, 260, ... (0x4c8e000), 4096, 4, ) == 0x0
 02214   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 1336}, ) == 0x0
 02215   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02216   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02217   896   NtResumeThread  (644, ... 1, ) == 0x0
 02218   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 80281600, 1048576, ) == 0x0
 02219   896   NtAllocateVirtualMemory  (-1, 81321984, 0, 8192, 4096, 4, ... 81321984, 8192, ) == 0x0
 02220  1336   NtWaitForSingleObject  (100, 0, 0x0, ...
 02221   896   NtProtectVirtualMemory  (-1, (0x4d8e000), 4096, 260, ... (0x4d8e000), 4096, 4, ) == 0x0
 02222   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 648, {1252, 1808}, ) == 0x0
 02223   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 02224   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\20\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 02225   896   NtResumeThread  (648, ... 1, ) == 0x0
 02226   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02227  1808   NtWaitForSingleObject  (100, 0, 0x0, ...
 02226   896   NtAllocateVirtualMemory  ... 81330176, 1048576, ) == 0x0
 02228   896   NtAllocateVirtualMemory  (-1, 82370560, 0, 8192, 4096, 4, ... 82370560, 8192, ) == 0x0
 02229   896   NtProtectVirtualMemory  (-1, (0x4e8e000), 4096, 260, ... (0x4e8e000), 4096, 4, ) == 0x0
 02230   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 468}, ) == 0x0
 02231   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 02232   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 02233   896   NtResumeThread  (652, ... 1, ) == 0x0
 02234   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 82378752, 1048576, ) == 0x0
 02235   896   NtAllocateVirtualMemory  (-1, 83419136, 0, 8192, 4096, 4, ... 83419136, 8192, ) == 0x0
 02236   468   NtWaitForSingleObject  (100, 0, 0x0, ...
 02237   896   NtProtectVirtualMemory  (-1, (0x4f8e000), 4096, 260, ... (0x4f8e000), 4096, 4, ) == 0x0
 02238   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1252, 752}, ) == 0x0
 02239   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02240   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02241   896   NtResumeThread  (656, ... 1, ) == 0x0
 02242   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02243   752   NtWaitForSingleObject  (100, 0, 0x0, ...
 02242   896   NtAllocateVirtualMemory  ... 83427328, 1048576, ) == 0x0
 02244   896   NtAllocateVirtualMemory  (-1, 84467712, 0, 8192, 4096, 4, ... 84467712, 8192, ) == 0x0
 02245   896   NtProtectVirtualMemory  (-1, (0x508e000), 4096, 260, ... (0x508e000), 4096, 4, ) == 0x0
 02246   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 660, {1252, 1512}, ) == 0x0
 02247   896   NtQueryInformationThread  (660, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 02248   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 02249   896   NtResumeThread  (660, ... 1, ) == 0x0
 02250   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 84475904, 1048576, ) == 0x0
 02251   896   NtAllocateVirtualMemory  (-1, 85516288, 0, 8192, 4096, 4, ... 85516288, 8192, ) == 0x0
 02252  1512   NtWaitForSingleObject  (100, 0, 0x0, ...
 02253   896   NtProtectVirtualMemory  (-1, (0x518e000), 4096, 260, ... (0x518e000), 4096, 4, ) == 0x0
 02254   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 1380}, ) == 0x0
 02255   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02256   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02257   896   NtResumeThread  (664, ... 1, ) == 0x0
 02258   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02259  1380   NtWaitForSingleObject  (100, 0, 0x0, ...
 02258   896   NtAllocateVirtualMemory  ... 85524480, 1048576, ) == 0x0
 02260   896   NtAllocateVirtualMemory  (-1, 86564864, 0, 8192, 4096, 4, ... 86564864, 8192, ) == 0x0
 02261   896   NtProtectVirtualMemory  (-1, (0x528e000), 4096, 260, ... (0x528e000), 4096, 4, ) == 0x0
 02262   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1252, 1564}, ) == 0x0
 02263   896   NtQueryInformationThread  (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 02264   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 02265   896   NtResumeThread  (668, ... 1, ) == 0x0
 02266   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 86573056, 1048576, ) == 0x0
 02267   896   NtAllocateVirtualMemory  (-1, 87613440, 0, 8192, 4096, 4, ... 87613440, 8192, ) == 0x0
 02268  1564   NtWaitForSingleObject  (100, 0, 0x0, ...
 02269   896   NtProtectVirtualMemory  (-1, (0x538e000), 4096, 260, ... (0x538e000), 4096, 4, ) == 0x0
 02270   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 672, {1252, 164}, ) == 0x0
 02271   896   NtQueryInformationThread  (672, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 02272   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 02273   896   NtResumeThread  (672, ... 1, ) == 0x0
 02274   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02275   164   NtWaitForSingleObject  (100, 0, 0x0, ...
 02274   896   NtAllocateVirtualMemory  ... 87621632, 1048576, ) == 0x0
 02276   896   NtAllocateVirtualMemory  (-1, 88662016, 0, 8192, 4096, 4, ... 88662016, 8192, ) == 0x0
 02277   896   NtProtectVirtualMemory  (-1, (0x548e000), 4096, 260, ... (0x548e000), 4096, 4, ) == 0x0
 02278   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1252, 312}, ) == 0x0
 02279   896   NtQueryInformationThread  (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 02280   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\08\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 02281   896   NtResumeThread  (676, ... 1, ) == 0x0
 02282   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 88670208, 1048576, ) == 0x0
 02283   896   NtAllocateVirtualMemory  (-1, 89710592, 0, 8192, 4096, 4, ... 89710592, 8192, ) == 0x0
 02284   312   NtWaitForSingleObject  (100, 0, 0x0, ...
 02285   896   NtProtectVirtualMemory  (-1, (0x558e000), 4096, 260, ... (0x558e000), 4096, 4, ) == 0x0
 02286   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 680, {1252, 1964}, ) == 0x0
 02287   896   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 02288   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\254\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 02289   896   NtResumeThread  (680, ... 1, ) == 0x0
 02290   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02291  1964   NtWaitForSingleObject  (100, 0, 0x0, ...
 02290   896   NtAllocateVirtualMemory  ... 89718784, 1048576, ) == 0x0
 02292   896   NtAllocateVirtualMemory  (-1, 90759168, 0, 8192, 4096, 4, ... 90759168, 8192, ) == 0x0
 02293   896   NtProtectVirtualMemory  (-1, (0x568e000), 4096, 260, ... (0x568e000), 4096, 4, ) == 0x0
 02294   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 684, {1252, 1568}, ) == 0x0
 02295   896   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 02296   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0 \6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 02297   896   NtResumeThread  (684, ... 1, ) == 0x0
 02298   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 90767360, 1048576, ) == 0x0
 02299   896   NtAllocateVirtualMemory  (-1, 91807744, 0, 8192, 4096, 4, ... 91807744, 8192, ) == 0x0
 02300  1568   NtWaitForSingleObject  (100, 0, 0x0, ...
 02301   896   NtProtectVirtualMemory  (-1, (0x578e000), 4096, 260, ... (0x578e000), 4096, 4, ) == 0x0
 02302   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1252, 1624}, ) == 0x0
 02303   896   NtQueryInformationThread  (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1624,}, 0x0, ) == 0x0
 02304   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0X\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0X\6\0\0" )  ) == 0x0
 02305   896   NtResumeThread  (688, ... 1, ) == 0x0
 02306   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02307  1624   NtWaitForSingleObject  (100, 0, 0x0, ...
 02306   896   NtAllocateVirtualMemory  ... 91815936, 1048576, ) == 0x0
 02308   896   NtAllocateVirtualMemory  (-1, 92856320, 0, 8192, 4096, 4, ... 92856320, 8192, ) == 0x0
 02309   896   NtProtectVirtualMemory  (-1, (0x588e000), 4096, 260, ... (0x588e000), 4096, 4, ) == 0x0
 02310   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1252, 1716}, ) == 0x0
 02311   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 02312   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 02313   896   NtResumeThread  (692, ... 1, ) == 0x0
 02314   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 92864512, 1048576, ) == 0x0
 02315   896   NtAllocateVirtualMemory  (-1, 93904896, 0, 8192, 4096, 4, ... 93904896, 8192, ) == 0x0
 02316  1716   NtWaitForSingleObject  (100, 0, 0x0, ...
 02317   896   NtProtectVirtualMemory  (-1, (0x598e000), 4096, 260, ... (0x598e000), 4096, 4, ) == 0x0
 02318   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 696, {1252, 1440}, ) == 0x0
 02319   896   NtQueryInformationThread  (696, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 02320   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\240\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 02321   896   NtResumeThread  (696, ... 1, ) == 0x0
 02322   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02323  1440   NtWaitForSingleObject  (100, 0, 0x0, ...
 02322   896   NtAllocateVirtualMemory  ... 93913088, 1048576, ) == 0x0
 02324   896   NtAllocateVirtualMemory  (-1, 94953472, 0, 8192, 4096, 4, ... 94953472, 8192, ) == 0x0
 02325   896   NtProtectVirtualMemory  (-1, (0x5a8e000), 4096, 260, ... (0x5a8e000), 4096, 4, ) == 0x0
 02326   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 700, {1252, 1664}, ) == 0x0
 02327   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 02328   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\200\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 02329   896   NtResumeThread  (700, ... 1, ) == 0x0
 02330   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 94961664, 1048576, ) == 0x0
 02331   896   NtAllocateVirtualMemory  (-1, 96002048, 0, 8192, 4096, 4, ... 96002048, 8192, ) == 0x0
 02332  1664   NtWaitForSingleObject  (100, 0, 0x0, ...
 02333   896   NtProtectVirtualMemory  (-1, (0x5b8e000), 4096, 260, ... (0x5b8e000), 4096, 4, ) == 0x0
 02334   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 1972}, ) == 0x0
 02335   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 02336   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\264\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 02337   896   NtResumeThread  (704, ... 1, ) == 0x0
 02338   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02339  1972   NtWaitForSingleObject  (100, 0, 0x0, ...
 02338   896   NtAllocateVirtualMemory  ... 96010240, 1048576, ) == 0x0
 02340   896   NtAllocateVirtualMemory  (-1, 97050624, 0, 8192, 4096, 4, ... 97050624, 8192, ) == 0x0
 02341   896   NtProtectVirtualMemory  (-1, (0x5c8e000), 4096, 260, ... (0x5c8e000), 4096, 4, ) == 0x0
 02342   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 708, {1252, 1036}, ) == 0x0
 02343   896   NtQueryInformationThread  (708, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 02344   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\14\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 02345   896   NtResumeThread  (708, ... 1, ) == 0x0
 02346   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02347  1036   NtWaitForSingleObject  (100, 0, 0x0, ...
 02346   896   NtAllocateVirtualMemory  ... 97058816, 1048576, ) == 0x0
 02348   896   NtAllocateVirtualMemory  (-1, 98099200, 0, 8192, 4096, 4, ... 98099200, 8192, ) == 0x0
 02349   896   NtProtectVirtualMemory  (-1, (0x5d8e000), 4096, 260, ... (0x5d8e000), 4096, 4, ) == 0x0
 02350   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 712, {1252, 1248}, ) == 0x0
 02351   896   NtQueryInformationThread  (712, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 02352   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\340\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 02353   896   NtResumeThread  (712, ... 1, ) == 0x0
 02354   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 98107392, 1048576, ) == 0x0
 02355   896   NtAllocateVirtualMemory  (-1, 99147776, 0, 8192, 4096, 4, ... 99147776, 8192, ) == 0x0
 02356  1248   NtWaitForSingleObject  (100, 0, 0x0, ...
 02357   896   NtProtectVirtualMemory  (-1, (0x5e8e000), 4096, 260, ... (0x5e8e000), 4096, 4, ) == 0x0
 02358   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 716, {1252, 1656}, ) == 0x0
 02359   896   NtQueryInformationThread  (716, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 02360   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0x\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0x\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0x\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 02361   896   NtResumeThread  (716, ... 1, ) == 0x0
 02362   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02363  1656   NtWaitForSingleObject  (100, 0, 0x0, ...
 02362   896   NtAllocateVirtualMemory  ... 99155968, 1048576, ) == 0x0
 02364   896   NtAllocateVirtualMemory  (-1, 100196352, 0, 8192, 4096, 4, ... 100196352, 8192, ) == 0x0
 02365   896   NtProtectVirtualMemory  (-1, (0x5f8e000), 4096, 260, ... (0x5f8e000), 4096, 4, ) == 0x0
 02366   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 720, {1252, 760}, ) == 0x0
 02367   896   NtQueryInformationThread  (720, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 02368   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\370\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 02369   896   NtResumeThread  (720, ... 1, ) == 0x0
 02370   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 100204544, 1048576, ) == 0x0
 02371   896   NtAllocateVirtualMemory  (-1, 101244928, 0, 8192, 4096, 4, ... 101244928, 8192, ) == 0x0
 02372   760   NtWaitForSingleObject  (100, 0, 0x0, ...
 02373   896   NtProtectVirtualMemory  (-1, (0x608e000), 4096, 260, ... (0x608e000), 4096, 4, ) == 0x0
 02374   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 724, {1252, 484}, ) == 0x0
 02375   896   NtQueryInformationThread  (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=484,}, 0x0, ) == 0x0
 02376   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\344\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\344\1\0\0" )  ) == 0x0
 02377   896   NtResumeThread  (724, ... 1, ) == 0x0
 02378   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02379   484   NtWaitForSingleObject  (100, 0, 0x0, ...
 02378   896   NtAllocateVirtualMemory  ... 101253120, 1048576, ) == 0x0
 02380   896   NtAllocateVirtualMemory  (-1, 102293504, 0, 8192, 4096, 4, ... 102293504, 8192, ) == 0x0
 02381   896   NtProtectVirtualMemory  (-1, (0x618e000), 4096, 260, ... (0x618e000), 4096, 4, ) == 0x0
 02382   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 728, {1252, 1580}, ) == 0x0
 02383   896   NtQueryInformationThread  (728, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 02384   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0,\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 02385   896   NtResumeThread  (728, ... 1, ) == 0x0
 02386   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 102301696, 1048576, ) == 0x0
 02387   896   NtAllocateVirtualMemory  (-1, 103342080, 0, 8192, 4096, 4, ... 103342080, 8192, ) == 0x0
 02388  1580   NtWaitForSingleObject  (100, 0, 0x0, ...
 02389   896   NtProtectVirtualMemory  (-1, (0x628e000), 4096, 260, ... (0x628e000), 4096, 4, ) == 0x0
 02390   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 732, {1252, 1756}, ) == 0x0
 02391   896   NtQueryInformationThread  (732, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 02392   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\334\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 02393   896   NtResumeThread  (732, ... 1, ) == 0x0
 02394   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02395  1756   NtWaitForSingleObject  (100, 0, 0x0, ...
 02394   896   NtAllocateVirtualMemory  ... 103350272, 1048576, ) == 0x0
 02396   896   NtAllocateVirtualMemory  (-1, 104390656, 0, 8192, 4096, 4, ... 104390656, 8192, ) == 0x0
 02397   896   NtProtectVirtualMemory  (-1, (0x638e000), 4096, 260, ... (0x638e000), 4096, 4, ) == 0x0
 02398   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 736, {1252, 1304}, ) == 0x0
 02399   896   NtQueryInformationThread  (736, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 02400   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 02401   896   NtResumeThread  (736, ... 1, ) == 0x0
 02402   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 104398848, 1048576, ) == 0x0
 02403   896   NtAllocateVirtualMemory  (-1, 105439232, 0, 8192, 4096, 4, ... 105439232, 8192, ) == 0x0
 02404  1304   NtWaitForSingleObject  (100, 0, 0x0, ...
 02405   896   NtProtectVirtualMemory  (-1, (0x648e000), 4096, 260, ... (0x648e000), 4096, 4, ) == 0x0
 02406   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 740, {1252, 2052}, ) == 0x0
 02407   896   NtQueryInformationThread  (740, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=2052,}, 0x0, ) == 0x0
 02408   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\4\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\4\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\4\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\4\10\0\0" )  ) == 0x0
 02409   896   NtResumeThread  (740, ... 1, ) == 0x0
 02410   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02411  2052   NtWaitForSingleObject  (100, 0, 0x0, ...
 02410   896   NtAllocateVirtualMemory  ... 105447424, 1048576, ) == 0x0
 02412   896   NtAllocateVirtualMemory  (-1, 106487808, 0, 8192, 4096, 4, ... 106487808, 8192, ) == 0x0
 02413   896   NtProtectVirtualMemory  (-1, (0x658e000), 4096, 260, ... (0x658e000), 4096, 4, ) == 0x0
 02414   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 744, {1252, 2056}, ) == 0x0
 02415   896   NtQueryInformationThread  (744, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=2056,}, 0x0, ) == 0x0
 02416   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\10\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\10\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\10\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\10\10\0\0" )  ) == 0x0
 02417   896   NtResumeThread  (744, ... 1, ) == 0x0
 02418   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 106496000, 1048576, ) == 0x0
 02419   896   NtAllocateVirtualMemory  (-1, 107536384, 0, 8192, 4096, 4, ... 107536384, 8192, ) == 0x0
 02420  2056   NtWaitForSingleObject  (100, 0, 0x0, ...
 02421   896   NtProtectVirtualMemory  (-1, (0x668e000), 4096, 260, ... (0x668e000), 4096, 4, ) == 0x0
 02422   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 748, {1252, 2060}, ) == 0x0
 02423   896   NtQueryInformationThread  (748, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=2060,}, 0x0, ) == 0x0
 02424   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\14\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\14\10\0\0" )  ) == 0x0
 02425   896   NtResumeThread  (748, ... 1, ) == 0x0
 02426   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02427  2060   NtWaitForSingleObject  (100, 0, 0x0, ...
 02426   896   NtAllocateVirtualMemory  ... 107544576, 1048576, ) == 0x0
 02428   896   NtAllocateVirtualMemory  (-1, 108584960, 0, 8192, 4096, 4, ... 108584960, 8192, ) == 0x0
 02429   896   NtProtectVirtualMemory  (-1, (0x678e000), 4096, 260, ... (0x678e000), 4096, 4, ) == 0x0
 02430   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 752, {1252, 2064}, ) == 0x0
 02431   896   NtQueryInformationThread  (752, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 02432   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\20\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\20\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\20\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 02433   896   NtResumeThread  (752, ... 1, ) == 0x0
 02434   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 108593152, 1048576, ) == 0x0
 02435   896   NtAllocateVirtualMemory  (-1, 109633536, 0, 8192, 4096, 4, ... 109633536, 8192, ) == 0x0
 02436  2064   NtWaitForSingleObject  (100, 0, 0x0, ...
