Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtNotifyChangeKey(>) 
 2 
NtSetInformationThread(>) 
 8 
NtContinue(>) 
 99 

NtCallbackReturn(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 
NtOpenKey(>) 
 100 

NtDelayExecution(>) 
 1 
NtOpenProcessTokenEx(>) 
 2 
NtFsControlFile(>) 
 11 
NtWriteVirtualMemory(>) 
 116 

NtGdiCreateBitmap(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtQuerySection(>) 
 11 
NtQuerySystemInformation(>) 
 120 

NtGdiInit(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtSetInformationFile(>) 
 13 
NtResumeThread(>) 
 135 

NtGdiQueryFontAssocInfo(>) 
 1 
NtSecureConnectPort(>) 
 2 
NtQueryDirectoryFile(>) 
 14 
NtCreateThread(>) 
 140 

NtGdiSelectBitmap(>) 
 1 
NtSetInformationObject(>) 
 2 
NtUserRegisterClassExWOW(>) 
 14 
NtQueryInformationThread(>) 
 148 

NtOpenKeyedEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtCreateFile(>) 
 16 
NtRequestWaitReplyPort(>) 
 173 

NtOpenSymbolicLinkObject(>) 
 1 
NtOpenProcessToken(>) 
 3 
NtSetValueKey(>) 
 16 
NtTestAlert(>) 
 188 

NtQueryObject(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtCreateKey(>) 
 19 
NtRegisterThreadTerminatePort(>) 
 189 

NtQueryPerformanceCounter(>) 
 1 
NtReadFile(>) 
 4 
NtOpenFile(>) 
 23 
NtDuplicateObject(>) 
 193 

NtQuerySymbolicLinkObject(>) 
 1 
NtWriteFile(>) 
 4 
NtOpenProcess(>) 
 29 
NtQueryValueKey(>) 
 224 

NtQuerySystemTime(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtDeviceIoControlFile(>) 
 35 
NtProtectVirtualMemory(>) 
 343 

NtRaiseException(>) 
 1 
NtQueryInformationToken(>) 
 5 
NtFlushInstructionCache(>) 
 43 
NtClose(>) 
 358 

NtSetInformationProcess(>) 
 1 
NtQueryVolumeInformationFile(>) 
 5 
NtUnmapViewOfSection(>) 
 44 
NtAllocateVirtualMemory(>) 
 369 

NtUserCallNoParam(>) 
 1 
NtConnectPort(>) 
 6 
NtOpenSection(>) 
 50 
NtSetEventBoostPriority(>) 
 546 

NtUserGetThreadDesktop(>) 
 1 
NtQueryInformationProcess(>) 
 6 
NtQueryAttributesFile(>) 
 50 
NtWaitForSingleObject(>) 
 813 

NtCreateIoCompletion(>) 
 2 
NtQueryVirtualMemory(>) 
 7 
NtCreateEvent(>) 
 66 

NtCreateMutant(>) 
 2 
NtOpenThreadToken(>) 
 8 
NtCreateSection(>) 
 72 

NtGdiCreateSolidBrush(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 94224, 4, ... (0x409000), 98304, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 98304, 128, ... (0x409000), 98304, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 94224, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40283e,}, 4, ... ) == 0x0
 00260   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00261   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262   896   NtClose  (16, ... ) == 0x0
 00263   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00264   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00266   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00267   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00268   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00269   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00270   896   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00271   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00273   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00274   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00275   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00276   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00277   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00278   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00280   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00281   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00283   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00284   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 16, ) }, ... 16, ) == 0x0
 00285   896   NtCreateEvent  (0x1f0003, {24, 16, 0x80, 1245092, 0,  (0x1f0003, {24, 16, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 28, ) }, 1, 0, ... 28, ) == 0x0
 00286   896   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 32, ) }, {27086, 0}, 64, 134217728, 0, ... 32, ) == 0x0
 00287   896   NtMapViewOfSection  (32, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0x320000), 0x0, 28672, ) == 0x0
 00288   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.DLL"}, ... 36, ) }, ... 36, ) == 0x0
 00289   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00290   896   NtClose  (36, ... ) == 0x0
 00291   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00292   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00293   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00294   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00295   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00296   896   NtClose  (36, ... ) == 0x0
 00297   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00298   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00299   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00300   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00301   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00302   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00303   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00304   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00305   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00306   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00307   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00308   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00309   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00310   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00311   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00312   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 36, ) }, ... 36, ) == 0x0
 00313   896   NtQueryValueKey  (36,  (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00314   896   NtQueryValueKey  (36,  (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00315   896   NtClose  (36, ... ) == 0x0
 00316   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 36, ) }, ... 36, ) == 0x0
 00317   896   NtQueryValueKey  (36,  (36, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00318   896   NtClose  (36, ... ) == 0x0
 00319   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 36, ) }, ... 36, ) == 0x0
 00320   896   NtSetInformationObject  (36, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00321   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00322   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00323   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00324   896   NtOpenProcessToken  (-1, 0x20, ... 40, ) == 0x0
 00325   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00326   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00327   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 44, ) }, ... 44, ) == 0x0
 00328   896   NtQueryValueKey  (44,  (44, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329   896   NtClose  (44, ... ) == 0x0
 00330   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 44, ) == 0x0
 00332   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 48, ) == 0x0
 00333   896   NtQuerySystemTime  (... {1415547914, 29929616}, ) == 0x0
 00334   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00335   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00336   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00337   896   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00338   896   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00339   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00340   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 60, ) == 0x0
 00341   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00342   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 64, ) }, ... 64, ) == 0x0
 00343   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "ActiveComputerName"}, ... 68, ) }, ... 68, ) == 0x0
 00344   896   NtQueryValueKey  (68,  (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 00345   896   NtClose  (68, ... ) == 0x0
 00346   896   NtClose  (64, ... ) == 0x0
 00347   896   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 64, ) == 0x0
 00348   896   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 68, ) == 0x0
 00349   896   NtDuplicateObject  (-1, 64, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00350   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00351   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00352   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00353   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00354   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243252,  (0xc0100080, {24, 0, 0x40, 0, 1243252, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) == 0x0
 00355   896   NtSetInformationFile  (80, 1243308, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00356   896   NtSetInformationFile  (80, 1243296, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00357   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00358   896   NtWriteFile  (80, 57, 0, 0,  (80, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00359   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00360   896   NtReadFile  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00361   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00362   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) == 0x103
 00363   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00364   896   NtClose  (76, ... ) == 0x0
 00365   896   NtClose  (80, ... ) == 0x0
 00366   896   NtAdjustPrivilegesToken  (40, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00367   896   NtClose  (40, ... ) == 0x0
 00368   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 3342336, 65536, ) == 0x0
 00369   896   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00370   896   NtCreateSection  (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 40, ) == 0x0
 00371   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00372   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00373   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00374   896   NtFreeVirtualMemory  (-1, (0x330000), 0, 32768, ... (0x330000), 65536, ) == 0x0
 00375   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00376   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00377   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00378   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00379   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00380   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00381   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00382   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00383   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00384   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00385   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00386   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 80, ) == 0x0
 00387   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 76, ) }, ... 76, ) == 0x0
 00388   896   NtMapViewOfSection  (76, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00389   896   NtClose  (76, ... ) == 0x0
 00390   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00391   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00392   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00393   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00394   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00395   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00396   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00397   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00398   896   NtAllocateVirtualMemory  (80, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 00399   896   NtAllocateVirtualMemory  (80, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 00400   896   NtProtectVirtualMemory  (80, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 00401   896   NtCreateThread  (0x1f03ff, 0x0, 80, 1243840, 1243784, 1, ... 76, {580, 2016}, ) == 0x0
 00402   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" )  ) == 0x0
 00403   896   NtResumeThread  (76, ... 1, ) == 0x0
 00404   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00405   896   NtClose  (80, ... ) == 0x0
 00406   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00407   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00408   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 80, ) == 0x0
 00409   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00410   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00411   896   NtClose  (84, ... ) == 0x0
 00412   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00413   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00414   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00415   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00416   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00417   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00418   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00419   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00420   896   NtClose  (80, ... ) == 0x0
 00421   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00422   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00423   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 80, ) == 0x0
 00424   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00425   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00426   896   NtClose  (84, ... ) == 0x0
 00427   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00428   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00429   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00430   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00431   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00432   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00433   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00434   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00435   896   NtClose  (80, ... ) == 0x0
 00436   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00437   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00438   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 80, ) == 0x0
 00439   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00440   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00441   896   NtClose  (84, ... ) == 0x0
 00442   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00443   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00444   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00445   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00446   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00447   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00448   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00449   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00450   896   NtClose  (80, ... ) == 0x0
 00451   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00452   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00453   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 80, ) == 0x0
 00454   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00455   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00456   896   NtClose  (84, ... ) == 0x0
 00457   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00458   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00459   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00460   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00461   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00462   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00463   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00464   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00465   896   NtClose  (80, ... ) == 0x0
 00466   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00467   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00468   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 80, ) == 0x0
 00469   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00470   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff50000), 0x0, 28672, ) == 0x0
 00471   896   NtClose  (84, ... ) == 0x0
 00472   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00473   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Md\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00474   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00475   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00476   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00477   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00478   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00479   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00480   896   NtClose  (80, ... ) == 0x0
 00481   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00482   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00483   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 80, ) == 0x0
 00484   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00485   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00486   896   NtClose  (84, ... ) == 0x0
 00487   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00488   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00489   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00490   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00491   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00492   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00493   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00494   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00495   896   NtClose  (80, ... ) == 0x0
 00496   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00497   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00498   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 80, ) == 0x0
 00499   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00500   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00501   896   NtClose  (84, ... ) == 0x0
 00502   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00503   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00504   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00505   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00506   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00507   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00508   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00509   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00510   896   NtClose  (80, ... ) == 0x0
 00511   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00512   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00513   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 80, ) == 0x0