 02437   896   NtProtectVirtualMemory  (-1, (0x688e000), 4096, 260, ... (0x688e000), 4096, 4, ) == 0x0
 02438   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 756, {1252, 2068}, ) == 0x0
 02439   896   NtQueryInformationThread  (756, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5b000,Pid=1252,Tid=2068,}, 0x0, ) == 0x0
 02440   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\24\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\24\10\0\0" )  ) == 0x0
 02441   896   NtResumeThread  (756, ... 1, ) == 0x0
 02442   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02443  2068   NtWaitForSingleObject  (100, 0, 0x0, ...
 02442   896   NtAllocateVirtualMemory  ... 109641728, 1048576, ) == 0x0
 02444   896   NtAllocateVirtualMemory  (-1, 110682112, 0, 8192, 4096, 4, ... 110682112, 8192, ) == 0x0
 02445   896   NtProtectVirtualMemory  (-1, (0x698e000), 4096, 260, ... (0x698e000), 4096, 4, ) == 0x0
 02446   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 760, {1252, 2072}, ) == 0x0
 02447   896   NtQueryInformationThread  (760, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5a000,Pid=1252,Tid=2072,}, 0x0, ) == 0x0
 02448   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\0\30\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\0\30\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\0\30\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\0\30\10\0\0" )  ) == 0x0
 02449   896   NtResumeThread  (760, ... 1, ) == 0x0
 02450   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 110690304, 1048576, ) == 0x0
 02451   896   NtAllocateVirtualMemory  (-1, 111730688, 0, 8192, 4096, 4, ... 111730688, 8192, ) == 0x0
 02452  2072   NtWaitForSingleObject  (100, 0, 0x0, ...
 02453   896   NtProtectVirtualMemory  (-1, (0x6a8e000), 4096, 260, ... (0x6a8e000), 4096, 4, ) == 0x0
 02454   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 764, {1252, 2076}, ) == 0x0
 02455   896   NtQueryInformationThread  (764, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff59000,Pid=1252,Tid=2076,}, 0x0, ) == 0x0
 02456   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\0\34\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\0\34\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\0\34\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\0\34\10\0\0" )  ) == 0x0
 02457   896   NtResumeThread  (764, ... 1, ) == 0x0
 02458   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02459  2076   NtWaitForSingleObject  (100, 0, 0x0, ...
 02458   896   NtAllocateVirtualMemory  ... 111738880, 1048576, ) == 0x0
 02460   896   NtAllocateVirtualMemory  (-1, 112779264, 0, 8192, 4096, 4, ... 112779264, 8192, ) == 0x0
 02461   896   NtProtectVirtualMemory  (-1, (0x6b8e000), 4096, 260, ... (0x6b8e000), 4096, 4, ) == 0x0
 02462   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 768, {1252, 2080}, ) == 0x0
 02463   896   NtQueryInformationThread  (768, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff58000,Pid=1252,Tid=2080,}, 0x0, ) == 0x0
 02464   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\0 \10\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\0 \10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\0 \10\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\0 \10\0\0" )  ) == 0x0
 02465   896   NtResumeThread  (768, ... 1, ) == 0x0
 02466   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 112787456, 1048576, ) == 0x0
 02467   896   NtAllocateVirtualMemory  (-1, 113827840, 0, 8192, 4096, 4, ... 113827840, 8192, ) == 0x0
 02468  2080   NtWaitForSingleObject  (100, 0, 0x0, ...
 02469   896   NtProtectVirtualMemory  (-1, (0x6c8e000), 4096, 260, ... (0x6c8e000), 4096, 4, ) == 0x0
 02470   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 772, {1252, 2084}, ) == 0x0
 02471   896   NtQueryInformationThread  (772, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff57000,Pid=1252,Tid=2084,}, 0x0, ) == 0x0
 02472   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0$\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0$\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0$\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0$\10\0\0" )  ) == 0x0
 02473   896   NtResumeThread  (772, ... 1, ) == 0x0
 02474   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02475  2084   NtWaitForSingleObject  (100, 0, 0x0, ...
 02474   896   NtAllocateVirtualMemory  ... 113836032, 1048576, ) == 0x0
 02476   896   NtAllocateVirtualMemory  (-1, 114876416, 0, 8192, 4096, 4, ... 114876416, 8192, ) == 0x0
 02477   896   NtProtectVirtualMemory  (-1, (0x6d8e000), 4096, 260, ... (0x6d8e000), 4096, 4, ) == 0x0
 02478   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 776, {1252, 2088}, ) == 0x0
 02479   896   NtQueryInformationThread  (776, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff56000,Pid=1252,Tid=2088,}, 0x0, ) == 0x0
 02480   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0(\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0(\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0(\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0(\10\0\0" )  ) == 0x0
 02481   896   NtResumeThread  (776, ... 1, ) == 0x0
 02482   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 114884608, 1048576, ) == 0x0
 02483   896   NtAllocateVirtualMemory  (-1, 115924992, 0, 8192, 4096, 4, ... 115924992, 8192, ) == 0x0
 02484  2088   NtWaitForSingleObject  (100, 0, 0x0, ...
 02485   896   NtProtectVirtualMemory  (-1, (0x6e8e000), 4096, 260, ... (0x6e8e000), 4096, 4, ) == 0x0
 02486   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 780, {1252, 2092}, ) == 0x0
 02487   896   NtQueryInformationThread  (780, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff55000,Pid=1252,Tid=2092,}, 0x0, ) == 0x0
 02488   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0,\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0,\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0,\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0,\10\0\0" )  ) == 0x0
 02489   896   NtResumeThread  (780, ... 1, ) == 0x0
 02490   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02491  2092   NtWaitForSingleObject  (100, 0, 0x0, ...
 02490   896   NtAllocateVirtualMemory  ... 115933184, 1048576, ) == 0x0
 02492   896   NtAllocateVirtualMemory  (-1, 116973568, 0, 8192, 4096, 4, ... 116973568, 8192, ) == 0x0
 02493   896   NtProtectVirtualMemory  (-1, (0x6f8e000), 4096, 260, ... (0x6f8e000), 4096, 4, ) == 0x0
 02494   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 784, {1252, 2096}, ) == 0x0
 02495   896   NtQueryInformationThread  (784, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff54000,Pid=1252,Tid=2096,}, 0x0, ) == 0x0
 02496   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\00\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\00\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\00\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\00\10\0\0" )  ) == 0x0
 02497   896   NtResumeThread  (784, ... 1, ) == 0x0
 02498   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 116981760, 1048576, ) == 0x0
 02499   896   NtAllocateVirtualMemory  (-1, 118022144, 0, 8192, 4096, 4, ... 118022144, 8192, ) == 0x0
 02500  2096   NtWaitForSingleObject  (100, 0, 0x0, ...
 02501   896   NtProtectVirtualMemory  (-1, (0x708e000), 4096, 260, ... (0x708e000), 4096, 4, ) == 0x0
 02502   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 788, {1252, 2100}, ) == 0x0
 02503   896   NtQueryInformationThread  (788, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff53000,Pid=1252,Tid=2100,}, 0x0, ) == 0x0
 02504   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0\344\4\0\04\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0\344\4\0\04\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0\344\4\0\04\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0\344\4\0\04\10\0\0" )  ) == 0x0
 02505   896   NtResumeThread  (788, ... 1, ) == 0x0
 02506   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02507  2100   NtWaitForSingleObject  (100, 0, 0x0, ...
 02506   896   NtAllocateVirtualMemory  ... 118030336, 1048576, ) == 0x0
 02508   896   NtAllocateVirtualMemory  (-1, 119070720, 0, 8192, 4096, 4, ... 119070720, 8192, ) == 0x0
 02509   896   NtProtectVirtualMemory  (-1, (0x718e000), 4096, 260, ... (0x718e000), 4096, 4, ) == 0x0
 02510   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 792, {1252, 2104}, ) == 0x0
 02511   896   NtQueryInformationThread  (792, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff52000,Pid=1252,Tid=2104,}, 0x0, ) == 0x0
 02512   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\08\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\08\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\08\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\08\10\0\0" )  ) == 0x0
 02513   896   NtResumeThread  (792, ... 1, ) == 0x0
 02514   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 119078912, 1048576, ) == 0x0
 02515   896   NtAllocateVirtualMemory  (-1, 120119296, 0, 8192, 4096, 4, ... 120119296, 8192, ) == 0x0
 02516  2104   NtWaitForSingleObject  (100, 0, 0x0, ...
 02517   896   NtProtectVirtualMemory  (-1, (0x728e000), 4096, 260, ... (0x728e000), 4096, 4, ) == 0x0
 02518   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 796, {1252, 2108}, ) == 0x0
 02519   896   NtQueryInformationThread  (796, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff51000,Pid=1252,Tid=2108,}, 0x0, ) == 0x0
 02520   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0<\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0<\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0<\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0<\10\0\0" )  ) == 0x0
 02521   896   NtResumeThread  (796, ... 1, ) == 0x0
 02522   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02523  2108   NtWaitForSingleObject  (100, 0, 0x0, ...
 02522   896   NtAllocateVirtualMemory  ... 120127488, 1048576, ) == 0x0
 02524   896   NtAllocateVirtualMemory  (-1, 121167872, 0, 8192, 4096, 4, ... 121167872, 8192, ) == 0x0
 02525   896   NtProtectVirtualMemory  (-1, (0x738e000), 4096, 260, ... (0x738e000), 4096, 4, ) == 0x0
 02526   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 800, {1252, 2112}, ) == 0x0
 02527   896   NtQueryInformationThread  (800, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff50000,Pid=1252,Tid=2112,}, 0x0, ) == 0x0
 02528   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0@\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0@\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0@\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0@\10\0\0" )  ) == 0x0
 02529   896   NtResumeThread  (800, ... 1, ) == 0x0
 02530   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 121176064, 1048576, ) == 0x0
 02531   896   NtAllocateVirtualMemory  (-1, 122216448, 0, 8192, 4096, 4, ... 122216448, 8192, ) == 0x0
 02532  2112   NtWaitForSingleObject  (100, 0, 0x0, ...
 02533   896   NtProtectVirtualMemory  (-1, (0x748e000), 4096, 260, ... (0x748e000), 4096, 4, ) == 0x0
 02534   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 804, {1252, 2116}, ) == 0x0
 02535   896   NtQueryInformationThread  (804, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4f000,Pid=1252,Tid=2116,}, 0x0, ) == 0x0
 02536   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0D\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0D\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0D\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0D\10\0\0" )  ) == 0x0
 02537   896   NtResumeThread  (804, ... 1, ) == 0x0
 02538   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02539  2116   NtWaitForSingleObject  (100, 0, 0x0, ...
 02538   896   NtAllocateVirtualMemory  ... 122224640, 1048576, ) == 0x0
 02540   896   NtAllocateVirtualMemory  (-1, 123265024, 0, 8192, 4096, 4, ... 123265024, 8192, ) == 0x0
 02541   896   NtProtectVirtualMemory  (-1, (0x758e000), 4096, 260, ... (0x758e000), 4096, 4, ) == 0x0
 02542   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 808, {1252, 2120}, ) == 0x0
 02543   896   NtQueryInformationThread  (808, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4e000,Pid=1252,Tid=2120,}, 0x0, ) == 0x0
 02544   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0H\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0H\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0H\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0H\10\0\0" )  ) == 0x0
 02545   896   NtResumeThread  (808, ... 1, ) == 0x0
 02546   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 123273216, 1048576, ) == 0x0
 02547   896   NtAllocateVirtualMemory  (-1, 124313600, 0, 8192, 4096, 4, ... 124313600, 8192, ) == 0x0
 02548  2120   NtWaitForSingleObject  (100, 0, 0x0, ...
 02549   896   NtProtectVirtualMemory  (-1, (0x768e000), 4096, 260, ... (0x768e000), 4096, 4, ) == 0x0
 02550   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 812, {1252, 2124}, ) == 0x0
 02551   896   NtQueryInformationThread  (812, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4d000,Pid=1252,Tid=2124,}, 0x0, ) == 0x0
 02552   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0L\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0L\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0L\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0L\10\0\0" )  ) == 0x0
 02553   896   NtResumeThread  (812, ... 1, ) == 0x0
 02554   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02555  2124   NtWaitForSingleObject  (100, 0, 0x0, ...
 02554   896   NtAllocateVirtualMemory  ... 124321792, 1048576, ) == 0x0
 02556   896   NtAllocateVirtualMemory  (-1, 125362176, 0, 8192, 4096, 4, ... 125362176, 8192, ) == 0x0
 02557   896   NtProtectVirtualMemory  (-1, (0x778e000), 4096, 260, ... (0x778e000), 4096, 4, ) == 0x0
 02558   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 816, {1252, 2128}, ) == 0x0
 02559   896   NtQueryInformationThread  (816, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4c000,Pid=1252,Tid=2128,}, 0x0, ) == 0x0
 02560   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0P\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0P\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0P\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0P\10\0\0" )  ) == 0x0
 02561   896   NtResumeThread  (816, ... 1, ) == 0x0
 02562   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 125370368, 1048576, ) == 0x0
 02563   896   NtAllocateVirtualMemory  (-1, 126410752, 0, 8192, 4096, 4, ... 126410752, 8192, ) == 0x0
 02564  2128   NtWaitForSingleObject  (100, 0, 0x0, ...
 02565   896   NtProtectVirtualMemory  (-1, (0x788e000), 4096, 260, ... (0x788e000), 4096, 4, ) == 0x0
 02566   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 820, {1252, 2132}, ) == 0x0
 02567   896   NtQueryInformationThread  (820, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4b000,Pid=1252,Tid=2132,}, 0x0, ) == 0x0
 02568   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0T\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0T\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0T\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0T\10\0\0" )  ) == 0x0
 02569   896   NtResumeThread  (820, ... 1, ) == 0x0
 02570   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02571  2132   NtWaitForSingleObject  (100, 0, 0x0, ...
 02570   896   NtAllocateVirtualMemory  ... 126418944, 1048576, ) == 0x0
 02572   896   NtAllocateVirtualMemory  (-1, 127459328, 0, 8192, 4096, 4, ... 127459328, 8192, ) == 0x0
 02573   896   NtProtectVirtualMemory  (-1, (0x798e000), 4096, 260, ... (0x798e000), 4096, 4, ) == 0x0
 02574   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 824, {1252, 2136}, ) == 0x0
 02575   896   NtQueryInformationThread  (824, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4a000,Pid=1252,Tid=2136,}, 0x0, ) == 0x0
 02576   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0X\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0X\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0X\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0X\10\0\0" )  ) == 0x0
 02577   896   NtResumeThread  (824, ... 1, ) == 0x0
 02578   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 127467520, 1048576, ) == 0x0
 02579   896   NtAllocateVirtualMemory  (-1, 128507904, 0, 8192, 4096, 4, ... 128507904, 8192, ) == 0x0
 02580  2136   NtWaitForSingleObject  (100, 0, 0x0, ...
 02581   896   NtProtectVirtualMemory  (-1, (0x7a8e000), 4096, 260, ... (0x7a8e000), 4096, 4, ) == 0x0
 02582   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 828, {1252, 2140}, ) == 0x0
 02583   896   NtQueryInformationThread  (828, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff49000,Pid=1252,Tid=2140,}, 0x0, ) == 0x0
 02584   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0\\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0\\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0\\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0\\10\0\0" )  ) == 0x0
 02585   896   NtResumeThread  (828, ... 1, ) == 0x0
 02586   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02587  2140   NtWaitForSingleObject  (100, 0, 0x0, ...
 02586   896   NtAllocateVirtualMemory  ... 128516096, 1048576, ) == 0x0
 02588   896   NtAllocateVirtualMemory  (-1, 129556480, 0, 8192, 4096, 4, ... 129556480, 8192, ) == 0x0
 02589   896   NtProtectVirtualMemory  (-1, (0x7b8e000), 4096, 260, ... (0x7b8e000), 4096, 4, ) == 0x0
 02590   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 832, {1252, 2144}, ) == 0x0
 02591   896   NtQueryInformationThread  (832, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff48000,Pid=1252,Tid=2144,}, 0x0, ) == 0x0
 02592   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0`\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0`\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0`\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0`\10\0\0" )  ) == 0x0
 02593   896   NtResumeThread  (832, ... 1, ) == 0x0
 02594   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 129564672, 1048576, ) == 0x0
 02595   896   NtAllocateVirtualMemory  (-1, 130605056, 0, 8192, 4096, 4, ... 130605056, 8192, ) == 0x0
 02596  2144   NtWaitForSingleObject  (100, 0, 0x0, ...
 02597   896   NtProtectVirtualMemory  (-1, (0x7c8e000), 4096, 260, ... (0x7c8e000), 4096, 4, ) == 0x0
 02598   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 836, {1252, 2148}, ) == 0x0
 02599   896   NtQueryInformationThread  (836, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff47000,Pid=1252,Tid=2148,}, 0x0, ) == 0x0
 02600   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0d\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0d\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0d\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0d\10\0\0" )  ) == 0x0
 02601   896   NtResumeThread  (836, ... 1, ) == 0x0
 02602   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02603  2148   NtWaitForSingleObject  (100, 0, 0x0, ...
 02602   896   NtAllocateVirtualMemory  ... 130613248, 1048576, ) == 0x0
 02604   896   NtAllocateVirtualMemory  (-1, 131653632, 0, 8192, 4096, 4, ... 131653632, 8192, ) == 0x0
 02605   896   NtProtectVirtualMemory  (-1, (0x7d8e000), 4096, 260, ... (0x7d8e000), 4096, 4, ) == 0x0
 02606   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 840, {1252, 2152}, ) == 0x0
 02607   896   NtQueryInformationThread  (840, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff46000,Pid=1252,Tid=2152,}, 0x0, ) == 0x0
 02608   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0h\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0h\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0h\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0h\10\0\0" )  ) == 0x0
 02609   896   NtResumeThread  (840, ... 1, ) == 0x0
 02610   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 131661824, 1048576, ) == 0x0
 02611   896   NtAllocateVirtualMemory  (-1, 132702208, 0, 8192, 4096, 4, ... 132702208, 8192, ) == 0x0
 02612  2152   NtWaitForSingleObject  (100, 0, 0x0, ...
 02613   896   NtProtectVirtualMemory  (-1, (0x7e8e000), 4096, 260, ... (0x7e8e000), 4096, 4, ) == 0x0
 02614   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 844, {1252, 2156}, ) == 0x0
 02615   896   NtQueryInformationThread  (844, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff45000,Pid=1252,Tid=2156,}, 0x0, ) == 0x0
 02616   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\3\0\0\344\4\0\0l\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\3\0\0\344\4\0\0l\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\3\0\0\344\4\0\0l\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\3\0\0\344\4\0\0l\10\0\0" )  ) == 0x0
 02617   896   NtResumeThread  (844, ... 1, ) == 0x0
 02618   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02619  2156   NtWaitForSingleObject  (100, 0, 0x0, ...