 00514   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00515   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00516   896   NtClose  (84, ... ) == 0x0
 00517   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00518   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00519   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00520   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00521   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00522   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00523   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00524   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00525   896   NtClose  (80, ... ) == 0x0
 00526   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00527   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00528   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 80, ) == 0x0
 00529   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00530   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00531   896   NtClose  (84, ... ) == 0x0
 00532   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00533   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00534   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00535   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00536   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00537   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00538   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00539   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00540   896   NtClose  (80, ... ) == 0x0
 00541   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00542   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00543   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 80, ) == 0x0
 00544   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00545   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00546   896   NtClose  (84, ... ) == 0x0
 00547   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00548   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00549   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00550   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00551   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00552   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00553   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00554   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00555   896   NtClose  (80, ... ) == 0x0
 00556   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00557   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00558   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 80, ) == 0x0
 00559   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00560   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00561   896   NtClose  (84, ... ) == 0x0
 00562   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00563   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00564   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00565   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00566   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00567   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00568   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00569   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00570   896   NtClose  (80, ... ) == 0x0
 00571   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00572   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00573   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 80, ) == 0x0
 00574   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00575   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00576   896   NtClose  (84, ... ) == 0x0
 00577   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00578   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00579   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00580   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00581   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00582   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00583   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00584   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00585   896   NtClose  (80, ... ) == 0x0
 00586   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00587   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00588   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 80, ) == 0x0
 00589   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00590   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00591   896   NtClose  (84, ... ) == 0x0
 00592   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00593   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00594   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00595   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00596   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00597   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00598   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00599   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00600   896   NtClose  (80, ... ) == 0x0
 00601   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00602   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00603   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 80, ) == 0x0
 00604   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00605   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00606   896   NtClose  (84, ... ) == 0x0
 00607   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00608   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00609   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00610   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00611   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00612   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00613   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00614   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00615   896   NtClose  (80, ... ) == 0x0
 00616   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00617   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00618   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 80, ) == 0x0
 00619   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00620   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00621   896   NtClose  (84, ... ) == 0x0
 00622   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00623   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00624   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00625   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00626   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00627   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00628   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00629   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00630   896   NtClose  (80, ... ) == 0x0
 00631   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00632   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00633   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 80, ) == 0x0
 00634   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00635   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00636   896   NtClose  (84, ... ) == 0x0
 00637   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00638   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00639   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00640   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00641   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00642   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00643   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00644   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00645   896   NtClose  (80, ... ) == 0x0
 00646   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00647   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00648   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 80, ) == 0x0
 00649   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00650   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00651   896   NtClose  (84, ... ) == 0x0
 00652   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00653   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00654   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00655   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00656   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00657   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00658   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00659   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00660   896   NtClose  (80, ... ) == 0x0
 00661   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00662   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00663   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 80, ) == 0x0
 00664   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00665   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00666   896   NtClose  (84, ... ) == 0x0
 00667   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00668   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00669   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00670   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00671   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00672   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00673   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00674   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00675   896   NtClose  (80, ... ) == 0x0
 00676   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00677   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00678   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 80, ) == 0x0
 00679   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00680   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00681   896   NtClose  (84, ... ) == 0x0
 00682   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00683   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00684   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00685   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00686   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00687   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00688   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00689   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00690   896   NtClose  (80, ... ) == 0x0
 00691   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00692   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00693   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 80, ) == 0x0
 00694   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00695   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00696   896   NtClose  (84, ... ) == 0x0
 00697   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00698   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00699   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00700   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00701   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00702   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00703   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00704   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00705   896   NtClose  (80, ... ) == 0x0
 00706   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00707   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00708   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {784, 0}, ... 80, ) == 0x0
 00709   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00710   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00711   896   NtClose  (84, ... ) == 0x0
 00712   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00713   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00714   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00715   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00716   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00717   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00718   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00719   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00720   896   NtClose  (80, ... ) == 0x0
 00721   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00722   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00723   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {488, 0}, ... 80, ) == 0x0
 00724   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00725   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00726   896   NtClose  (84, ... ) == 0x0
 00727   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00728   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00729   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00730   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00731   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00732   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00733   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00734   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00735   896   NtClose  (80, ... ) == 0x0
 00736   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00737   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00738   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1208, 0}, ... 80, ) == 0x0
 00739   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00740   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00741   896   NtClose  (84, ... ) == 0x0
 00742   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00743   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00744   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00745   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00746   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00747   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00748   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00749   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00750   896   NtClose  (80, ... ) == 0x0
 00751   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00752   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00753   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {168, 0}, ... 80, ) == 0x0
 00754   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00755   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00756   896   NtClose  (84, ... ) == 0x0
 00757   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00758   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00759   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00760   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00761   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00762   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00763   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00764   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00765   896   NtClose  (80, ... ) == 0x0
 00766   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00767   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00768   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {764, 0}, ... 80, ) == 0x0
 00769   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00770   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00771   896   NtClose  (84, ... ) == 0x0
 00772   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00773   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00774   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00775   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00776   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00777   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00778   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00779   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00780   896   NtClose  (80, ... ) == 0x0
 00781   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00782   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00783   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {868, 0}, ... 80, ) == 0x0
 00784   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00785   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00786   896   NtClose  (84, ... ) == 0x0
 00787   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00788   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00789   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00790   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00791   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00792   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00793   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00794   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00795   896   NtClose  (80, ... ) == 0x0
 00796   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00797   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00798   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {808, 0}, ... 80, ) == 0x0
 00799   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00800   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00801   896   NtClose  (84, ... ) == 0x0
 00802   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00803   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00804   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00805   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00806   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00807   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00808   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00809   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00810   896   NtClose  (80, ... ) == 0x0
 00811   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00812   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00813   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 80, ) == 0x0
 00814   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00815   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00816   896   NtClose  (84, ... ) == 0x0
 00817   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00818   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00819   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00820   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00821   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00822   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00823   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00824   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00825   896   NtClose  (80, ... ) == 0x0
 00826   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00827   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00828   896   NtClose  (40, ... ) == 0x0
 00829   896   NtClose  (28, ... ) == 0x0
 00830   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00831   896   NtContinue  (1244400, 0, ...
 00832   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3342336, 4096, ) == 0x0
 00833   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00834   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00835   896   NtClose  (28, ... ) == 0x0
 00836   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00837   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00838   896   NtClose  (28, ... ) == 0x0
 00839   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00840   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00841   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00842   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00843   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00844   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00845   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00846   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00847   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00848   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00849   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00850   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00851   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00852   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00853   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00854   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00855   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00856   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00857   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00858   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00859   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00860   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00861   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00862   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00863   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 40, ) == 0x0
 00864   896   NtClose  (28, ... ) == 0x0
 00865   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00866   896   NtClose  (40, ... ) == 0x0
 00867   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00868   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00869   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00870   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 40, ... 28, ) == 0x0
 00871   896   NtClose  (40, ... ) == 0x0
 00872   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00873   896   NtClose  (28, ... ) == 0x0
 00874   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00875   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00876   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00877   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 40, ) == 0x0
 00878   896   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00879   896   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00880   896   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00881   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00882   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00883   896   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00884   896   NtClose  (84, ... ) == 0x0
 00885   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00886   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00887   896   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00888   896   NtClose  (84, ... ) == 0x0
 00889   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00890   896   NtClose  (80, ... ) == 0x0
 00891   896   NtClose  (28, ... ) == 0x0
 00892   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00893   896   NtClose  (40, ... ) == 0x0
 00894   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00895   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00896   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00897   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00898   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00899   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00900   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00901   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00902   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00903   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00904   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00905   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00906   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00907   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00908   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00909   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 40, ) }, ... 40, ) == 0x0
 00910   896   NtQueryValueKey  (40,  (40, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00911   896   NtClose  (40, ... ) == 0x0
 00912   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x500000), 0x0, 1060864, ) == 0x0
 00913   896   NtClose  (-2147482756, ... ) == 0x0
 00914   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 40, ) == 0x0
 00915   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00916   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00917   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00918   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00919   896   NtClose  (-2147482756, ... ) == 0x0
 00920   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00921   896   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00922   896   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00923   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00924   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00925   896   NtClose  (-2147482756, ... ) == 0x0
 00926   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00927   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00928   896   NtClose  (-2147482756, ... ) == 0x0
 00929   896   NtQueryDefaultLocale  (0, -142628532, ... ) == 0x0
 00930   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00931   896   NtUserCallNoParam  (24, ... ) == 0x0
 00932   896   NtGdiCreateCompatibleDC  (0, ...
 00933   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00932   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00934   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00935   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00936   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00937   896   NtGdiCreateSolidBrush  (0, 0, ...
 00938   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00937   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00939   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00940   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00941   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00942   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x50
 00943   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 88, ) }, ... 88, ) == 0x0
 00944   896   NtQueryValueKey  (88,  (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00945   896   NtClose  (88, ... ) == 0x0
 00946   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00947   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00948   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00949   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00950   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00951   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00952   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00953   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00954   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00955   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00956   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00957   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00958   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00959   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00960   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00961   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00962   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00963   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00964   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00965   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00966   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00967   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00968   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00969   896   NtCallbackReturn  (0, 0, 0, ...
 00970   896   NtGdiInit  (... ) == 0x1
 00971   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00972   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00973   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 3538944, 28672, ) == 0x0
 00974   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00975   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00976   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00977   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00978   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 88, ... 92, ) == 0x0
 00979   896   NtQuerySection  (92, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00980   896   NtClose  (88, ... ) == 0x0
 00981   896   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00982   896   NtClose  (92, ... ) == 0x0
 00983   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00984   896   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00985   896   NtClose  (92, ... ) == 0x0
 00986   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00987   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00988   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00989   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00990   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00991   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00992   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00993   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00994   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00995   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00996   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00997   896   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00998   896   NtClose  (92, ... ) == 0x0
 00999   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 01000   896   NtClose  (88, ... ) == 0x0
 01001   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 01002   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 01003   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 01004   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 01005   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 01006   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 01007   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01008   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01009   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 01010   896   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 01011   896   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 01012   896   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 01013   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 88, ) }, ... 88, ) == 0x0
 01014   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x380000), 0x0, 12288, ) == 0x0
 01015   896   NtClose  (88, ... ) == 0x0
 01016   896   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 01017   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01018   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01019   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01020   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 01021   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01022   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01023   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01024   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01025   896   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 28672, ) == 0x0
 01026   896   NtFreeVirtualMemory  (-1, (0x330144), 0, 32768, ... (0x330000), 4096, ) == 0x0
 01027   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01028   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3342336, 65536, ) == 0x0
 01029   896   NtAllocateVirtualMemory  (-1, 3342336, 0, 4096, 4096, 4, ... 3342336, 4096, ) == 0x0
 01030   896   NtAllocateVirtualMemory  (-1, 3346432, 0, 20480, 4096, 4, ... 3346432, 20480, ) == 0x0
 01031   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9502720, 1048576, ) == 0x0
 01032   896   NtAllocateVirtualMemory  (-1, 9502720, 0, 32768, 4096, 4, ... 9502720, 32768, ) == 0x0
 01033   896   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "Jobaka3"}, 0, ... 88, ) }, 0, ... 88, ) == 0x0
 01034   896   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01035   896   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01036   896   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01037   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 96, ) == 0x0
 01038   896   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "Protocol_Catalog9"}, ... 100, ) }, ... 100, ) == 0x0
 01039   896   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01040   896   NtNotifyChangeKey  (100, 96, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01041   896   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01042   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01043   896   NtQueryValueKey  (100,  (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01044   896   NtQueryValueKey  (100,  (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01045   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Catalog_Entries"}, ... 104, ) }, ... 104, ) == 0x0
 01046   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 01047   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000001"}, ... 108, ) }, ... 108, ) == 0x0
 01048   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01049   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01050   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\33\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\34\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\33\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\34\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\33\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\34\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01051   896   NtClose  (108, ... ) == 0x0
 01052   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000002"}, ... 108, ) }, ... 108, ) == 0x0
 01053   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01054   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01055   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0 \4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01056   896   NtClose  (108, ... ) == 0x0