 02618   896   NtAllocateVirtualMemory  ... 132710400, 1048576, ) == 0x0
 02620   896   NtAllocateVirtualMemory  (-1, 133750784, 0, 8192, 4096, 4, ... 133750784, 8192, ) == 0x0
 02621   896   NtProtectVirtualMemory  (-1, (0x7f8e000), 4096, 260, ... (0x7f8e000), 4096, 4, ) == 0x0
 02622   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 848, {1252, 2160}, ) == 0x0
 02623   896   NtQueryInformationThread  (848, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff44000,Pid=1252,Tid=2160,}, 0x0, ) == 0x0
 02624   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0p\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0p\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0p\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0p\10\0\0" )  ) == 0x0
 02625   896   NtResumeThread  (848, ... 1, ) == 0x0
 02626   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 133758976, 1048576, ) == 0x0
 02627   896   NtAllocateVirtualMemory  (-1, 134799360, 0, 8192, 4096, 4, ... 134799360, 8192, ) == 0x0
 02628  2160   NtWaitForSingleObject  (100, 0, 0x0, ...
 02629   896   NtProtectVirtualMemory  (-1, (0x808e000), 4096, 260, ... (0x808e000), 4096, 4, ) == 0x0
 02630   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 852, {1252, 2164}, ) == 0x0
 02631   896   NtQueryInformationThread  (852, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff43000,Pid=1252,Tid=2164,}, 0x0, ) == 0x0
 02632   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0t\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0t\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0t\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0t\10\0\0" )  ) == 0x0
 02633   896   NtResumeThread  (852, ... 1, ) == 0x0
 02634   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02635  2164   NtWaitForSingleObject  (100, 0, 0x0, ...
 02634   896   NtAllocateVirtualMemory  ... 134807552, 1048576, ) == 0x0
 02636   896   NtAllocateVirtualMemory  (-1, 135847936, 0, 8192, 4096, 4, ... 135847936, 8192, ) == 0x0
 02637   896   NtProtectVirtualMemory  (-1, (0x818e000), 4096, 260, ... (0x818e000), 4096, 4, ) == 0x0
 02638   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 856, {1252, 2168}, ) == 0x0
 02639   896   NtQueryInformationThread  (856, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff42000,Pid=1252,Tid=2168,}, 0x0, ) == 0x0
 02640   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0\344\4\0\0x\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0\344\4\0\0x\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0\344\4\0\0x\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0\344\4\0\0x\10\0\0" )  ) == 0x0
 02641   896   NtResumeThread  (856, ... 1, ) == 0x0
 02642   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 135856128, 1048576, ) == 0x0
 02643   896   NtAllocateVirtualMemory  (-1, 136896512, 0, 8192, 4096, 4, ... 136896512, 8192, ) == 0x0
 02644  2168   NtWaitForSingleObject  (100, 0, 0x0, ...
 02645   896   NtProtectVirtualMemory  (-1, (0x828e000), 4096, 260, ... (0x828e000), 4096, 4, ) == 0x0
 02646   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 860, {1252, 2172}, ) == 0x0
 02647   896   NtQueryInformationThread  (860, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff41000,Pid=1252,Tid=2172,}, 0x0, ) == 0x0
 02648   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\3\0\0\344\4\0\0|\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\3\0\0\344\4\0\0|\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81978, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\3\0\0\344\4\0\0|\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\3\0\0\344\4\0\0|\10\0\0" )  ) == 0x0
 02649   896   NtResumeThread  (860, ... 1, ) == 0x0
 02650   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02651  2172   NtWaitForSingleObject  (100, 0, 0x0, ...
 02650   896   NtAllocateVirtualMemory  ... 136904704, 1048576, ) == 0x0
 02652   896   NtAllocateVirtualMemory  (-1, 137945088, 0, 8192, 4096, 4, ... 137945088, 8192, ) == 0x0
 02653   896   NtProtectVirtualMemory  (-1, (0x838e000), 4096, 260, ... (0x838e000), 4096, 4, ) == 0x0
 02654   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 864, {1252, 2176}, ) == 0x0
 02655   896   NtQueryInformationThread  (864, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff40000,Pid=1252,Tid=2176,}, 0x0, ) == 0x0
 02656   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0\200\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0\200\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81979, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0\200\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0\200\10\0\0" )  ) == 0x0
 02657   896   NtResumeThread  (864, ... 1, ) == 0x0
 02658   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 137953280, 1048576, ) == 0x0
 02659   896   NtAllocateVirtualMemory  (-1, 138993664, 0, 8192, 4096, 4, ... 138993664, 8192, ) == 0x0
 02660  2176   NtWaitForSingleObject  (100, 0, 0x0, ...
 02661   896   NtProtectVirtualMemory  (-1, (0x848e000), 4096, 260, ... (0x848e000), 4096, 4, ) == 0x0
 02662   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 868, {1252, 2180}, ) == 0x0
 02663   896   NtQueryInformationThread  (868, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3f000,Pid=1252,Tid=2180,}, 0x0, ) == 0x0
 02664   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0\344\4\0\0\204\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0\344\4\0\0\204\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0\344\4\0\0\204\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0\344\4\0\0\204\10\0\0" )  ) == 0x0
 02665   896   NtResumeThread  (868, ... 1, ) == 0x0
 02666   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02667  2180   NtWaitForSingleObject  (100, 0, 0x0, ...
 02666   896   NtAllocateVirtualMemory  ... 139001856, 1048576, ) == 0x0
 02668   896   NtAllocateVirtualMemory  (-1, 140042240, 0, 8192, 4096, 4, ... 140042240, 8192, ) == 0x0
 02669   896   NtProtectVirtualMemory  (-1, (0x858e000), 4096, 260, ... (0x858e000), 4096, 4, ) == 0x0
 02670   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 872, {1252, 2184}, ) == 0x0
 02671   896   NtQueryInformationThread  (872, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3e000,Pid=1252,Tid=2184,}, 0x0, ) == 0x0
 02672   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0\344\4\0\0\210\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0\344\4\0\0\210\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0\344\4\0\0\210\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0\344\4\0\0\210\10\0\0" )  ) == 0x0
 02673   896   NtResumeThread  (872, ... 1, ) == 0x0
 02674   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 140050432, 1048576, ) == 0x0
 02675   896   NtAllocateVirtualMemory  (-1, 141090816, 0, 8192, 4096, 4, ... 141090816, 8192, ) == 0x0
 02676  2184   NtWaitForSingleObject  (100, 0, 0x0, ...
 02677   896   NtProtectVirtualMemory  (-1, (0x868e000), 4096, 260, ... (0x868e000), 4096, 4, ) == 0x0
 02678   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 876, {1252, 2188}, ) == 0x0
 02679   896   NtQueryInformationThread  (876, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3d000,Pid=1252,Tid=2188,}, 0x0, ) == 0x0
 02680   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\3\0\0\344\4\0\0\214\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\3\0\0\344\4\0\0\214\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\3\0\0\344\4\0\0\214\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\3\0\0\344\4\0\0\214\10\0\0" )  ) == 0x0
 02681   896   NtResumeThread  (876, ... 1, ) == 0x0
 02682   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02683  2188   NtWaitForSingleObject  (100, 0, 0x0, ...
 02682   896   NtAllocateVirtualMemory  ... 141099008, 1048576, ) == 0x0
 02684   896   NtAllocateVirtualMemory  (-1, 142139392, 0, 8192, 4096, 4, ... 142139392, 8192, ) == 0x0
 02685   896   NtProtectVirtualMemory  (-1, (0x878e000), 4096, 260, ... (0x878e000), 4096, 4, ) == 0x0
 02686   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 880, {1252, 2192}, ) == 0x0
 02687   896   NtQueryInformationThread  (880, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3c000,Pid=1252,Tid=2192,}, 0x0, ) == 0x0
 02688   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\3\0\0\344\4\0\0\220\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\3\0\0\344\4\0\0\220\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\3\0\0\344\4\0\0\220\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\3\0\0\344\4\0\0\220\10\0\0" )  ) == 0x0
 02689   896   NtResumeThread  (880, ... 1, ) == 0x0
 02690   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 142147584, 1048576, ) == 0x0
 02691   896   NtAllocateVirtualMemory  (-1, 143187968, 0, 8192, 4096, 4, ... 143187968, 8192, ) == 0x0
 02692  2192   NtWaitForSingleObject  (100, 0, 0x0, ...
 02693   896   NtProtectVirtualMemory  (-1, (0x888e000), 4096, 260, ... (0x888e000), 4096, 4, ) == 0x0
 02694   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 884, {1252, 2196}, ) == 0x0
 02695   896   NtQueryInformationThread  (884, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3b000,Pid=1252,Tid=2196,}, 0x0, ) == 0x0
 02696   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\3\0\0\344\4\0\0\224\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\3\0\0\344\4\0\0\224\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\3\0\0\344\4\0\0\224\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\3\0\0\344\4\0\0\224\10\0\0" )  ) == 0x0
 02697   896   NtResumeThread  (884, ... 1, ) == 0x0
 02698   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02699  2196   NtWaitForSingleObject  (100, 0, 0x0, ...
 02698   896   NtAllocateVirtualMemory  ... 143196160, 1048576, ) == 0x0
 02700   896   NtAllocateVirtualMemory  (-1, 144236544, 0, 8192, 4096, 4, ... 144236544, 8192, ) == 0x0
 02701   896   NtProtectVirtualMemory  (-1, (0x898e000), 4096, 260, ... (0x898e000), 4096, 4, ) == 0x0
 02702   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 888, {1252, 2200}, ) == 0x0
 02703   896   NtQueryInformationThread  (888, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3a000,Pid=1252,Tid=2200,}, 0x0, ) == 0x0
 02704   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\230\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\230\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\230\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\230\10\0\0" )  ) == 0x0
 02705   896   NtResumeThread  (888, ... 1, ) == 0x0
 02706   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 144244736, 1048576, ) == 0x0
 02707   896   NtAllocateVirtualMemory  (-1, 145285120, 0, 8192, 4096, 4, ... 145285120, 8192, ) == 0x0
 02708  2200   NtWaitForSingleObject  (100, 0, 0x0, ...
 02709   896   NtProtectVirtualMemory  (-1, (0x8a8e000), 4096, 260, ... (0x8a8e000), 4096, 4, ) == 0x0
 02710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 892, {1252, 2204}, ) == 0x0
 02711   896   NtQueryInformationThread  (892, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff39000,Pid=1252,Tid=2204,}, 0x0, ) == 0x0
 02712   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\3\0\0\344\4\0\0\234\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\3\0\0\344\4\0\0\234\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\3\0\0\344\4\0\0\234\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\3\0\0\344\4\0\0\234\10\0\0" )  ) == 0x0
 02713   896   NtResumeThread  (892, ... 1, ) == 0x0
 02714   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02715  2204   NtWaitForSingleObject  (100, 0, 0x0, ...
 02714   896   NtAllocateVirtualMemory  ... 145293312, 1048576, ) == 0x0
 02716   896   NtAllocateVirtualMemory  (-1, 146333696, 0, 8192, 4096, 4, ... 146333696, 8192, ) == 0x0
 02717   896   NtProtectVirtualMemory  (-1, (0x8b8e000), 4096, 260, ... (0x8b8e000), 4096, 4, ) == 0x0
 02718   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 896, {1252, 2208}, ) == 0x0
 02719   896   NtQueryInformationThread  (896, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff38000,Pid=1252,Tid=2208,}, 0x0, ) == 0x0
 02720   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0\344\4\0\0\240\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0\344\4\0\0\240\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0\344\4\0\0\240\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0\344\4\0\0\240\10\0\0" )  ) == 0x0
 02721   896   NtResumeThread  (896, ... 1, ) == 0x0
 02722   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 146341888, 1048576, ) == 0x0
 02723   896   NtAllocateVirtualMemory  (-1, 147382272, 0, 8192, 4096, 4, ... 147382272, 8192, ) == 0x0
 02724  2208   NtWaitForSingleObject  (100, 0, 0x0, ...
 02725   896   NtProtectVirtualMemory  (-1, (0x8c8e000), 4096, 260, ... (0x8c8e000), 4096, 4, ) == 0x0
 02726   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 900, {1252, 2212}, ) == 0x0
 02727   896   NtQueryInformationThread  (900, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff37000,Pid=1252,Tid=2212,}, 0x0, ) == 0x0
 02728   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\3\0\0\344\4\0\0\244\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\3\0\0\344\4\0\0\244\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81988, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\3\0\0\344\4\0\0\244\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\3\0\0\344\4\0\0\244\10\0\0" )  ) == 0x0
 02729   896   NtResumeThread  (900, ... 1, ) == 0x0
 02730   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02731  2212   NtWaitForSingleObject  (100, 0, 0x0, ...
 02730   896   NtAllocateVirtualMemory  ... 147390464, 1048576, ) == 0x0
 02732   896   NtAllocateVirtualMemory  (-1, 148430848, 0, 8192, 4096, 4, ... 148430848, 8192, ) == 0x0
 02733   896   NtProtectVirtualMemory  (-1, (0x8d8e000), 4096, 260, ... (0x8d8e000), 4096, 4, ) == 0x0
 02734   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 904, {1252, 2216}, ) == 0x0
 02735   896   NtQueryInformationThread  (904, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff36000,Pid=1252,Tid=2216,}, 0x0, ) == 0x0
 02736   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\3\0\0\344\4\0\0\250\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\3\0\0\344\4\0\0\250\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81989, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\3\0\0\344\4\0\0\250\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\3\0\0\344\4\0\0\250\10\0\0" )  ) == 0x0
 02737   896   NtResumeThread  (904, ... 1, ) == 0x0
 02738   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 148439040, 1048576, ) == 0x0
 02739   896   NtAllocateVirtualMemory  (-1, 149479424, 0, 8192, 4096, 4, ... 149479424, 8192, ) == 0x0
 02740  2216   NtWaitForSingleObject  (100, 0, 0x0, ...
 02741   896   NtProtectVirtualMemory  (-1, (0x8e8e000), 4096, 260, ... (0x8e8e000), 4096, 4, ) == 0x0
 02742   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 908, {1252, 2220}, ) == 0x0
 02743   896   NtQueryInformationThread  (908, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff35000,Pid=1252,Tid=2220,}, 0x0, ) == 0x0
 02744   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\3\0\0\344\4\0\0\254\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\3\0\0\344\4\0\0\254\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81990, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\3\0\0\344\4\0\0\254\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\3\0\0\344\4\0\0\254\10\0\0" )  ) == 0x0
 02745   896   NtResumeThread  (908, ... 1, ) == 0x0
 02746   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02747  2220   NtWaitForSingleObject  (100, 0, 0x0, ...
 02746   896   NtAllocateVirtualMemory  ... 149487616, 1048576, ) == 0x0
 02748   896   NtAllocateVirtualMemory  (-1, 150528000, 0, 8192, 4096, 4, ... 150528000, 8192, ) == 0x0
 02749   896   NtProtectVirtualMemory  (-1, (0x8f8e000), 4096, 260, ... (0x8f8e000), 4096, 4, ) == 0x0
 02750   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 912, {1252, 2224}, ) == 0x0
 02751   896   NtQueryInformationThread  (912, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff34000,Pid=1252,Tid=2224,}, 0x0, ) == 0x0
 02752   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\3\0\0\344\4\0\0\260\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\3\0\0\344\4\0\0\260\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81991, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\3\0\0\344\4\0\0\260\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\3\0\0\344\4\0\0\260\10\0\0" )  ) == 0x0
 02753   896   NtResumeThread  (912, ... 1, ) == 0x0
 02754   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 150536192, 1048576, ) == 0x0
 02755   896   NtAllocateVirtualMemory  (-1, 151576576, 0, 8192, 4096, 4, ... 151576576, 8192, ) == 0x0
 02756  2224   NtWaitForSingleObject  (100, 0, 0x0, ...
 02757   896   NtProtectVirtualMemory  (-1, (0x908e000), 4096, 260, ... (0x908e000), 4096, 4, ) == 0x0
 02758   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 916, {1252, 2228}, ) == 0x0
 02759   896   NtQueryInformationThread  (916, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff33000,Pid=1252,Tid=2228,}, 0x0, ) == 0x0
 02760   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\3\0\0\344\4\0\0\264\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\3\0\0\344\4\0\0\264\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81992, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\3\0\0\344\4\0\0\264\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\3\0\0\344\4\0\0\264\10\0\0" )  ) == 0x0
 02761   896   NtResumeThread  (916, ... 1, ) == 0x0
 02762   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02763  2228   NtWaitForSingleObject  (100, 0, 0x0, ...
 02762   896   NtAllocateVirtualMemory  ... 151584768, 1048576, ) == 0x0
 02764   896   NtAllocateVirtualMemory  (-1, 152625152, 0, 8192, 4096, 4, ... 152625152, 8192, ) == 0x0
 02765   896   NtProtectVirtualMemory  (-1, (0x918e000), 4096, 260, ... (0x918e000), 4096, 4, ) == 0x0
 02766   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 920, {1252, 2232}, ) == 0x0
 02767   896   NtQueryInformationThread  (920, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff32000,Pid=1252,Tid=2232,}, 0x0, ) == 0x0
 02768   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\3\0\0\344\4\0\0\270\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\3\0\0\344\4\0\0\270\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81993, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\3\0\0\344\4\0\0\270\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\3\0\0\344\4\0\0\270\10\0\0" )  ) == 0x0
 02769   896   NtResumeThread  (920, ... 1, ) == 0x0
 02770   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02771  2232   NtWaitForSingleObject  (100, 0, 0x0, ...
 02770   896   NtAllocateVirtualMemory  ... 152633344, 1048576, ) == 0x0
 02772   896   NtAllocateVirtualMemory  (-1, 153673728, 0, 8192, 4096, 4, ... 153673728, 8192, ) == 0x0
 02773   896   NtProtectVirtualMemory  (-1, (0x928e000), 4096, 260, ... (0x928e000), 4096, 4, ) == 0x0
 02774   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 924, {1252, 2236}, ) == 0x0
 02775   896   NtQueryInformationThread  (924, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff31000,Pid=1252,Tid=2236,}, 0x0, ) == 0x0
 02776   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\274\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\274\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81994, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\274\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\274\10\0\0" )  ) == 0x0
 02777   896   NtResumeThread  (924, ... 1, ) == 0x0
 02778   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 153681920, 1048576, ) == 0x0
 02779   896   NtAllocateVirtualMemory  (-1, 154722304, 0, 8192, 4096, 4, ... 154722304, 8192, ) == 0x0
 02780  2236   NtWaitForSingleObject  (100, 0, 0x0, ...
 02781   896   NtProtectVirtualMemory  (-1, (0x938e000), 4096, 260, ... (0x938e000), 4096, 4, ) == 0x0
 02782   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 928, {1252, 2240}, ) == 0x0
 02783   896   NtQueryInformationThread  (928, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff30000,Pid=1252,Tid=2240,}, 0x0, ) == 0x0
 02784   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\300\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\300\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81995, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\300\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\300\10\0\0" )  ) == 0x0
 02785   896   NtResumeThread  (928, ... 1, ) == 0x0
 02786   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02787  2240   NtWaitForSingleObject  (100, 0, 0x0, ...
 02786   896   NtAllocateVirtualMemory  ... 154730496, 1048576, ) == 0x0
 02788   896   NtAllocateVirtualMemory  (-1, 155770880, 0, 8192, 4096, 4, ... 155770880, 8192, ) == 0x0
 02789   896   NtProtectVirtualMemory  (-1, (0x948e000), 4096, 260, ... (0x948e000), 4096, 4, ) == 0x0
 02790   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 932, {1252, 2244}, ) == 0x0
 02791   896   NtQueryInformationThread  (932, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff2f000,Pid=1252,Tid=2244,}, 0x0, ) == 0x0
 02792   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\3\0\0\344\4\0\0\304\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\3\0\0\344\4\0\0\304\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81996, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\3\0\0\344\4\0\0\304\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\3\0\0\344\4\0\0\304\10\0\0" )  ) == 0x0
 02793   896   NtResumeThread  (932, ... 1, ) == 0x0
 02794   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 155779072, 1048576, ) == 0x0
 02795   896   NtAllocateVirtualMemory  (-1, 156819456, 0, 8192, 4096, 4, ... 156819456, 8192, ) == 0x0
 02796  2244   NtWaitForSingleObject  (100, 0, 0x0, ...
 02797   896   NtProtectVirtualMemory  (-1, (0x958e000), 4096, 260, ... (0x958e000), 4096, 4, ) == 0x0
 02798   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 936, {1252, 2248}, ) == 0x0
 02799   896   NtQueryInformationThread  (936, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff2e000,Pid=1252,Tid=2248,}, 0x0, ) == 0x0
 02800   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\3\0\0\344\4\0\0\310\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\3\0\0\344\4\0\0\310\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81997, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\3\0\0\344\4\0\0\310\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\3\0\0\344\4\0\0\310\10\0\0" )  ) == 0x0
 02801   896   NtResumeThread  (936, ... 1, ) == 0x0
 02802   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02803  2248   NtWaitForSingleObject  (100, 0, 0x0, ...
 02802   896   NtAllocateVirtualMemory  ... 156827648, 1048576, ) == 0x0
 02804   896   NtAllocateVirtualMemory  (-1, 157868032, 0, 8192, 4096, 4, ... 157868032, 8192, ) == 0x0
 02805   896   NtProtectVirtualMemory  (-1, (0x968e000), 4096, 260, ... (0x968e000), 4096, 4, ) == 0x0
 02806   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 940, {1252, 2252}, ) == 0x0
 02807   896   NtQueryInformationThread  (940, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff2d000,Pid=1252,Tid=2252,}, 0x0, ) == 0x0
 02808   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\3\0\0\344\4\0\0\314\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\3\0\0\344\4\0\0\314\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81998, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\3\0\0\344\4\0\0\314\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\3\0\0\344\4\0\0\314\10\0\0" )  ) == 0x0
 02809   896   NtResumeThread  (940, ... 1, ) == 0x0
 02810   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 157876224, 1048576, ) == 0x0
 02811   896   NtAllocateVirtualMemory  (-1, 158916608, 0, 8192, 4096, 4, ... 158916608, 8192, ) == 0x0
 02812  2252   NtWaitForSingleObject  (100, 0, 0x0, ...
 02813   896   NtProtectVirtualMemory  (-1, (0x978e000), 4096, 260, ... (0x978e000), 4096, 4, ) == 0x0
 02814   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 944, {1252, 2256}, ) == 0x0
 02815   896   NtQueryInformationThread  (944, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff2c000,Pid=1252,Tid=2256,}, 0x0, ) == 0x0
 02816   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\3\0\0\344\4\0\0\320\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\3\0\0\344\4\0\0\320\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81999, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\3\0\0\344\4\0\0\320\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\3\0\0\344\4\0\0\320\10\0\0" )  ) == 0x0
 02817   896   NtResumeThread  (944, ... 1, ) == 0x0
 02818   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02819  2256   NtWaitForSingleObject  (100, 0, 0x0, ...
 02818   896   NtAllocateVirtualMemory  ... 158924800, 1048576, ) == 0x0
 02820   896   NtAllocateVirtualMemory  (-1, 159965184, 0, 8192, 4096, 4, ... 159965184, 8192, ) == 0x0
 02821   896   NtProtectVirtualMemory  (-1, (0x988e000), 4096, 260, ... (0x988e000), 4096, 4, ) == 0x0
 02822   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 948, {1252, 2260}, ) == 0x0
 02823   896   NtQueryInformationThread  (948, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff2b000,Pid=1252,Tid=2260,}, 0x0, ) == 0x0
 02824   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\324\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\324\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82000, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\324\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\324\10\0\0" )  ) == 0x0
 02825   896   NtResumeThread  (948, ... 1, ) == 0x0
 02826   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 159973376, 1048576, ) == 0x0
 02827   896   NtAllocateVirtualMemory  (-1, 161013760, 0, 8192, 4096, 4, ... 161013760, 8192, ) == 0x0
 02828  2260   NtWaitForSingleObject  (100, 0, 0x0, ...
 02829   896   NtProtectVirtualMemory  (-1, (0x998e000), 4096, 260, ... (0x998e000), 4096, 4, ) == 0x0
 02830   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 952, {1252, 2264}, ) == 0x0
 02831   896   NtQueryInformationThread  (952, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff2a000,Pid=1252,Tid=2264,}, 0x0, ) == 0x0
 02832   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\3\0\0\344\4\0\0\330\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\3\0\0\344\4\0\0\330\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82001, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\3\0\0\344\4\0\0\330\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\3\0\0\344\4\0\0\330\10\0\0" )  ) == 0x0
 02833   896   NtResumeThread  (952, ... 1, ) == 0x0
 02834   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02835  2264   NtWaitForSingleObject  (100, 0, 0x0, ...
 02834   896   NtAllocateVirtualMemory  ... 161021952, 1048576, ) == 0x0
 02836   896   NtAllocateVirtualMemory  (-1, 162062336, 0, 8192, 4096, 4, ... 162062336, 8192, ) == 0x0
 02837   896   NtProtectVirtualMemory  (-1, (0x9a8e000), 4096, 260, ... (0x9a8e000), 4096, 4, ) == 0x0
 02838   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 956, {1252, 2268}, ) == 0x0
 02839   896   NtQueryInformationThread  (956, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff29000,Pid=1252,Tid=2268,}, 0x0, ) == 0x0
 02840   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\3\0\0\344\4\0\0\334\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\3\0\0\344\4\0\0\334\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82002, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\3\0\0\344\4\0\0\334\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\3\0\0\344\4\0\0\334\10\0\0" )  ) == 0x0
 02841   896   NtResumeThread  (956, ... 1, ) == 0x0
 02842   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 162070528, 1048576, ) == 0x0
 02843   896   NtAllocateVirtualMemory  (-1, 163110912, 0, 8192, 4096, 4, ... 163110912, 8192, ) == 0x0
 02844  2268   NtWaitForSingleObject  (100, 0, 0x0, ...
 02845   896   NtProtectVirtualMemory  (-1, (0x9b8e000), 4096, 260, ... (0x9b8e000), 4096, 4, ) == 0x0
 02846   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 960, {1252, 2272}, ) == 0x0
 02847   896   NtQueryInformationThread  (960, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff28000,Pid=1252,Tid=2272,}, 0x0, ) == 0x0
 02848   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\340\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\340\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82003, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\340\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\340\10\0\0" )  ) == 0x0
 02849   896   NtResumeThread  (960, ... 1, ) == 0x0
 02850   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02851  2272   NtWaitForSingleObject  (100, 0, 0x0, ...
 02850   896   NtAllocateVirtualMemory  ... 163119104, 1048576, ) == 0x0
 02852   896   NtAllocateVirtualMemory  (-1, 164159488, 0, 8192, 4096, 4, ... 164159488, 8192, ) == 0x0
 02853   896   NtProtectVirtualMemory  (-1, (0x9c8e000), 4096, 260, ... (0x9c8e000), 4096, 4, ) == 0x0
 02854   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 964, {1252, 2276}, ) == 0x0
 02855   896   NtQueryInformationThread  (964, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff27000,Pid=1252,Tid=2276,}, 0x0, ) == 0x0
 02856   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\3\0\0\344\4\0\0\344\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82004, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\3\0\0\344\4\0\0\344\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82004, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\3\0\0\344\4\0\0\344\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82004, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\3\0\0\344\4\0\0\344\10\0\0" )  ) == 0x0
 02857   896   NtResumeThread  (964, ... 1, ) == 0x0
 02858   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 164167680, 1048576, ) == 0x0
 02859   896   NtAllocateVirtualMemory  (-1, 165208064, 0, 8192, 4096, 4, ... 165208064, 8192, ) == 0x0
 02860  2276   NtWaitForSingleObject  (100, 0, 0x0, ...
 02861   896   NtProtectVirtualMemory  (-1, (0x9d8e000), 4096, 260, ... (0x9d8e000), 4096, 4, ) == 0x0
 02862   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 968, {1252, 2280}, ) == 0x0
 02863   896   NtQueryInformationThread  (968, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff26000,Pid=1252,Tid=2280,}, 0x0, ) == 0x0
 02864   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82004, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82004, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\3\0\0\344\4\0\0\350\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82005, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\3\0\0\344\4\0\0\350\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82005, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82004, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\3\0\0\344\4\0\0\350\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82005, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\3\0\0\344\4\0\0\350\10\0\0" )  ) == 0x0
 02865   896   NtResumeThread  (968, ... 1, ) == 0x0
 02866   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02867  2280   NtWaitForSingleObject  (100, 0, 0x0, ...
 02866   896   NtAllocateVirtualMemory  ... 165216256, 1048576, ) == 0x0
 02868   896   NtAllocateVirtualMemory  (-1, 166256640, 0, 8192, 4096, 4, ... 166256640, 8192, ) == 0x0
 02869   896   NtProtectVirtualMemory  (-1, (0x9e8e000), 4096, 260, ... (0x9e8e000), 4096, 4, ) == 0x0
 02870   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 972, {1252, 2284}, ) == 0x0
 02871   896   NtQueryInformationThread  (972, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff25000,Pid=1252,Tid=2284,}, 0x0, ) == 0x0
 02872   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82005, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82005, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\354\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82006, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\354\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82006, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82005, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\354\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82006, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\354\10\0\0" )  ) == 0x0
 02873   896   NtResumeThread  (972, ... 1, ) == 0x0
 02874   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 166264832, 1048576, ) == 0x0
 02875   896   NtAllocateVirtualMemory  (-1, 167305216, 0, 8192, 4096, 4, ... 167305216, 8192, ) == 0x0
 02876  2284   NtWaitForSingleObject  (100, 0, 0x0, ...
 02877   896   NtProtectVirtualMemory  (-1, (0x9f8e000), 4096, 260, ... (0x9f8e000), 4096, 4, ) == 0x0
 02878   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 976, {1252, 2288}, ) == 0x0
 02879   896   NtQueryInformationThread  (976, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff24000,Pid=1252,Tid=2288,}, 0x0, ) == 0x0
 02880   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82006, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82006, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\3\0\0\344\4\0\0\360\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82007, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\3\0\0\344\4\0\0\360\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82007, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82006, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\3\0\0\344\4\0\0\360\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82007, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\3\0\0\344\4\0\0\360\10\0\0" )  ) == 0x0
 02881   896   NtResumeThread  (976, ... 1, ) == 0x0
 02882   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02883  2288   NtWaitForSingleObject  (100, 0, 0x0, ...
 02882   896   NtAllocateVirtualMemory  ... 167313408, 1048576, ) == 0x0
 02884   896   NtAllocateVirtualMemory  (-1, 168353792, 0, 8192, 4096, 4, ... 168353792, 8192, ) == 0x0
 02885   896   NtProtectVirtualMemory  (-1, (0xa08e000), 4096, 260, ... (0xa08e000), 4096, 4, ) == 0x0
 02886   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 980, {1252, 2292}, ) == 0x0
 02887   896   NtQueryInformationThread  (980, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff23000,Pid=1252,Tid=2292,}, 0x0, ) == 0x0
 02888   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82007, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82007, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\3\0\0\344\4\0\0\364\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82008, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\3\0\0\344\4\0\0\364\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82008, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82007, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\3\0\0\344\4\0\0\364\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82008, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\3\0\0\344\4\0\0\364\10\0\0" )  ) == 0x0
 02889   896   NtResumeThread  (980, ... 1, ) == 0x0
 02890   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 168361984, 1048576, ) == 0x0
 02891   896   NtAllocateVirtualMemory  (-1, 169402368, 0, 8192, 4096, 4, ... 169402368, 8192, ) == 0x0
 02892  2292   NtWaitForSingleObject  (100, 0, 0x0, ...
 02893   896   NtProtectVirtualMemory  (-1, (0xa18e000), 4096, 260, ... (0xa18e000), 4096, 4, ) == 0x0
 02894   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 984, {1252, 2296}, ) == 0x0
 02895   896   NtQueryInformationThread  (984, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff22000,Pid=1252,Tid=2296,}, 0x0, ) == 0x0
 02896   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82008, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82008, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\370\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82009, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\370\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82009, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82008, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\370\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82009, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\370\10\0\0" )  ) == 0x0
 02897   896   NtResumeThread  (984, ... 1, ) == 0x0
 02898   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02899  2296   NtWaitForSingleObject  (100, 0, 0x0, ...
 02898   896   NtAllocateVirtualMemory  ... 169410560, 1048576, ) == 0x0
 02900   896   NtAllocateVirtualMemory  (-1, 170450944, 0, 8192, 4096, 4, ... 170450944, 8192, ) == 0x0
 02901   896   NtProtectVirtualMemory  (-1, (0xa28e000), 4096, 260, ... (0xa28e000), 4096, 4, ) == 0x0
 02902   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 988, {1252, 2300}, ) == 0x0
 02903   896   NtQueryInformationThread  (988, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff21000,Pid=1252,Tid=2300,}, 0x0, ) == 0x0
 02904   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82009, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82009, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\3\0\0\344\4\0\0\374\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82010, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\3\0\0\344\4\0\0\374\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82010, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82009, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\3\0\0\344\4\0\0\374\10\0\0" ... {28, 56, reply, 0, 1252, 896, 82010, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\3\0\0\344\4\0\0\374\10\0\0" )  ) == 0x0
 02905   896   NtResumeThread  (988, ... 1, ) == 0x0
 02906   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 170459136, 1048576, ) == 0x0
 02907   896   NtAllocateVirtualMemory  (-1, 171499520, 0, 8192, 4096, 4, ... 171499520, 8192, ) == 0x0
 02908  2300   NtWaitForSingleObject  (100, 0, 0x0, ...
 02909   896   NtProtectVirtualMemory  (-1, (0xa38e000), 4096, 260, ... (0xa38e000), 4096, 4, ) == 0x0
 02910   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 992, {1252, 2304}, ) == 0x0
 02911   896   NtQueryInformationThread  (992, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff20000,Pid=1252,Tid=2304,}, 0x0, ) == 0x0
 02912   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82010, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82010, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\0\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82011, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\0\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82011, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82010, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\0\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82011, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\0\11\0\0" )  ) == 0x0
 02913   896   NtResumeThread  (992, ... 1, ) == 0x0
 02914   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02915  2304   NtWaitForSingleObject  (100, 0, 0x0, ...
 02914   896   NtAllocateVirtualMemory  ... 171507712, 1048576, ) == 0x0
 02916   896   NtAllocateVirtualMemory  (-1, 172548096, 0, 8192, 4096, 4, ... 172548096, 8192, ) == 0x0
 02917   896   NtProtectVirtualMemory  (-1, (0xa48e000), 4096, 260, ... (0xa48e000), 4096, 4, ) == 0x0
 02918   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 996, {1252, 2308}, ) == 0x0
 02919   896   NtQueryInformationThread  (996, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff1f000,Pid=1252,Tid=2308,}, 0x0, ) == 0x0
 02920   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82011, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82011, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\4\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82012, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\4\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82012, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82011, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\4\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82012, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\4\11\0\0" )  ) == 0x0
 02921   896   NtResumeThread  (996, ... 1, ) == 0x0
 02922   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 172556288, 1048576, ) == 0x0
 02923   896   NtAllocateVirtualMemory  (-1, 173596672, 0, 8192, 4096, 4, ... 173596672, 8192, ) == 0x0
 02924  2308   NtWaitForSingleObject  (100, 0, 0x0, ...
 02925   896   NtProtectVirtualMemory  (-1, (0xa58e000), 4096, 260, ... (0xa58e000), 4096, 4, ) == 0x0
 02926   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1000, {1252, 2312}, ) == 0x0
 02927   896   NtQueryInformationThread  (1000, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff1e000,Pid=1252,Tid=2312,}, 0x0, ) == 0x0
 02928   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82012, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82012, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\3\0\0\344\4\0\0\10\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82013, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\3\0\0\344\4\0\0\10\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82013, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82012, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\3\0\0\344\4\0\0\10\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82013, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\3\0\0\344\4\0\0\10\11\0\0" )  ) == 0x0
 02929   896   NtResumeThread  (1000, ... 1, ) == 0x0
 02930   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02931  2312   NtWaitForSingleObject  (100, 0, 0x0, ...