 01057   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000003"}, ... 108, ) }, ... 108, ) == 0x0
 01058   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01059   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01060   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 01061   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0&\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0'\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0&\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0'\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0&\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0'\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0(\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01062   896   NtClose  (108, ... ) == 0x0
 01063   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000004"}, ... 108, ) }, ... 108, ) == 0x0
 01064   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01065   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01066   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0+\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0,\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0+\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0,\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0+\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0,\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0-\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01067   896   NtClose  (108, ... ) == 0x0
 01068   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000005"}, ... 108, ) }, ... 108, ) == 0x0
 01069   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01070   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01071   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\00\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\01\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\00\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\01\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\00\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\01\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01072   896   NtClose  (108, ... ) == 0x0
 01073   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000006"}, ... 108, ) }, ... 108, ) == 0x0
 01074   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01075   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01076   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\05\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\05\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\06\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\05\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\05\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\06\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\05\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\05\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\06\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01077   896   NtClose  (108, ... ) == 0x0
 01078   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000007"}, ... 108, ) }, ... 108, ) == 0x0
 01079   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01080   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01081   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0:\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0:\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0;\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0:\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0:\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0;\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0:\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0:\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0;\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01082   896   NtClose  (108, ... ) == 0x0
 01083   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000008"}, ... 108, ) }, ... 108, ) == 0x0
 01084   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01085   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01086   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 01087   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0@\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0A\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0@\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0A\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0@\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0A\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01088   896   NtClose  (108, ... ) == 0x0
 01089   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000009"}, ... 108, ) }, ... 108, ) == 0x0
 01090   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01091   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01092   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0E\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0F\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0E\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0F\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0E\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0F\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0G\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01093   896   NtClose  (108, ... ) == 0x0
 01094   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000010"}, ... 108, ) }, ... 108, ) == 0x0
 01095   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01096   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01097   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0J\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0K\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0J\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0K\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0J\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0K\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01098   896   NtClose  (108, ... ) == 0x0
 01099   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000011"}, ... 108, ) }, ... 108, ) == 0x0
 01100   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01101   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01102   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0O\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0O\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0P\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0O\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0O\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0P\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0O\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0O\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0P\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01103   896   NtClose  (108, ... ) == 0x0
 01104   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000012"}, ... 108, ) }, ... 108, ) == 0x0
 01105   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01106   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01107   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01108   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0U\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0V\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0U\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0V\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0U\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0V\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01109   896   NtClose  (108, ... ) == 0x0
 01110   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000013"}, ... 108, ) }, ... 108, ) == 0x0
 01111   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01112   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01113   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0Z\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0[\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0Z\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0[\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0Z\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0[\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01114   896   NtClose  (108, ... ) == 0x0
 01115   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000014"}, ... 108, ) }, ... 108, ) == 0x0
 01116   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01117   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01118   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0_\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0`\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0_\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0`\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0_\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0`\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01119   896   NtClose  (108, ... ) == 0x0
 01120   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000015"}, ... 108, ) }, ... 108, ) == 0x0
 01121   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01122   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01123   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0d\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0e\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0d\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0e\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0d\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0e\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01124   896   NtClose  (108, ... ) == 0x0
 01125   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000016"}, ... 108, ) }, ... 108, ) == 0x0
 01126   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01127   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01128   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0i\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0i\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0j\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0i\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0i\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0j\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0i\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0i\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0j\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01129   896   NtClose  (108, ... ) == 0x0
 01130   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000017"}, ... 108, ) }, ... 108, ) == 0x0
 01131   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01132   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01133   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01134   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0o\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0p\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0o\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0p\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0o\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0p\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01135   896   NtClose  (108, ... ) == 0x0
 01136   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000018"}, ... 108, ) }, ... 108, ) == 0x0
 01137   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01138   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01139   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0t\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0u\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0t\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0u\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0t\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0u\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01140   896   NtClose  (108, ... ) == 0x0
 01141   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000019"}, ... 108, ) }, ... 108, ) == 0x0
 01142   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01143   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01144   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0z\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0z\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0z\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0|\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01145   896   NtClose  (108, ... ) == 0x0
 01146   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000020"}, ... 108, ) }, ... 108, ) == 0x0
 01147   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01148   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01149   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\177\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\177\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\177\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01150   896   NtClose  (108, ... ) == 0x0
 01151   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000021"}, ... 108, ) }, ... 108, ) == 0x0
 01152   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01153   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01154   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01155   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\204\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\204\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\205\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\204\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\204\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\205\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\204\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\204\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\205\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01156   896   NtClose  (108, ... ) == 0x0
 01157   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000022"}, ... 108, ) }, ... 108, ) == 0x0
 01158   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01159   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01160   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\211\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\211\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0\212\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\213\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\214\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\214\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\215\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\211\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\211\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0\212\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\213\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\214\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\214\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\215\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\211\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\211\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0\212\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\213\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\214\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\214\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\215\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01161   896   NtClose  (108, ... ) == 0x0
 01162   896   NtClose  (104, ... ) == 0x0
 01163   896   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01164   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 01165   896   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 108, ) }, ... 108, ) == 0x0
 01166   896   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01167   896   NtNotifyChangeKey  (108, 104, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01168   896   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01169   896   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01170   896   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01171   896   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 01172   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 01173   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01174   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01175   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01176   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01177   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01178   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01179   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01180   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01181   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01182   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01183   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01184   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01185   896   NtClose  (116, ... ) == 0x0