 02930   896   NtAllocateVirtualMemory  ... 173604864, 1048576, ) == 0x0
 02932   896   NtAllocateVirtualMemory  (-1, 174645248, 0, 8192, 4096, 4, ... 174645248, 8192, ) == 0x0
 02933   896   NtProtectVirtualMemory  (-1, (0xa68e000), 4096, 260, ... (0xa68e000), 4096, 4, ) == 0x0
 02934   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1004, {1252, 2316}, ) == 0x0
 02935   896   NtQueryInformationThread  (1004, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff1d000,Pid=1252,Tid=2316,}, 0x0, ) == 0x0
 02936   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82013, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82013, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\3\0\0\344\4\0\0\14\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82014, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\3\0\0\344\4\0\0\14\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82014, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82013, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\3\0\0\344\4\0\0\14\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82014, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\3\0\0\344\4\0\0\14\11\0\0" )  ) == 0x0
 02937   896   NtResumeThread  (1004, ... 1, ) == 0x0
 02938   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 174653440, 1048576, ) == 0x0
 02939   896   NtAllocateVirtualMemory  (-1, 175693824, 0, 8192, 4096, 4, ... 175693824, 8192, ) == 0x0
 02940  2316   NtWaitForSingleObject  (100, 0, 0x0, ...
 02941   896   NtProtectVirtualMemory  (-1, (0xa78e000), 4096, 260, ... (0xa78e000), 4096, 4, ) == 0x0
 02942   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1008, {1252, 2320}, ) == 0x0
 02943   896   NtQueryInformationThread  (1008, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff1c000,Pid=1252,Tid=2320,}, 0x0, ) == 0x0
 02944   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82014, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82014, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\3\0\0\344\4\0\0\20\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82015, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\3\0\0\344\4\0\0\20\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82015, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82014, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\3\0\0\344\4\0\0\20\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82015, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\3\0\0\344\4\0\0\20\11\0\0" )  ) == 0x0
 02945   896   NtResumeThread  (1008, ... 1, ) == 0x0
 02946   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02947  2320   NtWaitForSingleObject  (100, 0, 0x0, ...
 02946   896   NtAllocateVirtualMemory  ... 175702016, 1048576, ) == 0x0
 02948   896   NtAllocateVirtualMemory  (-1, 176742400, 0, 8192, 4096, 4, ... 176742400, 8192, ) == 0x0
 02949   896   NtProtectVirtualMemory  (-1, (0xa88e000), 4096, 260, ... (0xa88e000), 4096, 4, ) == 0x0
 02950   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1012, {1252, 2324}, ) == 0x0
 02951   896   NtQueryInformationThread  (1012, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff1b000,Pid=1252,Tid=2324,}, 0x0, ) == 0x0
 02952   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82015, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82015, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\3\0\0\344\4\0\0\24\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82016, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\3\0\0\344\4\0\0\24\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82016, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82015, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\3\0\0\344\4\0\0\24\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82016, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\3\0\0\344\4\0\0\24\11\0\0" )  ) == 0x0
 02953   896   NtResumeThread  (1012, ... 1, ) == 0x0
 02954   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 176750592, 1048576, ) == 0x0
 02955   896   NtAllocateVirtualMemory  (-1, 177790976, 0, 8192, 4096, 4, ... 177790976, 8192, ) == 0x0
 02956  2324   NtWaitForSingleObject  (100, 0, 0x0, ...
 02957   896   NtProtectVirtualMemory  (-1, (0xa98e000), 4096, 260, ... (0xa98e000), 4096, 4, ) == 0x0
 02958   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1016, {1252, 2328}, ) == 0x0
 02959   896   NtQueryInformationThread  (1016, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff1a000,Pid=1252,Tid=2328,}, 0x0, ) == 0x0
 02960   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82016, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82016, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\3\0\0\344\4\0\0\30\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82017, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\3\0\0\344\4\0\0\30\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82017, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82016, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\3\0\0\344\4\0\0\30\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82017, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\3\0\0\344\4\0\0\30\11\0\0" )  ) == 0x0
 02961   896   NtResumeThread  (1016, ... 1, ) == 0x0
 02962   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02963  2328   NtWaitForSingleObject  (100, 0, 0x0, ...
 02962   896   NtAllocateVirtualMemory  ... 177799168, 1048576, ) == 0x0
 02964   896   NtAllocateVirtualMemory  (-1, 178839552, 0, 8192, 4096, 4, ... 178839552, 8192, ) == 0x0
 02965   896   NtProtectVirtualMemory  (-1, (0xaa8e000), 4096, 260, ... (0xaa8e000), 4096, 4, ) == 0x0
 02966   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1020, {1252, 2332}, ) == 0x0
 02967   896   NtQueryInformationThread  (1020, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff19000,Pid=1252,Tid=2332,}, 0x0, ) == 0x0
 02968   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82017, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82017, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\3\0\0\344\4\0\0\34\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82018, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\3\0\0\344\4\0\0\34\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82018, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82017, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\3\0\0\344\4\0\0\34\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82018, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\3\0\0\344\4\0\0\34\11\0\0" )  ) == 0x0
 02969   896   NtResumeThread  (1020, ... 1, ) == 0x0
 02970   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 178847744, 1048576, ) == 0x0
 02971   896   NtAllocateVirtualMemory  (-1, 179888128, 0, 8192, 4096, 4, ... 179888128, 8192, ) == 0x0
 02972  2332   NtWaitForSingleObject  (100, 0, 0x0, ...
 02973   896   NtProtectVirtualMemory  (-1, (0xab8e000), 4096, 260, ... (0xab8e000), 4096, 4, ) == 0x0
 02974   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1024, {1252, 2336}, ) == 0x0
 02975   896   NtQueryInformationThread  (1024, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff18000,Pid=1252,Tid=2336,}, 0x0, ) == 0x0
 02976   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82018, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82018, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\4\0\0\344\4\0\0 \11\0\0" ... {28, 56, reply, 0, 1252, 896, 82019, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\4\0\0\344\4\0\0 \11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82019, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82018, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\4\0\0\344\4\0\0 \11\0\0" ... {28, 56, reply, 0, 1252, 896, 82019, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\4\0\0\344\4\0\0 \11\0\0" )  ) == 0x0
 02977   896   NtResumeThread  (1024, ... 1, ) == 0x0
 02978   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02979  2336   NtWaitForSingleObject  (100, 0, 0x0, ...
 02978   896   NtAllocateVirtualMemory  ... 179896320, 1048576, ) == 0x0
 02980   896   NtAllocateVirtualMemory  (-1, 180936704, 0, 8192, 4096, 4, ... 180936704, 8192, ) == 0x0
 02981   896   NtProtectVirtualMemory  (-1, (0xac8e000), 4096, 260, ... (0xac8e000), 4096, 4, ) == 0x0
 02982   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1028, {1252, 2340}, ) == 0x0
 02983   896   NtQueryInformationThread  (1028, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff17000,Pid=1252,Tid=2340,}, 0x0, ) == 0x0
 02984   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82019, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82019, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\4\0\0\344\4\0\0$\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82020, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\4\0\0\344\4\0\0$\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82020, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82019, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\4\0\0\344\4\0\0$\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82020, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\4\0\0\344\4\0\0$\11\0\0" )  ) == 0x0
 02985   896   NtResumeThread  (1028, ... 1, ) == 0x0
 02986   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 180944896, 1048576, ) == 0x0
 02987   896   NtAllocateVirtualMemory  (-1, 181985280, 0, 8192, 4096, 4, ... 181985280, 8192, ) == 0x0
 02988  2340   NtWaitForSingleObject  (100, 0, 0x0, ...
 02989   896   NtProtectVirtualMemory  (-1, (0xad8e000), 4096, 260, ... (0xad8e000), 4096, 4, ) == 0x0
 02990   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1032, {1252, 2344}, ) == 0x0
 02991   896   NtQueryInformationThread  (1032, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff16000,Pid=1252,Tid=2344,}, 0x0, ) == 0x0
 02992   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82020, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82020, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\4\0\0\344\4\0\0(\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82021, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\4\0\0\344\4\0\0(\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82021, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82020, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\4\0\0\344\4\0\0(\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82021, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\4\0\0\344\4\0\0(\11\0\0" )  ) == 0x0
 02993   896   NtResumeThread  (1032, ... 1, ) == 0x0
 02994   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02995  2344   NtWaitForSingleObject  (100, 0, 0x0, ...
 02994   896   NtAllocateVirtualMemory  ... 181993472, 1048576, ) == 0x0
 02996   896   NtAllocateVirtualMemory  (-1, 183033856, 0, 8192, 4096, 4, ... 183033856, 8192, ) == 0x0
 02997   896   NtProtectVirtualMemory  (-1, (0xae8e000), 4096, 260, ... (0xae8e000), 4096, 4, ) == 0x0
 02998   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1036, {1252, 2348}, ) == 0x0
 02999   896   NtQueryInformationThread  (1036, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff15000,Pid=1252,Tid=2348,}, 0x0, ) == 0x0
 03000   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82021, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82021, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\4\0\0\344\4\0\0,\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82022, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\4\0\0\344\4\0\0,\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82022, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82021, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\4\0\0\344\4\0\0,\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82022, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\4\0\0\344\4\0\0,\11\0\0" )  ) == 0x0
 03001   896   NtResumeThread  (1036, ... 1, ) == 0x0
 03002   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03003  2348   NtWaitForSingleObject  (100, 0, 0x0, ...
 03002   896   NtAllocateVirtualMemory  ... 183042048, 1048576, ) == 0x0
 03004   896   NtAllocateVirtualMemory  (-1, 184082432, 0, 8192, 4096, 4, ... 184082432, 8192, ) == 0x0
 03005   896   NtProtectVirtualMemory  (-1, (0xaf8e000), 4096, 260, ... (0xaf8e000), 4096, 4, ) == 0x0
 03006   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1040, {1252, 2352}, ) == 0x0
 03007   896   NtQueryInformationThread  (1040, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff14000,Pid=1252,Tid=2352,}, 0x0, ) == 0x0
 03008   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82022, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82022, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\4\0\0\344\4\0\00\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82023, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\4\0\0\344\4\0\00\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82023, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82022, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\4\0\0\344\4\0\00\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82023, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\4\0\0\344\4\0\00\11\0\0" )  ) == 0x0
 03009   896   NtResumeThread  (1040, ... 1, ) == 0x0
 03010   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 184090624, 1048576, ) == 0x0
 03011   896   NtAllocateVirtualMemory  (-1, 185131008, 0, 8192, 4096, 4, ... 185131008, 8192, ) == 0x0
 03012  2352   NtWaitForSingleObject  (100, 0, 0x0, ...
 03013   896   NtProtectVirtualMemory  (-1, (0xb08e000), 4096, 260, ... (0xb08e000), 4096, 4, ) == 0x0
 03014   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03015  1028   NtQueryPerformanceCounter  (... {-1448635355, 16}, {3579545, 0}, ) == 0x0
 03016  1028   NtSetEventBoostPriority  (100, ...
 02065   840   NtWaitForSingleObject  ... ) == 0x0
 03017   840   NtSetEventBoostPriority  (100, ...
 02090   876   NtWaitForSingleObject  ... ) == 0x0
 03018   876   NtSetEventBoostPriority  (100, ...
 02109  1104   NtWaitForSingleObject  ... ) == 0x0
 03019  1104   NtSetEventBoostPriority  (100, ...
 02132   860   NtWaitForSingleObject  ... ) == 0x0
 03020   860   NtSetEventBoostPriority  (100, ...
 02146  1516   NtWaitForSingleObject  ... ) == 0x0
 03021  1516   NtSetEventBoostPriority  (100, ...
 02156   780   NtWaitForSingleObject  ... ) == 0x0
 03022   780   NtSetEventBoostPriority  (100, ...
 02163   940   NtWaitForSingleObject  ... ) == 0x0
 03023   940   NtSetEventBoostPriority  (100, ...
 02172  1268   NtWaitForSingleObject  ... ) == 0x0
 03024  1268   NtSetEventBoostPriority  (100, ...
 02179   644   NtWaitForSingleObject  ... ) == 0x0
 03025   644   NtSetEventBoostPriority  (100, ...
 02188  1736   NtWaitForSingleObject  ... ) == 0x0
 03026  1736   NtSetEventBoostPriority  (100, ...
 02195   320   NtWaitForSingleObject  ... ) == 0x0
 03027   320   NtSetEventBoostPriority  (100, ...
 02204   380   NtWaitForSingleObject  ... ) == 0x0
 03028   380   NtSetEventBoostPriority  (100, ...
 02211  1332   NtWaitForSingleObject  ... ) == 0x0
 03029  1332   NtSetEventBoostPriority  (100, ...
 02220  1336   NtWaitForSingleObject  ... ) == 0x0
 03030  1336   NtSetEventBoostPriority  (100, ...
 02227  1808   NtWaitForSingleObject  ... ) == 0x0
 03031  1808   NtSetEventBoostPriority  (100, ...
 02236   468   NtWaitForSingleObject  ... ) == 0x0
 03032   468   NtSetEventBoostPriority  (100, ...
 02243   752   NtWaitForSingleObject  ... ) == 0x0
 03033   752   NtSetEventBoostPriority  (100, ...
 02252  1512   NtWaitForSingleObject  ... ) == 0x0
 03034  1512   NtSetEventBoostPriority  (100, ...
 02259  1380   NtWaitForSingleObject  ... ) == 0x0
 03035  1380   NtSetEventBoostPriority  (100, ...
 02268  1564   NtWaitForSingleObject  ... ) == 0x0
 03036  1564   NtSetEventBoostPriority  (100, ...
 02275   164   NtWaitForSingleObject  ... ) == 0x0
 03037   164   NtSetEventBoostPriority  (100, ...
 02284   312   NtWaitForSingleObject  ... ) == 0x0
 03038   312   NtSetEventBoostPriority  (100, ...
 02291  1964   NtWaitForSingleObject  ... ) == 0x0
 03039  1964   NtSetEventBoostPriority  (100, ...
 02300  1568   NtWaitForSingleObject  ... ) == 0x0
 03040  1568   NtSetEventBoostPriority  (100, ...
 02307  1624   NtWaitForSingleObject  ... ) == 0x0
 03041  1624   NtSetEventBoostPriority  (100, ...
 02316  1716   NtWaitForSingleObject  ... ) == 0x0
 03042  1716   NtSetEventBoostPriority  (100, ...
 02323  1440   NtWaitForSingleObject  ... ) == 0x0
 03043  1440   NtAllocateVirtualMemory  (-1, 8876032, 0, 4096, 4096, 4, ... 8876032, 4096, ) == 0x0
 03042  1716   NtSetEventBoostPriority  ... ) == 0x0
 03041  1624   NtSetEventBoostPriority  ... ) == 0x0
 03040  1568   NtSetEventBoostPriority  ... ) == 0x0
 03039  1964   NtSetEventBoostPriority  ... ) == 0x0
 03038   312   NtSetEventBoostPriority  ... ) == 0x0
 03037   164   NtSetEventBoostPriority  ... ) == 0x0
 03036  1564   NtSetEventBoostPriority  ... ) == 0x0
 03035  1380   NtSetEventBoostPriority  ... ) == 0x0
 03034  1512   NtSetEventBoostPriority  ... ) == 0x0
 03033   752   NtSetEventBoostPriority  ... ) == 0x0
 03032   468   NtSetEventBoostPriority  ... ) == 0x0
 03031  1808   NtSetEventBoostPriority  ... ) == 0x0
 03030  1336   NtSetEventBoostPriority  ... ) == 0x0
 03029  1332   NtSetEventBoostPriority  ... ) == 0x0
 03028   380   NtSetEventBoostPriority  ... ) == 0x0
 03027   320   NtSetEventBoostPriority  ... ) == 0x0
 03026  1736   NtSetEventBoostPriority  ... ) == 0x0
 03025   644   NtSetEventBoostPriority  ... ) == 0x0
 03024  1268   NtSetEventBoostPriority  ... ) == 0x0
 03023   940   NtSetEventBoostPriority  ... ) == 0x0
 03022   780   NtSetEventBoostPriority  ... ) == 0x0
 03021  1516   NtSetEventBoostPriority  ... ) == 0x0
 03020   860   NtSetEventBoostPriority  ... ) == 0x0
 03019  1104   NtSetEventBoostPriority  ... ) == 0x0
 03018   876   NtSetEventBoostPriority  ... ) == 0x0
 03017   840   NtSetEventBoostPriority  ... ) == 0x0
 03016  1028   NtSetEventBoostPriority  ... ) == 0x0
 03014   896   NtCreateThread  ... 1044, {1252, 2356}, ) == 0x0
 03044  1440   NtSetEventBoostPriority  (100, ...
 03045  1716   NtTestAlert  (...
 03046  1624   NtTestAlert  (...
 03047  1568   NtTestAlert  (...
 03048  1964   NtTestAlert  (...
 03049   312   NtTestAlert  (...
 03050   164   NtTestAlert  (...
 03051  1564   NtTestAlert  (...
 03052  1380   NtTestAlert  (...
 03053  1512   NtTestAlert  (...
 03054   752   NtTestAlert  (...
 03055   468   NtTestAlert  (...
 03056  1808   NtTestAlert  (...
 03057  1336   NtTestAlert  (...
 03058  1332   NtTestAlert  (...
 03059   380   NtTestAlert  (...
 03060   320   NtTestAlert  (...
 03061  1736   NtTestAlert  (...
 03062   644   NtTestAlert  (...
 03063  1268   NtTestAlert  (...
 03064   940   NtTestAlert  (...
 03065   780   NtTestAlert  (...
 03066  1516   NtTestAlert  (...
 03067   860   NtTestAlert  (...
 03068  1104   NtTestAlert  (...
 03069   876   NtTestAlert  (...
 03070  1028   NtWaitForSingleObject  (100, 0, 0x0, ...
 03071   896   NtQueryInformationThread  (1044, Basic, 28, ...
 02332  1664   NtWaitForSingleObject  ... ) == 0x0
 03044  1440   NtSetEventBoostPriority  ... ) == 0x0
 03045  1716   NtTestAlert  ... ) == 0x0
 03046  1624   NtTestAlert  ... ) == 0x0
 03047  1568   NtTestAlert  ... ) == 0x0
 03048  1964   NtTestAlert  ... ) == 0x0
 03049   312   NtTestAlert  ... ) == 0x0
 03050   164   NtTestAlert  ... ) == 0x0
 03051  1564   NtTestAlert  ... ) == 0x0
 03052  1380   NtTestAlert  ... ) == 0x0
 03053  1512   NtTestAlert  ... ) == 0x0
 03054   752   NtTestAlert  ... ) == 0x0
 03055   468   NtTestAlert  ... ) == 0x0
 03056  1808   NtTestAlert  ... ) == 0x0
 03057  1336   NtTestAlert  ... ) == 0x0
 03058  1332   NtTestAlert  ... ) == 0x0
 03059   380   NtTestAlert  ... ) == 0x0
 03060   320   NtTestAlert  ... ) == 0x0
 03061  1736   NtTestAlert  ... ) == 0x0
 03062   644   NtTestAlert  ... ) == 0x0
 03063  1268   NtTestAlert  ... ) == 0x0
 03064   940   NtTestAlert  ... ) == 0x0
 03065   780   NtTestAlert  ... ) == 0x0
 03066  1516   NtTestAlert  ... ) == 0x0
 03067   860   NtTestAlert  ... ) == 0x0
 03068  1104   NtTestAlert  ... ) == 0x0
 03069   876   NtTestAlert  ... ) == 0x0
 03072   840   NtTestAlert  (...
 03073  1664   NtSetEventBoostPriority  (100, ...
 03071   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff13000,Pid=1252,Tid=2356,}, 0x0, ) == 0x0
 03074  1440   NtTestAlert  (...
 03075  1716   NtContinue  (92863792, 1, ...
 03076  1624   NtContinue  (91815216, 1, ...
 03077  1568   NtContinue  (90766640, 1, ...
 03078  1964   NtContinue  (89718064, 1, ...
 03079   312   NtContinue  (88669488, 1, ...
 03080   164   NtContinue  (87620912, 1, ...
 03081  1564   NtContinue  (86572336, 1, ...
 03082  1380   NtContinue  (85523760, 1, ...
 03083  1512   NtContinue  (84475184, 1, ...
 03084   752   NtContinue  (83426608, 1, ...
 03085   468   NtContinue  (82378032, 1, ...
 03086  1808   NtContinue  (81329456, 1, ...
 03087  1336   NtContinue  (80280880, 1, ...
 03088  1332   NtContinue  (79232304, 1, ...
 03089   380   NtContinue  (78183728, 1, ...
 03090   320   NtContinue  (77135152, 1, ...
 03091  1736   NtContinue  (76086576, 1, ...
 03092   644   NtContinue  (75038000, 1, ...
 03093  1268   NtContinue  (73989424, 1, ...
 03094   940   NtContinue  (72940848, 1, ...
 03095   780   NtContinue  (71892272, 1, ...
 03096  1516   NtContinue  (70843696, 1, ...
 03097   860   NtContinue  (69795120, 1, ...
 03098  1104   NtContinue  (68746544, 1, ...
 03099   876   NtContinue  (67697968, 1, ...
 02339  1972   NtWaitForSingleObject  ... ) == 0x0
 03073  1664   NtSetEventBoostPriority  ... ) == 0x0
 03072   840   NtTestAlert  ... ) == 0x0
 03074  1440   NtTestAlert  ... ) == 0x0
 03100  1716   NtRegisterThreadTerminatePort  (24, ...
 03101  1624   NtRegisterThreadTerminatePort  (24, ...
 03102  1568   NtRegisterThreadTerminatePort  (24, ...
 03103  1964   NtRegisterThreadTerminatePort  (24, ...
 03104   312   NtRegisterThreadTerminatePort  (24, ...
 03105   164   NtRegisterThreadTerminatePort  (24, ...
 03106  1564   NtRegisterThreadTerminatePort  (24, ...
 03107  1380   NtRegisterThreadTerminatePort  (24, ...
 03108  1512   NtRegisterThreadTerminatePort  (24, ...
 03109   752   NtRegisterThreadTerminatePort  (24, ...
 03110   468   NtRegisterThreadTerminatePort  (24, ...
 03111  1808   NtRegisterThreadTerminatePort  (24, ...
 03112  1336   NtRegisterThreadTerminatePort  (24, ...
 03113  1332   NtRegisterThreadTerminatePort  (24, ...
 03114   380   NtRegisterThreadTerminatePort  (24, ...
 03115   320   NtRegisterThreadTerminatePort  (24, ...
 03116  1736   NtRegisterThreadTerminatePort  (24, ...
 03117   644   NtRegisterThreadTerminatePort  (24, ...
 03118  1268   NtRegisterThreadTerminatePort  (24, ...
 03119   940   NtRegisterThreadTerminatePort  (24, ...
 03120   780   NtRegisterThreadTerminatePort  (24, ...
 03121  1516   NtRegisterThreadTerminatePort  (24, ...
 03122   860   NtRegisterThreadTerminatePort  (24, ...
 03123  1104   NtRegisterThreadTerminatePort  (24, ...
 03124  1972   NtSetEventBoostPriority  (100, ...
 03125   876   NtRegisterThreadTerminatePort  (24, ...
 03126   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82023, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82023, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\4\0\0\344\4\0\04\11\0\0" ...  ...
 03127   840   NtContinue  (66649392, 1, ...
 03128  1440   NtContinue  (93912368, 1, ...
 03100  1716   NtRegisterThreadTerminatePort  ... ) == 0x0
 03101  1624   NtRegisterThreadTerminatePort  ... ) == 0x0
 03102  1568   NtRegisterThreadTerminatePort  ... ) == 0x0
 03103  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 03104   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 03105   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 03106  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 03107  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 03108  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 03109   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 03110   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 03111  1808   NtRegisterThreadTerminatePort  ... ) == 0x0
 03112  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 03113  1332   NtRegisterThreadTerminatePort  ... ) == 0x0
 03114   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 03115   320   NtRegisterThreadTerminatePort  ... ) == 0x0
 03116  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 03117   644   NtRegisterThreadTerminatePort  ... ) == 0x0
 03118  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 03119   940   NtRegisterThreadTerminatePort  ... ) == 0x0
 03120   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 03121  1516   NtRegisterThreadTerminatePort  ... ) == 0x0
 03122   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 02347  1036   NtWaitForSingleObject  ... ) == 0x0
 03124  1972   NtSetEventBoostPriority  ... ) == 0x0
 03123  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 03125   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 03126   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82024, 0}  ... {28, 56, reply, 0, 1252, 896, 82024, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\4\0\0\344\4\0\04\11\0\0" )  ) == 0x0
 03129   840   NtRegisterThreadTerminatePort  (24, ...
 03130  1440   NtRegisterThreadTerminatePort  (24, ...
 03131  1716   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03132  1624   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03133  1568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03134  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03135   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03136   164   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03137  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03138  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03139  1512   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03140   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03141   468   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03142  1808   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03143  1336   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ...
 03144  1332   NtWaitForSingleObject  (296, 0, 0x0, ...
 03145   380   NtWaitForSingleObject  (296, 0, 0x0, ...
 03146   320   NtWaitForSingleObject  (296, 0, 0x0, ...
 03147  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 03148   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 03149  1268   NtWaitForSingleObject  (296, 0, 0x0, ...
 03150   940   NtWaitForSingleObject  (296, 0, 0x0, ...
 03151   780   NtWaitForSingleObject  (296, 0, 0x0, ...
 03152  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 03153  1036   NtWaitForSingleObject  (296, 0, 0x0, ...
 03154   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 03155  1664   NtTestAlert  (...
 03156  1104   NtWaitForSingleObject  (296, 0, 0x0, ...
 03157   876   NtWaitForSingleObject  (296, 0, 0x0, ...
 03158   896   NtResumeThread  (1044, ...
 03129   840   NtRegisterThreadTerminatePort  ... ) == 0x0
 03159  1972   NtTestAlert  (...
 03130  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 03131  1716   NtDuplicateObject  ... 1048, ) == 0x0
 03132  1624   NtDuplicateObject  ... 1052, ) == 0x0
 03133  1568   NtDuplicateObject  ... 1056, ) == 0x0
 03134  1964   NtDuplicateObject  ... 1060, ) == 0x0
 03135   312   NtDuplicateObject  ... 1064, ) == 0x0
 03136   164   NtDuplicateObject  ... 1068, ) == 0x0
 03137  1564   NtDuplicateObject  ... 1072, ) == 0x0
 03138  1380   NtDuplicateObject  ... 1076, ) == 0x0
 03139  1512   NtDuplicateObject  ... 1080, ) == 0x0
 03140   752   NtDuplicateObject  ... 1084, ) == 0x0
 03141   468   NtDuplicateObject  ... 1088, ) == 0x0
 03142  1808   NtDuplicateObject  ... 1092, ) == 0x0
 03143  1336   NtAllocateVirtualMemory  ... 1404928, 4096, ) == 0x0
 03155  1664   NtTestAlert  ... ) == 0x0
 03158   896   NtResumeThread  ... 1, ) == 0x0
 03160   840   NtWaitForSingleObject  (296, 0, 0x0, ...
 03159  1972   NtTestAlert  ... ) == 0x0
 03161  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 03162  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 03163  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 03164  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 03165  1964   NtWaitForSingleObject  (296, 0, 0x0, ...
 03166   312   NtWaitForSingleObject  (296, 0, 0x0, ...
 03167   164   NtWaitForSingleObject  (296, 0, 0x0, ...
 03168  1564   NtWaitForSingleObject  (296, 0, 0x0, ...
 03169  1380   NtWaitForSingleObject  (296, 0, 0x0, ...
 03170  1512   NtWaitForSingleObject  (296, 0, 0x0, ...
 03171   752   NtWaitForSingleObject  (296, 0, 0x0, ...
 03172   468   NtWaitForSingleObject  (296, 0, 0x0, ...
 03173  1808   NtWaitForSingleObject  (296, 0, 0x0, ...
 03174  1336   NtSetEventBoostPriority  (296, ...
 03175  1664   NtContinue  (94960944, 1, ...
 03176   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03177  2356   NtWaitForSingleObject  (100, 0, 0x0, ...
 03178  1972   NtContinue  (96009520, 1, ...
 03144  1332   NtWaitForSingleObject  ... ) == 0x0
 03174  1336   NtSetEventBoostPriority  ... ) == 0x0
 03179  1664   NtRegisterThreadTerminatePort  (24, ...
 03180  1332   NtSetEventBoostPriority  (296, ...
 03181  1972   NtRegisterThreadTerminatePort  (24, ...
 03182  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03145   380   NtWaitForSingleObject  ... ) == 0x0
 03179  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 03181  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 03182  1336   NtDuplicateObject  ... 1096, ) == 0x0
 03183   380   NtSetEventBoostPriority  (296, ...
 03184  1664   NtWaitForSingleObject  (296, 0, 0x0, ...
 03185  1972   NtWaitForSingleObject  (296, 0, 0x0, ...
 03186  1336   NtWaitForSingleObject  (296, 0, 0x0, ...
 03146   320   NtWaitForSingleObject  ... ) == 0x0
 03183   380   NtSetEventBoostPriority  ... ) == 0x0
 03180  1332   NtSetEventBoostPriority  ... ) == 0x0
 03176   896   NtAllocateVirtualMemory  ... 185139200, 1048576, ) == 0x0
 03187   320   NtSetEventBoostPriority  (296, ...
 03188   380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03189  1332   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03190   896   NtAllocateVirtualMemory  (-1, 186179584, 0, 8192, 4096, 4, ...
 03147  1736   NtWaitForSingleObject  ... ) == 0x0
 03188   380   NtDuplicateObject  ... 1100, ) == 0x0
 03189  1332   NtDuplicateObject  ... 1104, ) == 0x0
 03190   896   NtAllocateVirtualMemory  ... 186179584, 8192, ) == 0x0
 03191  1736   NtSetEventBoostPriority  (296, ...
 03187   320   NtSetEventBoostPriority  ... ) == 0x0
 03192   380   NtWaitForSingleObject  (296, 0, 0x0, ...
 02133  2016   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 2016, 81914, 0}  ... {44, 68, reply, 0, 1252, 2016, 81914, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03193   896   NtProtectVirtualMemory  (-1, (0xb18e000), 4096, 260, ...
 03148   644   NtWaitForSingleObject  ... ) == 0x0
 03194   320   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03195  2016   NtRaiseException  (11074064, 11073324, 1, ...
 03193   896   NtProtectVirtualMemory  ... (0xb18e000), 4096, 4, ) == 0x0
 03196   644   NtSetEventBoostPriority  (296, ...
 03194   320   NtDuplicateObject  ... 1108, ) == 0x0
 03197  2016   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 03198   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03149  1268   NtWaitForSingleObject  ... ) == 0x0
 03196   644   NtSetEventBoostPriority  ... ) == 0x0
 03191  1736   NtSetEventBoostPriority  ... ) == 0x0
 03199  1332   NtWaitForSingleObject  (296, 0, 0x0, ...
 03200   320   NtWaitForSingleObject  (296, 0, 0x0, ...
 03197  2016   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 03201  1268   NtSetEventBoostPriority  (296, ...
 03202   644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03203  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03204  2016   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 03150   940   NtWaitForSingleObject  ... ) == 0x0
 03202   644   NtDuplicateObject  ... 1112, ) == 0x0
 03203  1736   NtDuplicateObject  ... 1116, ) == 0x0
 03204  2016   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 03205   940   NtSetEventBoostPriority  (296, ...
 03201  1268   NtSetEventBoostPriority  ... ) == 0x0
 03198   896   NtCreateThread  ... 1120, {1252, 2360}, ) == 0x0
 03206   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 03207  2016   NtContinue  (11072292, 0, ...
 03151   780   NtWaitForSingleObject  ... ) == 0x0
 03208  1268   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03209   896   NtQueryInformationThread  (1120, Basic, 28, ...
 03210  2016   NtDeviceIoControlFile  (416, 112, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 03211   780   NtSetEventBoostPriority  (296, ...
 03208  1268   NtDuplicateObject  ... 1124, ) == 0x0
 03209   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff12000,Pid=1252,Tid=2360,}, 0x0, ) == 0x0
 03210  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 03153  1036   NtWaitForSingleObject  ... ) == 0x0
 03211   780   NtSetEventBoostPriority  ... ) == 0x0
 03205   940   NtSetEventBoostPriority  ... ) == 0x0
 03212  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 03213   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82024, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82024, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\4\0\0\344\4\0\08\11\0\0" ...  ...
 03214  1268   NtWaitForSingleObject  (296, 0, 0x0, ...
 03215  1036   NtSetEventBoostPriority  (296, ...
 03216   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03217   940   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03213   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82025, 0}  ... {28, 56, reply, 0, 1252, 896, 82025, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\4\0\0\344\4\0\08\11\0\0" )  ) == 0x0
 03152  1516   NtWaitForSingleObject  ... ) == 0x0
 03215  1036   NtSetEventBoostPriority  ... ) == 0x0
 03216   780   NtDuplicateObject  ... 1128, ) == 0x0
 03217   940   NtDuplicateObject  ... 1132, ) == 0x0
 03218  2016   NtWaitForSingleObject  (112, 1, {-5000000, -1}, ...
 03219  1516   NtSetEventBoostPriority  (296, ...
 03220   896   NtResumeThread  (1120, ...
 03221  1036   NtSetEventBoostPriority  (100, ...
 03222   780   NtWaitForSingleObject  (296, 0, 0x0, ...
 03154   860   NtWaitForSingleObject  ... ) == 0x0
 03220   896   NtResumeThread  ... 1, ) == 0x0
 02356  1248   NtWaitForSingleObject  ... ) == 0x0
 03221  1036   NtSetEventBoostPriority  ... ) == 0x0
 03223   860   NtSetEventBoostPriority  (296, ...
 03224  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 03225   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03226  1036   NtTestAlert  (...
 03156  1104   NtWaitForSingleObject  ... ) == 0x0
 03225   896   NtAllocateVirtualMemory  ... 186187776, 1048576, ) == 0x0
 03226  1036   NtTestAlert  ... ) == 0x0
 03227  1104   NtSetEventBoostPriority  (296, ...
 03228   896   NtAllocateVirtualMemory  (-1, 187228160, 0, 8192, 4096, 4, ...
 03229  1036   NtContinue  (97058096, 1, ...
 03157   876   NtWaitForSingleObject  ... ) == 0x0
 03228   896   NtAllocateVirtualMemory  ... 187228160, 8192, ) == 0x0
 03230  1036   NtRegisterThreadTerminatePort  (24, ...
 03231   876   NtSetEventBoostPriority  (296, ...
 03227  1104   NtSetEventBoostPriority  ... ) == 0x0
 03223   860   NtSetEventBoostPriority  ... ) == 0x0
 03219  1516   NtSetEventBoostPriority  ... ) == 0x0
 03232   940   NtWaitForSingleObject  (296, 0, 0x0, ...
 03233  2360   NtWaitForSingleObject  (100, 0, 0x0, ...
 03234   896   NtProtectVirtualMemory  (-1, (0xb28e000), 4096, 260, ...
 03161  1440   NtWaitForSingleObject  ... ) == 0x0
 03235  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03236   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03237  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03234   896   NtProtectVirtualMemory  ... (0xb28e000), 4096, 4, ) == 0x0
 03238  1440   NtSetEventBoostPriority  (296, ...
 03235  1104   NtDuplicateObject  ... 1136, ) == 0x0
 03236   860   NtDuplicateObject  ... 1140, ) == 0x0
 03237  1516   NtDuplicateObject  ... 1144, ) == 0x0
 03239   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03162  1716   NtWaitForSingleObject  ... ) == 0x0
 03238  1440   NtSetEventBoostPriority  ... ) == 0x0
 03231   876   NtSetEventBoostPriority  ... ) == 0x0
 03230  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 03240  1104   NtWaitForSingleObject  (296, 0, 0x0, ...
 03241   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 03242  1716   NtSetEventBoostPriority  (296, ...
 03239   896   NtCreateThread  ... 1148, {1252, 2364}, ) == 0x0
 03243  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 03244   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03245  1036   NtWaitForSingleObject  (296, 0, 0x0, ...
 03163  1624   NtWaitForSingleObject  ... ) == 0x0
 03242  1716   NtSetEventBoostPriority  ... ) == 0x0
 03246   896   NtQueryInformationThread  (1148, Basic, 28, ...
 03244   876   NtDuplicateObject  ... 1152, ) == 0x0
 03247  1624   NtSetEventBoostPriority  (296, ...
 03248  1440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03246   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff11000,Pid=1252,Tid=2364,}, 0x0, ) == 0x0
 03249  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 03164  1568   NtWaitForSingleObject  ... ) == 0x0
 03247  1624   NtSetEventBoostPriority  ... ) == 0x0
 03248  1440   NtDuplicateObject  ... 1156, ) == 0x0
 03250   876   NtWaitForSingleObject  (296, 0, 0x0, ...
 03251  1568   NtSetEventBoostPriority  (296, ...
 03252   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82025, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82025, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\4\0\0\344\4\0\0<\11\0\0" ...  ...
 03253  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 03165  1964   NtWaitForSingleObject  ... ) == 0x0
 03251  1568   NtSetEventBoostPriority  ... ) == 0x0
 03252   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82026, 0}  ... {28, 56, reply, 0, 1252, 896, 82026, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\4\0\0\344\4\0\0<\11\0\0" )  ) == 0x0
 03254  1964   NtSetEventBoostPriority  (296, ...