 01186   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 01187   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01188   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01189   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01190   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01191   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01192   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01193   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01194   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01195   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01196   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01197   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01198   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01199   896   NtClose  (116, ... ) == 0x0
 01200   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 01201   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01202   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01203   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01204   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01205   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01206   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01207   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01208   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01209   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01210   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01211   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01212   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01213   896   NtClose  (116, ... ) == 0x0
 01214   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 01215   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01216   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01217   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01218   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01219   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01220   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01221   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01222   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01224   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01225   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01226   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01227   896   NtClose  (116, ... ) == 0x0
 01228   896   NtClose  (112, ... ) == 0x0
 01229   896   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01230   896   NtClose  (92, ... ) == 0x0
 01231   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01232   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01233   896   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01234   896   NtQueryValueKey  (92,  (92, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   896   NtClose  (92, ... ) == 0x0
 01236   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01237   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 92, ) == 0x0
 01238   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1241400, ... ) }, 1241400, ... ) == 0x0
 01239   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 112, {status=0x0, info=1}, ) }, 7, 2113568, ... 112, {status=0x0, info=1}, ) == 0x0
 01240   896   NtSetInformationFile  (112, 1241376, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 01241   896   NtClose  (112, ... ) == 0x0
 01242   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) == 0x0
 01243   896   NtQueryInformationFile  (112, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01244   896   NtQueryInformationFile  (112, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01245   896   NtQueryInformationFile  (112, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01246   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01247   896   NtQueryInformationFile  (112, 1365056, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01248   896   NtQueryInformationFile  (112, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01249   896   NtQueryInformationFile  (112, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01250   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 1239736, ... ) }, 1239736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01251   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01252   896   NtClose  (-2147482756, ... ) == 0x0
 01251   896   NtCreateFile  ... 116, {status=0x0, info=2}, ) == 0x0
 01253   896   NtQueryVolumeInformationFile  (116, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01254   896   NtQueryInformationFile  (116, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01255   896   NtQueryVolumeInformationFile  (112, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01256   896   NtSetInformationFile  (116, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01257   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 112, ... 120, ) == 0x0
 01258   896   NtMapViewOfSection  (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 28672, ) == 0x0
 01259   896   NtClose  (120, ... ) == 0x0
 01260   896   NtWriteFile  (116, 0, 0, 0,  (116, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\211\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0\204\214\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 25600, 0x0, 0, ... {status=0x0, info=25600}, ) \0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 25600, 0x0, 0, ... {status=0x0, info=25600}, ) == 0x0
 01261   896   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 01262   896   NtSetInformationFile  (116, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01263   896   NtClose  (112, ... ) == 0x0
 01264   896   NtClose  (116, ... ) == 0x0
 01265   896   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 116, ) }, ... 116, ) == 0x0
 01266   896   NtSetValueKey  (116,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 01267   896   NtSetInformationFile  (-2147482448, -142629072, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01268   896   NtSetInformationFile  (-2147482448, -142629164, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01269   896   NtSetInformationFile  (-2147482448, -142629472, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01270   896   NtSetInformationFile  (-2147482448, -142629568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01266   896   NtSetValueKey  ... ) == 0x0
 01271   896   NtClose  (116, ... ) == 0x0
 01272   896   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 116, ) }, 0, ... 116, ) == 0x0
 01273   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10551296, 1048576, ) == 0x0
 01274   896   NtAllocateVirtualMemory  (-1, 11591680, 0, 8192, 4096, 4, ... 11591680, 8192, ) == 0x0
 01275   896   NtProtectVirtualMemory  (-1, (0xb0e000), 4096, 260, ... (0xb0e000), 4096, 4, ) == 0x0
 01276   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 112, {1252, 1564}, ) == 0x0
 01277   896   NtQueryInformationThread  (112, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 01278   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 01279   896   NtResumeThread  (112, ... 1, ) == 0x0
 01280   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11599872, 1048576, ) == 0x0
 01281   896   NtAllocateVirtualMemory  (-1, 12640256, 0, 8192, 4096, 4, ...
 01282  1564   NtTestAlert  (... ) == 0x0
 01283  1564   NtContinue  (11599152, 1, ...
 01284  1564   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01285  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 120, ) == 0x0
 01286  1564   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01287  1564   NtAllocateVirtualMemory  (-1, 11587584, 0, 4096, 4096, 260, ...
 01281   896   NtAllocateVirtualMemory  ... 12640256, 8192, ) == 0x0
 01288   896   NtProtectVirtualMemory  (-1, (0xc0e000), 4096, 260, ... (0xc0e000), 4096, 4, ) == 0x0
 01289   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 124, {1252, 164}, ) == 0x0
 01290   896   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 01291   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 01292   896   NtResumeThread  (124, ... 1, ) == 0x0
 01287  1564   NtAllocateVirtualMemory  ... 11587584, 4096, ) == 0x0
 01293   164   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01294  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596276, ... }, 11596276, ...
 01293   164   NtCreateEvent  ... 128, ) == 0x0
 01294  1564   NtQueryAttributesFile  ... ) == 0x0
 01295   164   NtWaitForSingleObject  (128, 0, 0x0, ...
 01296  1564   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01297  1564   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 132, ... 136, ) == 0x0
 01298  1564   NtClose  (132, ... ) == 0x0
 01299  1564   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 245760, ) == 0x0
 01300  1564   NtClose  (136, ...
 01301   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 12648448, 1048576, ) == 0x0
 01302   896   NtAllocateVirtualMemory  (-1, 13688832, 0, 8192, 4096, 4, ... 13688832, 8192, ) == 0x0
 01303   896   NtProtectVirtualMemory  (-1, (0xd0e000), 4096, 260, ... (0xd0e000), 4096, 4, ) == 0x0
 01304   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 132, {1252, 1964}, ) == 0x0
 01305   896   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 01306   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\254\7\0\0" ...  ...
 01300  1564   NtClose  ... ) == 0x0
 01307  1564   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01308  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596584, ... ) }, 11596584, ... ) == 0x0
 01309  1564   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... }, 5, 96, ...
 01306   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 01310   896   NtResumeThread  (132, ... 1, ) == 0x0
 01311   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13697024, 1048576, ) == 0x0
 01312   896   NtAllocateVirtualMemory  (-1, 14737408, 0, 8192, 4096, 4, ... 14737408, 8192, ) == 0x0
 01313   896   NtProtectVirtualMemory  (-1, (0xe0e000), 4096, 260, ... (0xe0e000), 4096, 4, ) == 0x0
 01314   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 136, {1252, 1568}, ) == 0x0
 01315   896   NtQueryInformationThread  (136, Basic, 28, ...
 01309  1564   NtOpenFile  ... 140, {status=0x0, info=1}, ) == 0x0
 01316  1964   NtWaitForSingleObject  (128, 0, 0x0, ...
 01317  1564   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 140, ... 144, ) == 0x0
 01318  1564   NtQuerySection  (144, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01319  1564   NtClose  (140, ... ) == 0x0
 01320  1564   NtMapViewOfSection  (144, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 01321  1564   NtClose  (144, ... ) == 0x0
 01322  1564   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 01315   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 01323   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0 \6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 01324   896   NtResumeThread  (136, ... 1, ) == 0x0
 01325   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14745600, 1048576, ) == 0x0
 01326   896   NtAllocateVirtualMemory  (-1, 15785984, 0, 8192, 4096, 4, ... 15785984, 8192, ) == 0x0
 01327   896   NtProtectVirtualMemory  (-1, (0xf0e000), 4096, 260, ... (0xf0e000), 4096, 4, ) == 0x0
 01322  1564   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 01328  1568   NtWaitForSingleObject  (128, 0, 0x0, ...
 01329  1564   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01330  1564   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01331  1564   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01332  1564   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01333   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 144, {1252, 1440}, ) == 0x0
 01334   896   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 01335   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 01336   896   NtResumeThread  (144, ... 1, ) == 0x0
 01337   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15794176, 1048576, ) == 0x0
 01338   896   NtAllocateVirtualMemory  (-1, 16834560, 0, 8192, 4096, 4, ...
 01339  1564   NtFlushInstructionCache  (-1, 1906642944, 1060, ...
 01340  1440   NtWaitForSingleObject  (128, 0, 0x0, ...
 01339  1564   NtFlushInstructionCache  ... ) == 0x0
 01341  1564   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01342  1564   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01343  1564   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01344  1564   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01345  1564   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01338   896   NtAllocateVirtualMemory  ... 16834560, 8192, ) == 0x0
 01346   896   NtProtectVirtualMemory  (-1, (0x100e000), 4096, 260, ... (0x100e000), 4096, 4, ) == 0x0
 01347   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 140, {1252, 1664}, ) == 0x0
 01348   896   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 01349   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\200\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 01350   896   NtResumeThread  (140, ... 1, ) == 0x0
 01351  1564   NtQuerySystemInformation  (Processor, 12, ...
 01352  1664   NtWaitForSingleObject  (128, 0, 0x0, ...
 01351  1564   NtQuerySystemInformation  ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01353  1564   NtSetEventBoostPriority  (128, ...
 01295   164   NtWaitForSingleObject  ... ) == 0x0
 01354   164   NtSetEventBoostPriority  (128, ...
 01316  1964   NtWaitForSingleObject  ... ) == 0x0
 01355  1964   NtSetEventBoostPriority  (128, ...
 01328  1568   NtWaitForSingleObject  ... ) == 0x0
 01356  1568   NtSetEventBoostPriority  (128, ...
 01340  1440   NtWaitForSingleObject  ... ) == 0x0
 01357  1440   NtSetEventBoostPriority  (128, ...
 01352  1664   NtWaitForSingleObject  ... ) == 0x0
 01358  1664   NtTestAlert  (... ) == 0x0
 01357  1440   NtSetEventBoostPriority  ... ) == 0x0
 01356  1568   NtSetEventBoostPriority  ... ) == 0x0
 01355  1964   NtSetEventBoostPriority  ... ) == 0x0
 01354   164   NtSetEventBoostPriority  ... ) == 0x0
 01353  1564   NtSetEventBoostPriority  ... ) == 0x0
 01359   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01360  1664   NtContinue  (16842032, 1, ...
 01361  1440   NtTestAlert  (...
 01362  1568   NtTestAlert  (...
 01363  1964   NtTestAlert  (...
 01364  1564   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01359   896   NtAllocateVirtualMemory  ... 16842752, 1048576, ) == 0x0
 01365  1664   NtRegisterThreadTerminatePort  (24, ...
 01361  1440   NtTestAlert  ... ) == 0x0
 01362  1568   NtTestAlert  ... ) == 0x0
 01363  1964   NtTestAlert  ... ) == 0x0
 01364  1564   NtCreateEvent  ... 148, ) == 0x0
 01366   896   NtAllocateVirtualMemory  (-1, 17883136, 0, 8192, 4096, 4, ...
 01365  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 01367  1440   NtContinue  (15793456, 1, ...
 01368  1568   NtContinue  (14744880, 1, ...
 01369  1964   NtContinue  (13696304, 1, ...
 01370   164   NtTestAlert  (...
 01366   896   NtAllocateVirtualMemory  ... 17883136, 8192, ) == 0x0
 01371  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01372  1440   NtRegisterThreadTerminatePort  (24, ...
 01373  1568   NtRegisterThreadTerminatePort  (24, ...
 01374  1964   NtRegisterThreadTerminatePort  (24, ...
 01370   164   NtTestAlert  ... ) == 0x0
 01375   896   NtProtectVirtualMemory  (-1, (0x110e000), 4096, 260, ...
 01371  1664   NtDuplicateObject  ... 152, ) == 0x0
 01372  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 01373  1568   NtRegisterThreadTerminatePort  ... ) == 0x0
 01374  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 01376   164   NtContinue  (12647728, 1, ...
 01375   896   NtProtectVirtualMemory  ... (0x110e000), 4096, 4, ) == 0x0
 01377  1664   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01378  1440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01379  1568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01380  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01381   164   NtRegisterThreadTerminatePort  (24, ...
 01382  1564   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 01383   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01377  1664   NtWaitForSingleObject  ... ) == 0x102
 01378  1440   NtDuplicateObject  ... 156, ) == 0x0
 01379  1568   NtDuplicateObject  ... 160, ) == 0x0
 01381   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 01382  1564   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01383   896   NtCreateThread  ... 164, {1252, 760}, ) == 0x0
 01384  1664   NtAllocateVirtualMemory  (-1, 16830464, 0, 4096, 4096, 260, ...
 01385  1440   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01386  1568   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01387   164   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01388  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11596196, ... }, 11596196, ...
 01389   896   NtQueryInformationThread  (164, Basic, 28, ...
 01384  1664   NtAllocateVirtualMemory  ... 16830464, 4096, ) == 0x0
 01385  1440   NtWaitForSingleObject  ... ) == 0x102
 01386  1568   NtWaitForSingleObject  ... ) == 0x102
 01380  1964   NtDuplicateObject  ... 168, ) == 0x0
 01389   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 01390  1664   NtWaitForSingleObject  (128, 0, 0x0, ...
 01391  1440   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01392  1568   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01393  1964   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01394   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\370\2\0\0" ...  ...
 01391  1440   NtCreateEvent  ... 172, ) == 0x0
 01392  1568   NtCreateEvent  ... 176, ) == 0x0
 01393  1964   NtWaitForSingleObject  ... ) == 0x102
 01394   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 01387   164   NtDuplicateObject  ... 180, ) == 0x0
 01395  1440   NtWaitForSingleObject  (172, 0, 0x0, ...
 01396  1964   NtWaitForSingleObject  (172, 0, 0x0, ...
 01397   896   NtResumeThread  (164, ...
 01398   164   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01397   896   NtResumeThread  ... 1, ) == 0x0
 01398   164   NtWaitForSingleObject  ... ) == 0x102
 01399   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01400   164   NtWaitForSingleObject  (172, 0, 0x0, ...
 01399   896   NtAllocateVirtualMemory  ... 17891328, 1048576, ) == 0x0
 01401   896   NtAllocateVirtualMemory  (-1, 18931712, 0, 8192, 4096, 4, ... 18931712, 8192, ) == 0x0
 01402   896   NtProtectVirtualMemory  (-1, (0x120e000), 4096, 260, ... (0x120e000), 4096, 4, ) == 0x0
 01403   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 184, {1252, 1580}, ) == 0x0
 01404   896   NtQueryInformationThread  (184, Basic, 28, ...
 01405  1568   NtClose  (176, ...
 01406   760   NtWaitForSingleObject  (128, 0, 0x0, ...
 01405  1568   NtClose  ... ) == 0x0
 01407  1568   NtWaitForSingleObject  (172, 0, 0x0, ...
 01404   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 01408   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0,\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 01409   896   NtResumeThread  (184, ... 1, ) == 0x0
 01410  1580   NtWaitForSingleObject  (128, 0, 0x0, ...
 01411   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18939904, 1048576, ) == 0x0
 01412   896   NtAllocateVirtualMemory  (-1, 19980288, 0, 8192, 4096, 4, ... 19980288, 8192, ) == 0x0
 01413   896   NtProtectVirtualMemory  (-1, (0x130e000), 4096, 260, ... (0x130e000), 4096, 4, ) == 0x0
 01414   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 176, {1252, 1756}, ) == 0x0
 01415   896   NtQueryInformationThread  (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 01416   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\334\6\0\0" ...  ...
 01388  1564   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01417  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11596196, ... ) }, 11596196, ... ) == 0x0
 01418  1564   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... 188, {status=0x0, info=1}, ) }, 5, 96, ... 188, {status=0x0, info=1}, ) == 0x0
 01419  1564   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 188, ...
 01416   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 01420   896   NtResumeThread  (176, ... 1, ) == 0x0
 01421   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19988480, 1048576, ) == 0x0
 01422   896   NtAllocateVirtualMemory  (-1, 21028864, 0, 8192, 4096, 4, ... 21028864, 8192, ) == 0x0
 01423   896   NtProtectVirtualMemory  (-1, (0x140e000), 4096, 260, ... (0x140e000), 4096, 4, ) == 0x0
 01424   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 192, {1252, 1304}, ) == 0x0
 01425   896   NtQueryInformationThread  (192, Basic, 28, ...
 01419  1564   NtCreateSection  ... 196, ) == 0x0
 01426  1756   NtWaitForSingleObject  (128, 0, 0x0, ...
 01427  1564   NtQuerySection  (196, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01428  1564   NtClose  (188, ... ) == 0x0
 01429  1564   NtMapViewOfSection  (196, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x662b0000), 0x0, 360448, ) == 0x0
 01430  1564   NtClose  (196, ... ) == 0x0
 01431  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01432  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01425   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 01433   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\30\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 01434   896   NtResumeThread  (192, ... 1, ) == 0x0
 01435   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21037056, 1048576, ) == 0x0
 01436   896   NtAllocateVirtualMemory  (-1, 22077440, 0, 8192, 4096, 4, ... 22077440, 8192, ) == 0x0
 01437   896   NtProtectVirtualMemory  (-1, (0x150e000), 4096, 260, ... (0x150e000), 4096, 4, ) == 0x0
 01432  1564   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01438  1304   NtWaitForSingleObject  (128, 0, 0x0, ...
 01439  1564   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01440  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01441  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01442  1564   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01443  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01444  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01445   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 196, {1252, 1292}, ) == 0x0
 01446   896   NtQueryInformationThread  (196, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=1292,}, 0x0, ) == 0x0
 01447   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\14\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\14\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\14\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\14\5\0\0" )  ) == 0x0
 01448   896   NtResumeThread  (196, ... 1, ) == 0x0
 01449   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22085632, 1048576, ) == 0x0
 01450   896   NtAllocateVirtualMemory  (-1, 23126016, 0, 8192, 4096, 4, ...
 01444  1564   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01451  1292   NtWaitForSingleObject  (128, 0, 0x0, ...
 01452  1564   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01453  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01454  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01455  1564   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01456  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01457  1564   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01450   896   NtAllocateVirtualMemory  ... 23126016, 8192, ) == 0x0
 01458   896   NtProtectVirtualMemory  (-1, (0x160e000), 4096, 260, ... (0x160e000), 4096, 4, ) == 0x0
 01459   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 188, {1252, 540}, ) == 0x0
 01460   896   NtQueryInformationThread  (188, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=540,}, 0x0, ) == 0x0
 01461   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\34\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\34\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\34\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\34\2\0\0" )  ) == 0x0
 01462   896   NtResumeThread  (188, ... 1, ) == 0x0
 01457  1564   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01463   540   NtWaitForSingleObject  (128, 0, 0x0, ...
 01464  1564   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01465  1564   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01466  1564   NtSetEventBoostPriority  (128, ...
 01390  1664   NtWaitForSingleObject  ... ) == 0x0
 01467  1664   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 16837584, ... ) }, 16837584, ... ) == 0x0
 01468  1664   NtSetEventBoostPriority  (128, ...
 01406   760   NtWaitForSingleObject  ... ) == 0x0
 01469   760   NtSetEventBoostPriority  (128, ...
 01410  1580   NtWaitForSingleObject  ... ) == 0x0
 01470  1580   NtSetEventBoostPriority  (128, ...
 01426  1756   NtWaitForSingleObject  ... ) == 0x0
 01471  1756   NtSetEventBoostPriority  (128, ...
 01438  1304   NtWaitForSingleObject  ... ) == 0x0
 01472  1304   NtSetEventBoostPriority  (128, ...
 01451  1292   NtWaitForSingleObject  ... ) == 0x0
 01473  1292   NtSetEventBoostPriority  (128, ...
 01463   540   NtWaitForSingleObject  ... ) == 0x0
 01474   540   NtTestAlert  (... ) == 0x0
 01473  1292   NtSetEventBoostPriority  ... ) == 0x0
 01472  1304   NtSetEventBoostPriority  ... ) == 0x0
 01471  1756   NtSetEventBoostPriority  ... ) == 0x0
 01470  1580   NtSetEventBoostPriority  ... ) == 0x0
 01469   760   NtSetEventBoostPriority  ... ) == 0x0
 01468  1664   NtSetEventBoostPriority  ... ) == 0x0
 01466  1564   NtSetEventBoostPriority  ... ) == 0x0
 01475   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01476   540   NtContinue  (23133488, 1, ...
 01477  1292   NtTestAlert  (...
 01478  1304   NtTestAlert  (...
 01479  1756   NtTestAlert  (...
 01480  1580   NtTestAlert  (...
 01481  1664   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01482  1564   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01475   896   NtAllocateVirtualMemory  ... 23134208, 1048576, ) == 0x0
 01483   540   NtRegisterThreadTerminatePort  (24, ...
 01477  1292   NtTestAlert  ... ) == 0x0
 01478  1304   NtTestAlert  ... ) == 0x0
 01479  1756   NtTestAlert  ... ) == 0x0
 01480  1580   NtTestAlert  ... ) == 0x0
 01481  1664   NtCreateEvent  ... 200, ) == 0x0
 01482  1564   NtCreateEvent  ... 204, ) == 0x0
 01484   896   NtAllocateVirtualMemory  (-1, 24174592, 0, 8192, 4096, 4, ...
 01483   540   NtRegisterThreadTerminatePort  ... ) == 0x0
 01485  1292   NtContinue  (22084912, 1, ...
 01486  1304   NtContinue  (21036336, 1, ...
 01487  1756   NtContinue  (19987760, 1, ...
 01488  1580   NtContinue  (18939184, 1, ...
 01489  1664   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 01490  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01484   896   NtAllocateVirtualMemory  ... 24174592, 8192, ) == 0x0
 01491   540   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01492  1292   NtRegisterThreadTerminatePort  (24, ...
 01493  1304   NtRegisterThreadTerminatePort  (24, ...
 01494  1756   NtRegisterThreadTerminatePort  (24, ...
 01495  1580   NtRegisterThreadTerminatePort  (24, ...
 01489  1664   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01490  1564   NtDuplicateObject  ... 208, ) == 0x0
 01496   896   NtProtectVirtualMemory  (-1, (0x170e000), 4096, 260, ...
 01491   540   NtDuplicateObject  ... 212, ) == 0x0
 01492  1292   NtRegisterThreadTerminatePort  ... ) == 0x0
 01493  1304   NtRegisterThreadTerminatePort  ... ) == 0x0
 01494  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 01495  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 01497   760   NtTestAlert  (...
 01498  1564   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01496   896   NtProtectVirtualMemory  ... (0x170e000), 4096, 4, ) == 0x0
 01499   540   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01500  1292   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01501  1304   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01502  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01503  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01497   760   NtTestAlert  ... ) == 0x0
 01504  1664   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 16837688, ... }, 16837688, ...
 01498  1564   NtOpenKey  ... 216, ) == 0x0
 01505   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01499   540   NtWaitForSingleObject  ... ) == 0x102
 01500  1292   NtDuplicateObject  ... 220, ) == 0x0
 01501  1304   NtDuplicateObject  ... 224, ) == 0x0
 01502  1756   NtDuplicateObject  ... 228, ) == 0x0
 01506   760   NtContinue  (17890608, 1, ...
 01507  1564   NtQueryValueKey  (216,  (216, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01505   896   NtCreateThread  ... 232, {1252, 1480}, ) == 0x0
 01508   540   NtWaitForSingleObject  (172, 0, 0x0, ...
 01509  1292   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01510  1304   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01511  1756   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01512   760   NtRegisterThreadTerminatePort  (24, ...
 01507  1564   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01513   896   NtQueryInformationThread  (232, Basic, 28, ...
 01509  1292   NtWaitForSingleObject  ... ) == 0x102
 01510  1304   NtWaitForSingleObject  ... ) == 0x102
 01511  1756   NtWaitForSingleObject  ... ) == 0x102
 01512   760   NtRegisterThreadTerminatePort  ... ) == 0x0
 01514  1564   NtClose  (216, ...
 01513   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=1480,}, 0x0, ) == 0x0
 01515  1292   NtWaitForSingleObject  (172, 0, 0x0, ...
 01516  1304   NtWaitForSingleObject  (172, 0, 0x0, ...
 01517  1756   NtWaitForSingleObject  (172, 0, 0x0, ...
 01518   760   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01514  1564   NtClose  ... ) == 0x0
 01519   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\310\5\0\0" ...  ...
 01503  1580   NtDuplicateObject  ... 216, ) == 0x0
 01520  1564   NtOpenThreadToken  (-2, 0xc, 1, ...
 01521  1580   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01518   760   NtDuplicateObject  ... 236, ) == 0x0
 01519   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81893, 0}  ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\310\5\0\0" )  ) == 0x0
 01521  1580   NtWaitForSingleObject  ... ) == 0x102
 01522   760   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01523   896   NtResumeThread  (232, ...
 01524  1580   NtWaitForSingleObject  (172, 0, 0x0, ...
 01522   760   NtWaitForSingleObject  ... ) == 0x102
 01523   896   NtResumeThread  ... 1, ) == 0x0
 01525   760   NtWaitForSingleObject  (172, 0, 0x0, ...
 01526   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24182784, 1048576, ) == 0x0
 01527   896   NtAllocateVirtualMemory  (-1, 25223168, 0, 8192, 4096, 4, ... 25223168, 8192, ) == 0x0
 01528   896   NtProtectVirtualMemory  (-1, (0x180e000), 4096, 260, ... (0x180e000), 4096, 4, ) == 0x0
 01529   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 240, {1252, 1784}, ) == 0x0
 01530   896   NtQueryInformationThread  (240, Basic, 28, ...
 01520  1564   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01531  1480   NtWaitForSingleObject  (128, 0, 0x0, ...
 01532  1564   NtOpenThreadToken  (-2, 0x20008, 1, ... ) == STATUS_NO_TOKEN
 01533  1564   NtWaitForSingleObject  (128, 0, 0x0, ...
 01530   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=1784,}, 0x0, ) == 0x0
 01534   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\370\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\370\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\370\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\370\6\0\0" )  ) == 0x0
 01535   896   NtResumeThread  (240, ... 1, ) == 0x0
 01536  1784   NtWaitForSingleObject  (128, 0, 0x0, ...
 01537   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25231360, 1048576, ) == 0x0
 01538   896   NtAllocateVirtualMemory  (-1, 26271744, 0, 8192, 4096, 4, ... 26271744, 8192, ) == 0x0
 01539   896   NtProtectVirtualMemory  (-1, (0x190e000), 4096, 260, ... (0x190e000), 4096, 4, ) == 0x0
 01504  1664   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01540  1664   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 16837688, ... ) }, 16837688, ... ) == 0x0
 01541  1664   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0
 01542  1664   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 244, ... 248, ) == 0x0
 01543  1664   NtQuerySection  (248, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01544  1664   NtClose  (244, ... ) == 0x0
 01545   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 244, {1252, 1068}, ) == 0x0
 01546   896   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=1068,}, 0x0, ) == 0x0
 01547   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0,\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0,\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0,\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0,\4\0\0" )  ) == 0x0
 01548   896   NtResumeThread  (244, ... 1, ) == 0x0
 01549   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26279936, 1048576, ) == 0x0
 01550   896   NtAllocateVirtualMemory  (-1, 27320320, 0, 8192, 4096, 4, ...
 01551  1664   NtMapViewOfSection  (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01552  1068   NtWaitForSingleObject  (128, 0, 0x0, ...
 01551  1664   NtMapViewOfSection  ... (0x76f20000), 0x0, 159744, ) == 0x0
 01553  1664   NtClose  (248, ... ) == 0x0
 01554  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01555  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01556  1664   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01557  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01550   896   NtAllocateVirtualMemory  ... 27320320, 8192, ) == 0x0