 03255  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 03166   312   NtWaitForSingleObject  ... ) == 0x0
 03254  1964   NtSetEventBoostPriority  ... ) == 0x0
 03256   896   NtResumeThread  (1148, ...
 03257   312   NtSetEventBoostPriority  (296, ...
 03258  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 03167   164   NtWaitForSingleObject  ... ) == 0x0
 03257   312   NtSetEventBoostPriority  ... ) == 0x0
 03256   896   NtResumeThread  ... 1, ) == 0x0
 03259   164   NtSetEventBoostPriority  (296, ...
 03260  1964   NtWaitForSingleObject  (296, 0, 0x0, ...
 03261  2364   NtWaitForSingleObject  (100, 0, 0x0, ...
 03168  1564   NtWaitForSingleObject  ... ) == 0x0
 03259   164   NtSetEventBoostPriority  ... ) == 0x0
 03262   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03263  1564   NtSetEventBoostPriority  (296, ...
 03264   312   NtWaitForSingleObject  (296, 0, 0x0, ...
 03265   164   NtWaitForSingleObject  (296, 0, 0x0, ...
 03169  1380   NtWaitForSingleObject  ... ) == 0x0
 03263  1564   NtSetEventBoostPriority  ... ) == 0x0
 03266  1380   NtSetEventBoostPriority  (296, ...
 03262   896   NtAllocateVirtualMemory  ... 187236352, 1048576, ) == 0x0
 03170  1512   NtWaitForSingleObject  ... ) == 0x0
 03266  1380   NtSetEventBoostPriority  ... ) == 0x0
 03267  1512   NtSetEventBoostPriority  (296, ...
 03268   896   NtAllocateVirtualMemory  (-1, 188276736, 0, 8192, 4096, 4, ...
 03269  1564   NtWaitForSingleObject  (296, 0, 0x0, ...
 03171   752   NtWaitForSingleObject  ... ) == 0x0
 03267  1512   NtSetEventBoostPriority  ... ) == 0x0
 03268   896   NtAllocateVirtualMemory  ... 188276736, 8192, ) == 0x0
 03270   752   NtSetEventBoostPriority  (296, ...
 03271  1380   NtWaitForSingleObject  (296, 0, 0x0, ...
 03172   468   NtWaitForSingleObject  ... ) == 0x0
 03270   752   NtSetEventBoostPriority  ... ) == 0x0
 03272   896   NtProtectVirtualMemory  (-1, (0xb38e000), 4096, 260, ...
 03273   468   NtSetEventBoostPriority  (296, ...
 03274  1512   NtWaitForSingleObject  (296, 0, 0x0, ...
 03272   896   NtProtectVirtualMemory  ... (0xb38e000), 4096, 4, ) == 0x0
 03275   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 1160, {1252, 2368}, ) == 0x0
 03276   896   NtQueryInformationThread  (1160, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff10000,Pid=1252,Tid=2368,}, 0x0, ) == 0x0
 03277   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82026, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82026, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\4\0\0\344\4\0\0@\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82027, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\4\0\0\344\4\0\0@\11\0\0" )  ... {28, 56, reply, 0, 1252, 896, 82027, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82026, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\4\0\0\344\4\0\0@\11\0\0" ... {28, 56, reply, 0, 1252, 896, 82027, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\4\0\0\344\4\0\0@\11\0\0" )  ) == 0x0
 03173  1808   NtWaitForSingleObject  ... ) == 0x0
 03273   468   NtSetEventBoostPriority  ... ) == 0x0
 03278   752   NtWaitForSingleObject  (296, 0, 0x0, ...
 03279  1808   NtSetEventBoostPriority  (296, ...
 03280   468   NtWaitForSingleObject  (296, 0, 0x0, ...
 03160   840   NtWaitForSingleObject  ... ) == 0x0
 03279  1808   NtSetEventBoostPriority  ... ) == 0x0
 03281   840   NtSetEventBoostPriority  (296, ...
 03282   896   NtResumeThread  (1160, ...
 03184  1664   NtWaitForSingleObject  ... ) == 0x0
 03282   896   NtResumeThread  ... 1, ) == 0x0
 03283  1664   NtSetEventBoostPriority  (296, ...
 03284   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03185  1972   NtWaitForSingleObject  ... ) == 0x0
 03283  1664   NtSetEventBoostPriority  ... ) == 0x0
 03285  1972   NtSetEventBoostPriority  (296, ...
 03284   896   NtAllocateVirtualMemory  ... 188284928, 1048576, ) == 0x0
 03281   840   NtSetEventBoostPriority  ... ) == 0x0
 03286  1808   NtWaitForSingleObject  (296, 0, 0x0, ...
 03287  2368   NtWaitForSingleObject  (100, 0, 0x0, ...
 03186  1336   NtWaitForSingleObject  ... ) == 0x0
 03288   896   NtAllocateVirtualMemory  (-1, 189325312, 0, 8192, 4096, 4, ...
 03289   840   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03290  1336   NtSetEventBoostPriority  (296, ...
 03288   896   NtAllocateVirtualMemory  ... 189325312, 8192, ) == 0x0
 03289   840   NtDuplicateObject  ... 1164, ) == 0x0
 03192   380   NtWaitForSingleObject  ... ) == 0x0
 03290  1336   NtSetEventBoostPriority  ... ) == 0x0
 03285  1972   NtSetEventBoostPriority  ... ) == 0x0
 03291  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03292   896   NtProtectVirtualMemory  (-1, (0xb48e000), 4096, 260, ...
 03293   380   NtSetEventBoostPriority  (296, ...
 03294  1336   NtWaitForSingleObject  (296, 0, 0x0, ...
 03295  1972   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03291  1664   NtDuplicateObject  ... 1168, ) == 0x0
 03292   896   NtProtectVirtualMemory  ... (0xb48e000), 4096, 4, ) == 0x0
 03199  1332   NtWaitForSingleObject  ... ) == 0x0
 03293   380   NtSetEventBoostPriority  ... ) == 0x0
 03295  1972   NtDuplicateObject  ... 1172, ) == 0x0
 03296  1664   NtWaitForSingleObject  (296, 0, 0x0, ...
 03297  1332   NtSetEventBoostPriority  (296, ...
 03298   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03299   380   NtWaitForSingleObject  (296, 0, 0x0, ...
 03300   840   NtWaitForSingleObject  (296, 0, 0x0, ...
 03200   320   NtWaitForSingleObject  ... ) == 0x0
 03297  1332   NtSetEventBoostPriority  ... ) == 0x0
 03298   896   NtCreateThread  ... 1176, {1252, 2372}, ) == 0x0
 03301  1972   NtWaitForSingleObject  (296, 0, 0x0, ...
 03302   320   NtSetEventBoostPriority  (296, ...
 03303  1332   NtWaitForSingleObject  (296, 0, 0x0, ...
 03304   896   NtQueryInformationThread  (1176, Basic, 28, ...
 03206   644   NtWaitForSingleObject  ... ) == 0x0
 03302   320   NtSetEventBoostPriority  ... ) == 0x0
 03305   644   NtSetEventBoostPriority  (296, ...
 03304   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff0f000,Pid=1252,Tid=2372,}, 0x0, ) == 0x0
 03212  1736   NtWaitForSingleObject  ... ) == 0x0
 03305   644   NtSetEventBoostPriority  ... ) == 0x0
 03306   320   NtWaitForSingleObject  (296, 0, 0x0, ...
 03307  1736   NtSetEventBoostPriority  (296, ...
 03308   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 03309   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82027, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82027, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\4\0\0\344\4\0\0D\11\0\0" ...  ...
 03214  1268   NtWaitForSingleObject  ... ) == 0x0
 03307  1736   NtSetEventBoostPriority  ... ) == 0x0
 03310  1268   NtSetEventBoostPriority  (296, ...
 03309   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82028, 0}  ... {28, 56, reply, 0, 1252, 896, 82028, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\4\0\0\344\4\0\0D\11\0\0" )  ) == 0x0
 03222   780   NtWaitForSingleObject  ... ) == 0x0
 03310  1268   NtSetEventBoostPriority  ... ) == 0x0
 03311  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 03312   780   NtSetEventBoostPriority  (296, ...
 03313   896   NtResumeThread  (1176, ...
 03314  1268   NtWaitForSingleObject  (296, 0, 0x0, ...
 03224  1248   NtWaitForSingleObject  ... ) == 0x0
 03312   780   NtSetEventBoostPriority  ... ) == 0x0
 03313   896   NtResumeThread  ... 1, ) == 0x0
 03315  1248   NtSetEventBoostPriority  (296, ...
 03316   780   NtWaitForSingleObject  (296, 0, 0x0, ...
 03232   940   NtWaitForSingleObject  ... ) == 0x0
 03315  1248   NtSetEventBoostPriority  ... ) == 0x0
 03317   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03318  2372   NtWaitForSingleObject  (100, 0, 0x0, ...
 03319   940   NtSetEventBoostPriority  (296, ...
 03320  1248   NtSetEventBoostPriority  (100, ...
 03240  1104   NtWaitForSingleObject  ... ) == 0x0
 03319   940   NtSetEventBoostPriority  ... ) == 0x0
 03321  1104   NtSetEventBoostPriority  (296, ...
 02363  1656   NtWaitForSingleObject  ... ) == 0x0
 03320  1248   NtSetEventBoostPriority  ... ) == 0x0
 03241   860   NtWaitForSingleObject  ... ) == 0x0
 03322  1656   NtWaitForSingleObject  (296, 0, 0x0, ...
 03321  1104   NtSetEventBoostPriority  ... ) == 0x0
 03323   940   NtWaitForSingleObject  (296, 0, 0x0, ...
 03324   860   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ...
 03325  1248   NtTestAlert  (...
 03326  1104   NtWaitForSingleObject  (296, 0, 0x0, ...
 03317   896   NtAllocateVirtualMemory  ... 189333504, 1048576, ) == 0x0
 03324   860   NtAllocateVirtualMemory  ... 1409024, 4096, ) == 0x0
 03325  1248   NtTestAlert  ... ) == 0x0
 03327   860   NtSetEventBoostPriority  (296, ...
 03328   896   NtAllocateVirtualMemory  (-1, 190373888, 0, 8192, 4096, 4, ...
 03329  1248   NtContinue  (98106672, 1, ...
 03328   896   NtAllocateVirtualMemory  ... 190373888, 8192, ) == 0x0
 03330  1248   NtRegisterThreadTerminatePort  (24, ...
 03331   896   NtProtectVirtualMemory  (-1, (0xb58e000), 4096, 260, ...
 03243  1516   NtWaitForSingleObject  ... ) == 0x0
 03327   860   NtSetEventBoostPriority  ... ) == 0x0
 03331   896   NtProtectVirtualMemory  ... (0xb58e000), 4096, 4, ) == 0x0
 03332  1516   NtSetEventBoostPriority  (296, ...
 03333   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 03334   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03245  1036   NtWaitForSingleObject  ... ) == 0x0
 03332  1516   NtSetEventBoostPriority  ... ) == 0x0
 03330  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 03335  1036   NtSetEventBoostPriority  (296, ...
 03336  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 03249  1716   NtWaitForSingleObject  ... ) == 0x0
 03335  1036   NtSetEventBoostPriority  ... ) == 0x0
 03337  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 03334   896   NtCreateThread  ... 1180, {1252, 2376}, ) == 0x0
 03338  1716   NtSetEventBoostPriority  (296, ...
 03250   876   NtWaitForSingleObject  ... ) == 0x0
 03339   876   NtSetEventBoostPriority  (296, ...
 03253  1440   NtWaitForSingleObject  ... ) == 0x0
 03340  1440   NtSetEventBoostPriority  (296, ...
 03255  1624   NtWaitForSingleObject  ... ) == 0x0
 03341  1624   NtSetEventBoostPriority  (296, ...
 03258  1568   NtWaitForSingleObject  ... ) == 0x0
 03342  1568   NtSetEventBoostPriority  (296, ...
 03260  1964   NtWaitForSingleObject  ... ) == 0x0
 03343  1964   NtSetEventBoostPriority  (296, ...
 03264   312   NtWaitForSingleObject  ... ) == 0x0
 03344   312   NtSetEventBoostPriority  (296, ...
 03265   164   NtWaitForSingleObject  ... ) == 0x0
 03345   164   NtSetEventBoostPriority  (296, ...
 03269  1564   NtWaitForSingleObject  ... ) == 0x0
 03346  1564   NtSetEventBoostPriority  (296, ...
 03271  1380   NtWaitForSingleObject  ... ) == 0x0
 03347  1380   NtSetEventBoostPriority  (296, ...
 03274  1512   NtWaitForSingleObject  ... ) == 0x0
 03348  1512   NtSetEventBoostPriority  (296, ...
 03278   752   NtWaitForSingleObject  ... ) == 0x0
 03349   752   NtSetEventBoostPriority  (296, ...
 03280   468   NtWaitForSingleObject  ... ) == 0x0
 03350   468   NtSetEventBoostPriority  (296, ...
 03286  1808   NtWaitForSingleObject  ... ) == 0x0
 03351  1808   NtSetEventBoostPriority  (296, ...
 03294  1336   NtWaitForSingleObject  ... ) == 0x0
 03352  1336   NtSetEventBoostPriority  (296, ...
 03296  1664   NtWaitForSingleObject  ... ) == 0x0
 03353  1664   NtSetEventBoostPriority  (296, ...
 03300   840   NtWaitForSingleObject  ... ) == 0x0
 03354   840   NtSetEventBoostPriority  (296, ...
 03301  1972   NtWaitForSingleObject  ... ) == 0x0
 03355  1972   NtSetEventBoostPriority  (296, ...
 03299   380   NtWaitForSingleObject  ... ) == 0x0
 03356   380   NtSetEventBoostPriority  (296, ...
 03303  1332   NtWaitForSingleObject  ... ) == 0x0
 03357  1332   NtSetEventBoostPriority  (296, ...
 03306   320   NtWaitForSingleObject  ... ) == 0x0
 03358   320   NtSetEventBoostPriority  (296, ...
 03308   644   NtWaitForSingleObject  ... ) == 0x0
 03359   644   NtSetEventBoostPriority  (296, ...
 03311  1736   NtWaitForSingleObject  ... ) == 0x0
 03360  1736   NtSetEventBoostPriority  (296, ...
 03314  1268   NtWaitForSingleObject  ... ) == 0x0
 03361  1268   NtSetEventBoostPriority  (296, ...
 03316   780   NtWaitForSingleObject  ... ) == 0x0
 03362   780   NtSetEventBoostPriority  (296, ...
 03322  1656   NtWaitForSingleObject  ... ) == 0x0
 03363  1656   NtSetEventBoostPriority  (296, ...
 03323   940   NtWaitForSingleObject  ... ) == 0x0
 03364   940   NtSetEventBoostPriority  (296, ...
 03326  1104   NtWaitForSingleObject  ... ) == 0x0
 03365  1104   NtSetEventBoostPriority  (296, ...
 03333   860   NtWaitForSingleObject  ... ) == 0x0
 03366   860   NtSetEventBoostPriority  (296, ...
 03336  1516   NtWaitForSingleObject  ... ) == 0x0
 03367  1516   NtSetEventBoostPriority  (296, ...
 03337  1248   NtWaitForSingleObject  ... ) == 0x0
 03368  1248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 1184, ) == 0x0
 03366   860   NtSetEventBoostPriority  ... ) == 0x0
 03363  1656   NtSetEventBoostPriority  ... ) == 0x0
 03355  1972   NtSetEventBoostPriority  ... ) == 0x0
 03354   840   NtSetEventBoostPriority  ... ) == 0x0
 03353  1664   NtSetEventBoostPriority  ... ) == 0x0
 03352  1336   NtSetEventBoostPriority  ... ) == 0x0
 03351  1808   NtSetEventBoostPriority  ... ) == 0x0
 03350   468   NtSetEventBoostPriority  ... ) == 0x0
 03349   752   NtSetEventBoostPriority  ... ) == 0x0
 03348  1512   NtSetEventBoostPriority  ... ) == 0x0
 03347  1380   NtSetEventBoostPriority  ... ) == 0x0
 03346  1564   NtSetEventBoostPriority  ... ) == 0x0
 03345   164   NtSetEventBoostPriority  ... ) == 0x0
 03344   312   NtSetEventBoostPriority  ... ) == 0x0
 03343  1964   NtSetEventBoostPriority  ... ) == 0x0
 03342  1568   NtSetEventBoostPriority  ... ) == 0x0
 03341  1624   NtSetEventBoostPriority  ... ) == 0x0
 03340  1440   NtSetEventBoostPriority  ... ) == 0x0
 03339   876   NtSetEventBoostPriority  ... ) == 0x0
 03338  1716   NtSetEventBoostPriority  ... ) == 0x0
 03369   896   NtQueryInformationThread  (1180, Basic, 28, ...
 03367  1516   NtSetEventBoostPriority  ... ) == 0x0
 03365  1104   NtSetEventBoostPriority  ... ) == 0x0
 03364   940   NtSetEventBoostPriority  ... ) == 0x0
 03362   780   NtSetEventBoostPriority  ... ) == 0x0
 03361  1268   NtSetEventBoostPriority  ... ) == 0x0
 03360  1736   NtSetEventBoostPriority  ... ) == 0x0
 03359   644   NtSetEventBoostPriority  ... ) == 0x0
 03358   320   NtSetEventBoostPriority  ... ) == 0x0
 03357  1332   NtSetEventBoostPriority  ... ) == 0x0
 03356   380   NtSetEventBoostPriority  ... ) == 0x0
 03370  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03371  1248   NtWaitForSingleObject  (304, 0, 0x0, ...
 03372   860   NtWaitForSingleObject  (304, 0, 0x0, ...
 03373  1972   NtWaitForSingleObject  (304, 0, 0x0, ...
 03374   840   NtWaitForSingleObject  (304, 0, 0x0, ...
 03375  1656   NtSetEventBoostPriority  (100, ...
 03376  1664   NtWaitForSingleObject  (304, 0, 0x0, ...
 03377  1808   NtWaitForSingleObject  (304, 0, 0x0, ...
 03378  1336   NtWaitForSingleObject  (304, 0, 0x0, ...
 03379   752   NtWaitForSingleObject  (304, 0, 0x0, ...
 03380  1512   NtWaitForSingleObject  (304, 0, 0x0, ...
 03381  1380   NtWaitForSingleObject  (304, 0, 0x0, ...
 03382  1564   NtWaitForSingleObject  (304, 0, 0x0, ...
 03383   164   NtWaitForSingleObject  (304, 0, 0x0, ...
 03384   312   NtWaitForSingleObject  (304, 0, 0x0, ...
 03385  1964   NtWaitForSingleObject  (304, 0, 0x0, ...
 03386  1568   NtWaitForSingleObject  (304, 0, 0x0, ...
 03387  1624   NtWaitForSingleObject  (304, 0, 0x0, ...
 03388   468   NtWaitForSingleObject  (304, 0, 0x0, ...
 03389   876   NtWaitForSingleObject  (304, 0, 0x0, ...
 03390  1716   NtSetEventBoostPriority  (304, ...
 03369   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff0e000,Pid=1252,Tid=2376,}, 0x0, ) == 0x0
 03391  1516   NtWaitForSingleObject  (304, 0, 0x0, ...
 03392  1104   NtWaitForSingleObject  (304, 0, 0x0, ...
 03393   940   NtWaitForSingleObject  (304, 0, 0x0, ...
 03394   780   NtWaitForSingleObject  (304, 0, 0x0, ...
 03395  1268   NtWaitForSingleObject  (304, 0, 0x0, ...
 03396  1736   NtWaitForSingleObject  (304, 0, 0x0, ...
 03397   644   NtWaitForSingleObject  (304, 0, 0x0, ...
 03398   320   NtWaitForSingleObject  (304, 0, 0x0, ...
 03399  1332   NtWaitForSingleObject  (304, 0, 0x0, ...
 03400   380   NtWaitForSingleObject  (304, 0, 0x0, ...
 03370  1036   NtDuplicateObject  ... 1188, ) == 0x0
 03401  1440   NtWaitForSingleObject  (304, 0, 0x0, ...
 02372   760   NtWaitForSingleObject  ... ) == 0x0
 03375  1656   NtSetEventBoostPriority  ... ) == 0x0
 03402   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82028, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82028, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\4\0\0\344\4\0\0H\11\0\0" ...  ...
 03403  1036   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 03404   760   NtWaitForSingleObject  (296, 0, 0x0, ...
 03405  1656   NtTestAlert  (...
 03402   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82029, 0}  ... {28, 56, reply, 0, 1252, 896, 82029, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\4\0\0\344\4\0\0H\11\0\0" )  ) == 0x0
 03403  1036   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 03405  1656   NtTestAlert  ... ) == 0x0
 03371  1248   NtWaitForSingleObject  ... ) == 0x0
 03390  1716   NtSetEventBoostPriority  ... ) == 0x0
 03406  1036   NtSetEventBoostPriority  (296, ...
 03407  1656   NtContinue  (99155248, 1, ...
 03408  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 03409  1716   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03404   760   NtWaitForSingleObject  ... ) == 0x0
 03406  1036   NtSetEventBoostPriority  ... ) == 0x0
 03410  1656   NtRegisterThreadTerminatePort  (24, ...
 03411   760   NtSetEventBoostPriority  (296, ...
 03409  1716   NtWaitForSingleObject  ... ) == 0x102
 03412   896   NtResumeThread  (1180, ...
 03413  1036   NtWaitForSingleObject  (304, 0, 0x0, ...
 03408  1248   NtWaitForSingleObject  ... ) == 0x0
 03411   760   NtSetEventBoostPriority  ... ) == 0x0
 03414  1716   NtWaitForSingleObject  (132, 0, 0x0, ...
 03412   896   NtResumeThread  ... 1, ) == 0x0
 03415  1248   NtSetEventBoostPriority  (304, ...
 03410  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 03416  2376   NtWaitForSingleObject  (100, 0, 0x0, ...
 03372   860   NtWaitForSingleObject  ... ) == 0x0
 03415  1248   NtSetEventBoostPriority  ... ) == 0x0
 03417   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03418  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03419   860   NtSetEventBoostPriority  (304, ...
 03420   760   NtSetEventBoostPriority  (100, ...
 03417   896   NtAllocateVirtualMemory  ... 190382080, 1048576, ) == 0x0
 03373  1972   NtWaitForSingleObject  ... ) == 0x0
 03419   860   NtSetEventBoostPriority  ... ) == 0x0
 03418  1656   NtDuplicateObject  ... 1192, ) == 0x0
 02379   484   NtWaitForSingleObject  ... ) == 0x0
 03420   760   NtSetEventBoostPriority  ... ) == 0x0
 03421  1972   NtSetEventBoostPriority  (304, ...
 03422   896   NtAllocateVirtualMemory  (-1, 191422464, 0, 8192, 4096, 4, ...
 03423   860   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03424   484   NtSetEventBoostPriority  (100, ...
 03425  1656   NtWaitForSingleObject  (304, 0, 0x0, ...
 03376  1664   NtWaitForSingleObject  ... ) == 0x0
 03426   760   NtTestAlert  (...
 03422   896   NtAllocateVirtualMemory  ... 191422464, 8192, ) == 0x0
 03421  1972   NtSetEventBoostPriority  ... ) == 0x0
 03427  1248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02388  1580   NtWaitForSingleObject  ... ) == 0x0
 03424   484   NtSetEventBoostPriority  ... ) == 0x0
 03428  1664   NtSetEventBoostPriority  (304, ...
 03426   760   NtTestAlert  ... ) == 0x0
 03423   860   NtWaitForSingleObject  ... ) == 0x102
 03429  1972   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03430  1580   NtSetEventBoostPriority  (100, ...
 03427  1248   NtWaitForSingleObject  ... ) == 0x102
 03431   896   NtProtectVirtualMemory  (-1, (0xb68e000), 4096, 260, ...
 03374   840   NtWaitForSingleObject  ... ) == 0x0
 03428  1664   NtSetEventBoostPriority  ... ) == 0x0
 03432   760   NtContinue  (100203824, 1, ...
 03433   860   NtWaitForSingleObject  (132, 0, 0x0, ...
 02395  1756   NtWaitForSingleObject  ... ) == 0x0
 03430  1580   NtSetEventBoostPriority  ... ) == 0x0
 03434  1248   NtWaitForSingleObject  (132, 0, 0x0, ...
 03435   840   NtSetEventBoostPriority  (304, ...
 03431   896   NtProtectVirtualMemory  ... (0xb68e000), 4096, 4, ) == 0x0
 03436  1664   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03437   760   NtRegisterThreadTerminatePort  (24, ...
 03438  1756   NtSetEventBoostPriority  (100, ...
 03439   484   NtTestAlert  (...
 03429  1972   NtWaitForSingleObject  ... ) == 0x102
 03378  1336   NtWaitForSingleObject  ... ) == 0x0
 03440   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03435   840   NtSetEventBoostPriority  ... ) == 0x0
 03441  1580   NtTestAlert  (...
 03436  1664   NtWaitForSingleObject  ... ) == 0x102
 02404  1304   NtWaitForSingleObject  ... ) == 0x0
 03438  1756   NtSetEventBoostPriority  ... ) == 0x0
 03439   484   NtTestAlert  ... ) == 0x0
 03442  1972   NtWaitForSingleObject  (132, 0, 0x0, ...
 03443  1336   NtSetEventBoostPriority  (304, ...
 03440   896   NtCreateThread  ... 1196, {1252, 2380}, ) == 0x0
 03444   840   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03441  1580   NtTestAlert  ... ) == 0x0
 03445  1304   NtSetEventBoostPriority  (100, ...
 03446  1664   NtWaitForSingleObject  (132, 0, 0x0, ...
 03437   760   NtRegisterThreadTerminatePort  ... ) == 0x0
 03447   484   NtContinue  (101252400, 1, ...
 03377  1808   NtWaitForSingleObject  ... ) == 0x0
 03443  1336   NtSetEventBoostPriority  ... ) == 0x0
 03448   896   NtQueryInformationThread  (1196, Basic, 28, ...
 02411  2052   NtWaitForSingleObject  ... ) == 0x0
 03445  1304   NtSetEventBoostPriority  ... ) == 0x0
 03449  1580   NtContinue  (102300976, 1, ...
 03450   760   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03451  1808   NtSetEventBoostPriority  (304, ...
 03452   484   NtRegisterThreadTerminatePort  (24, ...
 03453  1336   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03454  2052   NtSetEventBoostPriority  (100, ...
 03448   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff0d000,Pid=1252,Tid=2380,}, 0x0, ) == 0x0
 03455  1756   NtTestAlert  (...
 03444   840   NtWaitForSingleObject  ... ) == 0x102
 03456  1580   NtRegisterThreadTerminatePort  (24, ...
 03379   752   NtWaitForSingleObject  ... ) == 0x0
 03450   760   NtDuplicateObject  ... 1200, ) == 0x0
 03452   484   NtRegisterThreadTerminatePort  ... ) == 0x0
 03451  1808   NtSetEventBoostPriority  ... ) == 0x0
 03457  1304   NtTestAlert  (...
 02420  2056   NtWaitForSingleObject  ... ) == 0x0
 03454  2052   NtSetEventBoostPriority  ... ) == 0x0
 03453  1336   NtWaitForSingleObject  ... ) == 0x102
 03455  1756   NtTestAlert  ... ) == 0x0
 03458   840   NtWaitForSingleObject  (132, 0, 0x0, ...
 03456  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 03459   752   NtSetEventBoostPriority  (304, ...
 03460   760   NtWaitForSingleObject  (304, 0, 0x0, ...
 03461   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03462  1808   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03463  2056   NtSetEventBoostPriority  (100, ...
 03457  1304   NtTestAlert  ... ) == 0x0
 03464   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82029, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82029, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\4\0\0\344\4\0\0L\11\0\0" ...  ...
 03465  1336   NtWaitForSingleObject  (132, 0, 0x0, ...
 03466  1756   NtContinue  (103349552, 1, ...
 03467  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03380  1512   NtWaitForSingleObject  ... ) == 0x0
 03459   752   NtSetEventBoostPriority  ... ) == 0x0
 03468  2052   NtTestAlert  (...
 02427  2060   NtWaitForSingleObject  ... ) == 0x0
 03463  2056   NtSetEventBoostPriority  ... ) == 0x0
 03469  1304   NtContinue  (104398128, 1, ...
 03464   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82030, 0}  ... {28, 56, reply, 0, 1252, 896, 82030, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\4\0\0\344\4\0\0L\11\0\0" )  ) == 0x0
 03470  1756   NtRegisterThreadTerminatePort  (24, ...
 03461   484   NtDuplicateObject  ... 1204, ) == 0x0
 03462  1808   NtWaitForSingleObject  ... ) == 0x102
 03471  1512   NtSetEventBoostPriority  (304, ...
 03472   752   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03473  2060   NtSetEventBoostPriority  (100, ...
 03468  2052   NtTestAlert  ... ) == 0x0
 03467  1580   NtDuplicateObject  ... 1208, ) == 0x0
 03474  1304   NtRegisterThreadTerminatePort  (24, ...
 03475   896   NtResumeThread  (1196, ...
 03470  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 03476   484   NtWaitForSingleObject  (304, 0, 0x0, ...
 03477  1808   NtWaitForSingleObject  (132, 0, 0x0, ...
 03381  1380   NtWaitForSingleObject  ... ) == 0x0
 02436  2064   NtWaitForSingleObject  ... ) == 0x0
 03473  2060   NtSetEventBoostPriority  ... ) == 0x0
 03478  2052   NtContinue  (105446704, 1, ...
 03479  1580   NtWaitForSingleObject  (304, 0, 0x0, ...
 03474  1304   NtRegisterThreadTerminatePort  ... ) == 0x0
 03475   896   NtResumeThread  ... 1, ) == 0x0
 03480  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03481  2064   NtSetEventBoostPriority  (100, ...
 03482  1380   NtSetEventBoostPriority  (304, ...
 03471  1512   NtSetEventBoostPriority  ... ) == 0x0
 03483  2056   NtTestAlert  (...
 03472   752   NtWaitForSingleObject  ... ) == 0x102
 03484  2380   NtWaitForSingleObject  (100, 0, 0x0, ...
 03485  2052   NtRegisterThreadTerminatePort  (24, ...
 03486  1304   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03487   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03488  2060   NtTestAlert  (...
 02443  2068   NtWaitForSingleObject  ... ) == 0x0
 03481  2064   NtSetEventBoostPriority  ... ) == 0x0
 03382  1564   NtWaitForSingleObject  ... ) == 0x0
 03489  1512   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03483  2056   NtTestAlert  ... ) == 0x0
 03490   752   NtWaitForSingleObject  (132, 0, 0x0, ...
 03485  2052   NtRegisterThreadTerminatePort  ... ) == 0x0
 03482  1380   NtSetEventBoostPriority  ... ) == 0x0
 03480  1756   NtDuplicateObject  ... 1212, ) == 0x0
 03486  1304   NtDuplicateObject  ... 1216, ) == 0x0
 03491  2068   NtSetEventBoostPriority  (100, ...
 03488  2060   NtTestAlert  ... ) == 0x0
 03487   896   NtAllocateVirtualMemory  ... 191430656, 1048576, ) == 0x0
 03492  1564   NtSetEventBoostPriority  (304, ...
 03493  2056   NtContinue  (106495280, 1, ...
 03494  2052   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03495  1380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03496  1756   NtWaitForSingleObject  (304, 0, 0x0, ...
 02452  2072   NtWaitForSingleObject  ... ) == 0x0
 03491  2068   NtSetEventBoostPriority  ... ) == 0x0
 03497  1304   NtWaitForSingleObject  (304, 0, 0x0, ...
 03498  2060   NtContinue  (107543856, 1, ...
 03499   896   NtAllocateVirtualMemory  (-1, 192471040, 0, 8192, 4096, 4, ...
 03383   164   NtWaitForSingleObject  ... ) == 0x0
 03500  2056   NtRegisterThreadTerminatePort  (24, ...
 03492  1564   NtSetEventBoostPriority  ... ) == 0x0
 03501  2064   NtTestAlert  (...
 03489  1512   NtWaitForSingleObject  ... ) == 0x102
 03502  2072   NtSetEventBoostPriority  (100, ...
 03494  2052   NtDuplicateObject  ... 1220, ) == 0x0
 03495  1380   NtWaitForSingleObject  ... ) == 0x102
 03503  2060   NtRegisterThreadTerminatePort  (24, ...
 03499   896   NtAllocateVirtualMemory  ... 192471040, 8192, ) == 0x0
 03504   164   NtSetEventBoostPriority  (304, ...
 03500  2056   NtRegisterThreadTerminatePort  ... ) == 0x0
 03505  1564   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03501  2064   NtTestAlert  ... ) == 0x0
 02459  2076   NtWaitForSingleObject  ... ) == 0x0
 03502  2072   NtSetEventBoostPriority  ... ) == 0x0
 03506  1512   NtWaitForSingleObject  (132, 0, 0x0, ...
 03507  2052   NtWaitForSingleObject  (304, 0, 0x0, ...
 03508  1380   NtWaitForSingleObject  (132, 0, 0x0, ...
 03503  2060   NtRegisterThreadTerminatePort  ... ) == 0x0
 03509   896   NtProtectVirtualMemory  (-1, (0xb78e000), 4096, 260, ...
 03384   312   NtWaitForSingleObject  ... ) == 0x0
 03510  2056   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03511  2076   NtSetEventBoostPriority  (100, ...
 03512  2064   NtContinue  (108592432, 1, ...
 03504   164   NtSetEventBoostPriority  ... ) == 0x0
 03513  2068   NtTestAlert  (...
 03505  1564   NtWaitForSingleObject  ... ) == 0x102
 03514  2060   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03509   896   NtProtectVirtualMemory  ... (0xb78e000), 4096, 4, ) == 0x0
 03515   312   NtSetEventBoostPriority  (304, ...
 03516  2072   NtTestAlert  (...
 02468  2080   NtWaitForSingleObject  ... ) == 0x0
 03511  2076   NtSetEventBoostPriority  ... ) == 0x0
 03517  2064   NtRegisterThreadTerminatePort  (24, ...
 03518   164   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03513  2068   NtTestAlert  ... ) == 0x0
 03519  1564   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 03510  2056   NtDuplicateObject  ... 1224, ) == 0x0
 03520   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03385  1964   NtWaitForSingleObject  ... ) == 0x0
 03521  2080   NtWaitForSingleObject  (296, 0, 0x0, ...
 03516  2072   NtTestAlert  ... ) == 0x0
 03515   312   NtSetEventBoostPriority  ... ) == 0x0
 03514  2060   NtDuplicateObject  ... 1228, ) == 0x0
 03517  2064   NtRegisterThreadTerminatePort  ... ) == 0x0
 03522  2068   NtContinue  (109641008, 1, ...
 03519  1564   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 03523  2056   NtWaitForSingleObject  (296, 0, 0x0, ...
 03524  2076   NtTestAlert  (...
 03518   164   NtWaitForSingleObject  ... ) == 0x102
 03525  1964   NtWaitForSingleObject  (296, 0, 0x0, ...
 03526  2072   NtContinue  (110689584, 1, ...
 03527   312   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03528  2060   NtWaitForSingleObject  (296, 0, 0x0, ...
 03529  2064   NtWaitForSingleObject  (296, 0, 0x0, ...
 03530  2068   NtRegisterThreadTerminatePort  (24, ...
 03531  1564   NtSetEventBoostPriority  (296, ...
 03524  2076   NtTestAlert  ... ) == 0x0
 03532   164   NtWaitForSingleObject  (296, 0, 0x0, ...
 03533  2072   NtRegisterThreadTerminatePort  (24, ...
 03520   896   NtCreateThread  ... 1232, {1252, 2384}, ) == 0x0
 03527   312   NtWaitForSingleObject  ... ) == 0x102
 03530  2068   NtRegisterThreadTerminatePort  ... ) == 0x0
 03521  2080   NtWaitForSingleObject  ... ) == 0x0
 03531  1564   NtSetEventBoostPriority  ... ) == 0x0
 03534  2076   NtContinue  (111738160, 1, ...
 03533  2072   NtRegisterThreadTerminatePort  ... ) == 0x0
 03535   896   NtQueryInformationThread  (1232, Basic, 28, ...
 03536   312   NtWaitForSingleObject  (296, 0, 0x0, ...
 03537  2080   NtSetEventBoostPriority  (296, ...
 03538  2068   NtWaitForSingleObject  (296, 0, 0x0, ...
 03539  1564   NtWaitForSingleObject  (132, 0, 0x0, ...
 03540  2076   NtRegisterThreadTerminatePort  (24, ...
 03541  2072   NtWaitForSingleObject  (296, 0, 0x0, ...
 03535   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff0c000,Pid=1252,Tid=2384,}, 0x0, ) == 0x0
 03523  2056   NtWaitForSingleObject  ... ) == 0x0
 03537  2080   NtSetEventBoostPriority  ... ) == 0x0
 03540  2076   NtRegisterThreadTerminatePort  ... ) == 0x0