 01558   896   NtProtectVirtualMemory  (-1, (0x1a0e000), 4096, 260, ... (0x1a0e000), 4096, 4, ) == 0x0
 01559   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 248, {1252, 1856}, ) == 0x0
 01560   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=1856,}, 0x0, ) == 0x0
 01561   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0@\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0@\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0@\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0@\7\0\0" )  ) == 0x0
 01562   896   NtResumeThread  (248, ... 1, ) == 0x0
 01563  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ...
 01564  1856   NtWaitForSingleObject  (128, 0, 0x0, ...
 01563  1664   NtProtectVirtualMemory  ... (0x76f21000), 4096, 4, ) == 0x0
 01565  1664   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01566  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01567  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01568  1664   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01569  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01570   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27328512, 1048576, ) == 0x0
 01571   896   NtAllocateVirtualMemory  (-1, 28368896, 0, 8192, 4096, 4, ... 28368896, 8192, ) == 0x0
 01572   896   NtProtectVirtualMemory  (-1, (0x1b0e000), 4096, 260, ... (0x1b0e000), 4096, 4, ) == 0x0
 01573   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 252, {1252, 1572}, ) == 0x0
 01574   896   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1572,}, 0x0, ) == 0x0
 01575   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0$\6\0\0" ...  ...
 01576  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01577  1664   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01578  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01575   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81897, 0}  ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0$\6\0\0" )  ) == 0x0
 01579   896   NtResumeThread  (252, ... 1, ) == 0x0
 01580   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28377088, 1048576, ) == 0x0
 01581   896   NtAllocateVirtualMemory  (-1, 29417472, 0, 8192, 4096, 4, ... 29417472, 8192, ) == 0x0
 01582   896   NtProtectVirtualMemory  (-1, (0x1c0e000), 4096, 260, ... (0x1c0e000), 4096, 4, ) == 0x0
 01583   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 256, {1252, 1604}, ) == 0x0
 01584   896   NtQueryInformationThread  (256, Basic, 28, ...
 01585  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ...
 01586  1572   NtWaitForSingleObject  (128, 0, 0x0, ...
 01585  1664   NtProtectVirtualMemory  ... (0x76f21000), 4096, 4, ) == 0x0
 01587  1664   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01588  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01589  1664   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01590  1664   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01591  1664   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01584   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1604,}, 0x0, ) == 0x0
 01592   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0D\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0D\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0D\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0D\6\0\0" )  ) == 0x0
 01593   896   NtResumeThread  (256, ... 1, ) == 0x0
 01594   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29425664, 1048576, ) == 0x0
 01595   896   NtAllocateVirtualMemory  (-1, 30466048, 0, 8192, 4096, 4, ... 30466048, 8192, ) == 0x0
 01596   896   NtProtectVirtualMemory  (-1, (0x1d0e000), 4096, 260, ... (0x1d0e000), 4096, 4, ) == 0x0
 01597  1664   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01598  1604   NtWaitForSingleObject  (128, 0, 0x0, ...
 01597  1664   NtCreateKey  ... 260, 2, ) == 0x0
 01599  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 264, ) }, ... 264, ) == 0x0
 01600  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01601  1664   NtQueryValueKey  (264,  (264, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01602  1664   NtQueryValueKey  (260,  (260, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01603  1664   NtQueryValueKey  (264,  (264, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01604   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 268, {1252, 1596}, ) == 0x0
 01605   896   NtQueryInformationThread  (268, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1596,}, 0x0, ) == 0x0
 01606   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0<\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0<\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0<\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0<\6\0\0" )  ) == 0x0
 01607   896   NtResumeThread  (268, ... 1, ) == 0x0
 01608   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30474240, 1048576, ) == 0x0
 01609   896   NtAllocateVirtualMemory  (-1, 31514624, 0, 8192, 4096, 4, ...
 01610  1664   NtQueryValueKey  (260,  (260, "UseDomainNameDevolution", Partial, 144, ... , Partial, 144, ...
 01611  1596   NtWaitForSingleObject  (128, 0, 0x0, ...
 01610  1664   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01612  1664   NtQueryValueKey  (264,  (264, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01613  1664   NtQueryValueKey  (260,  (260, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01614  1664   NtQueryValueKey  (264,  (264, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01615  1664   NtQueryValueKey  (260,  (260, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01616  1664   NtQueryValueKey  (264,  (264, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01609   896   NtAllocateVirtualMemory  ... 31514624, 8192, ) == 0x0
 01617   896   NtProtectVirtualMemory  (-1, (0x1e0e000), 4096, 260, ... (0x1e0e000), 4096, 4, ) == 0x0
 01618   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 272, {1252, 1132}, ) == 0x0
 01619   896   NtQueryInformationThread  (272, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=1132,}, 0x0, ) == 0x0
 01620   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0l\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0l\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0l\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0l\4\0\0" )  ) == 0x0
 01621   896   NtResumeThread  (272, ... 1, ) == 0x0
 01622  1664   NtQueryValueKey  (264,  (264, "ScreenBadTlds", Partial, 144, ... , Partial, 144, ...
 01623  1132   NtWaitForSingleObject  (128, 0, 0x0, ...
 01622  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01624  1664   NtQueryValueKey  (264,  (264, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01625  1664   NtQueryValueKey  (264,  (264, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01626  1664   NtQueryValueKey  (264,  (264, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01627  1664   NtQueryValueKey  (264,  (264, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01628  1664   NtQueryValueKey  (264,  (264, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01629   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31522816, 1048576, ) == 0x0
 01630   896   NtAllocateVirtualMemory  (-1, 32563200, 0, 8192, 4096, 4, ... 32563200, 8192, ) == 0x0
 01631   896   NtProtectVirtualMemory  (-1, (0x1f0e000), 4096, 260, ... (0x1f0e000), 4096, 4, ) == 0x0
 01632   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 276, {1252, 948}, ) == 0x0
 01633   896   NtQueryInformationThread  (276, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=948,}, 0x0, ) == 0x0
 01634   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\1\0\0\344\4\0\0\264\3\0\0" ...  ...
 01635  1664   NtQueryValueKey  (264,  (264, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01636  1664   NtQueryValueKey  (264,  (264, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01637  1664   NtQueryValueKey  (260,  (260, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01634   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81901, 0}  ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\1\0\0\344\4\0\0\264\3\0\0" )  ) == 0x0
 01638   896   NtResumeThread  (276, ... 1, ) == 0x0
 01639   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32571392, 1048576, ) == 0x0
 01640   896   NtAllocateVirtualMemory  (-1, 33611776, 0, 8192, 4096, 4, ... 33611776, 8192, ) == 0x0
 01641   896   NtProtectVirtualMemory  (-1, (0x200e000), 4096, 260, ... (0x200e000), 4096, 4, ) == 0x0
 01642   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 280, {1252, 1064}, ) == 0x0
 01643   896   NtQueryInformationThread  (280, Basic, 28, ...
 01644  1664   NtQueryValueKey  (264,  (264, "RegisterPrimaryName", Partial, 144, ... , Partial, 144, ...
 01645   948   NtWaitForSingleObject  (128, 0, 0x0, ...
 01644  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01646  1664   NtQueryValueKey  (264,  (264, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01647  1664   NtQueryValueKey  (260,  (260, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01648  1664   NtQueryValueKey  (264,  (264, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01649  1664   NtQueryValueKey  (260,  (260, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01650  1664   NtQueryValueKey  (264,  (264, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01643   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1064,}, 0x0, ) == 0x0
 01651   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\1\0\0\344\4\0\0(\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\1\0\0\344\4\0\0(\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\1\0\0\344\4\0\0(\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\1\0\0\344\4\0\0(\4\0\0" )  ) == 0x0
 01652   896   NtResumeThread  (280, ... 1, ) == 0x0
 01653   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 33619968, 1048576, ) == 0x0
 01654   896   NtAllocateVirtualMemory  (-1, 34660352, 0, 8192, 4096, 4, ... 34660352, 8192, ) == 0x0
 01655   896   NtProtectVirtualMemory  (-1, (0x210e000), 4096, 260, ... (0x210e000), 4096, 4, ) == 0x0
 01656  1664   NtQueryValueKey  (260,  (260, "DisableWanDynamicUpdate", Partial, 144, ... , Partial, 144, ...
 01657  1064   NtWaitForSingleObject  (128, 0, 0x0, ...
 01656  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01658  1664   NtQueryValueKey  (264,  (264, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01659  1664   NtQueryValueKey  (260,  (260, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01660  1664   NtQueryValueKey  (264,  (264, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01661  1664   NtQueryValueKey  (260,  (260, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01662  1664   NtQueryValueKey  (264,  (264, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01663   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 284, {1252, 188}, ) == 0x0
 01664   896   NtQueryInformationThread  (284, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=188,}, 0x0, ) == 0x0
 01665   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\274\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\274\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\274\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\274\0\0\0" )  ) == 0x0
 01666   896   NtResumeThread  (284, ... 1, ) == 0x0
 01667   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 34668544, 1048576, ) == 0x0
 01668   896   NtAllocateVirtualMemory  (-1, 35708928, 0, 8192, 4096, 4, ...
 01669  1664   NtQueryValueKey  (260,  (260, "MaxNumberOfAddressesToRegister", Partial, 144, ... , Partial, 144, ...
 01670   188   NtWaitForSingleObject  (128, 0, 0x0, ...
 01669  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01671  1664   NtQueryValueKey  (264,  (264, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01672  1664   NtQueryValueKey  (260,  (260, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01673  1664   NtQueryValueKey  (264,  (264, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01674  1664   NtQueryValueKey  (264,  (264, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01675  1664   NtQueryValueKey  (264,  (264, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01668   896   NtAllocateVirtualMemory  ... 35708928, 8192, ) == 0x0
 01676   896   NtProtectVirtualMemory  (-1, (0x220e000), 4096, 260, ... (0x220e000), 4096, 4, ) == 0x0
 01677   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 288, {1252, 1240}, ) == 0x0
 01678   896   NtQueryInformationThread  (288, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1240,}, 0x0, ) == 0x0
 01679   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\330\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\330\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\330\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\330\4\0\0" )  ) == 0x0
 01680   896   NtResumeThread  (288, ... 1, ) == 0x0
 01681  1664   NtQueryValueKey  (264,  (264, "MaxCacheSize", Partial, 144, ... , Partial, 144, ...
 01682  1240   NtWaitForSingleObject  (128, 0, 0x0, ...
 01681  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01683  1664   NtQueryValueKey  (264,  (264, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01684  1664   NtQueryValueKey  (264,  (264, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01685  1664   NtQueryValueKey  (264,  (264, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01686  1664   NtQueryValueKey  (264,  (264, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01687  1664   NtQueryValueKey  (264,  (264, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01688   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 35717120, 1048576, ) == 0x0
 01689   896   NtAllocateVirtualMemory  (-1, 36757504, 0, 8192, 4096, 4, ... 36757504, 8192, ) == 0x0
 01690   896   NtProtectVirtualMemory  (-1, (0x230e000), 4096, 260, ... (0x230e000), 4096, 4, ) == 0x0
 01691   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 292, {1252, 740}, ) == 0x0
 01692   896   NtQueryInformationThread  (292, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=740,}, 0x0, ) == 0x0
 01693   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\1\0\0\344\4\0\0\344\2\0\0" ...  ...
 01694  1664   NtQueryValueKey  (264,  (264, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01695  1664   NtQueryValueKey  (264,  (264, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01696  1664   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\Setup"}, ... 296, ) }, ... 296, ) == 0x0
 01693   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81905, 0}  ... {28, 56, reply, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\1\0\0\344\4\0\0\344\2\0\0" )  ) == 0x0
 01697   896   NtResumeThread  (292, ... 1, ) == 0x0
 01698   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 36765696, 1048576, ) == 0x0
 01699   896   NtAllocateVirtualMemory  (-1, 37806080, 0, 8192, 4096, 4, ... 37806080, 8192, ) == 0x0
 01700   896   NtProtectVirtualMemory  (-1, (0x240e000), 4096, 260, ... (0x240e000), 4096, 4, ) == 0x0
 01701   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 300, {1252, 120}, ) == 0x0
 01702   896   NtQueryInformationThread  (300, Basic, 28, ...
 01703  1664   NtQueryValueKey  (296,  (296, "SystemSetupInProgress", Partial, 144, ... , Partial, 144, ...
 01704   740   NtWaitForSingleObject  (128, 0, 0x0, ...
 01703  1664   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01705  1664   NtClose  (296, ... ) == 0x0
 01706  1664   NtClose  (260, ... ) == 0x0
 01707  1664   NtClose  (264, ... ) == 0x0
 01708  1664   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 264, ) }, ... 264, ) == 0x0
 01709  1664   NtQueryValueKey  (264,  (264, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01702   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=120,}, 0x0, ) == 0x0
 01710   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0x\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0x\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0x\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0x\0\0\0" )  ) == 0x0
 01711   896   NtResumeThread  (300, ... 1, ) == 0x0
 01712   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 37814272, 1048576, ) == 0x0
 01713   896   NtAllocateVirtualMemory  (-1, 38854656, 0, 8192, 4096, 4, ... 38854656, 8192, ) == 0x0
 01714   896   NtProtectVirtualMemory  (-1, (0x250e000), 4096, 260, ... (0x250e000), 4096, 4, ) == 0x0
 01715  1664   NtQueryValueKey  (264,  (264, "DnsQuickQueryTimeouts", Partial, 144, ... , Partial, 144, ...
 01716   120   NtWaitForSingleObject  (128, 0, 0x0, ...
 01715  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01717  1664   NtQueryValueKey  (264,  (264, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01718  1664   NtClose  (264, ... ) == 0x0
 01719  1664   NtSetEventBoostPriority  (128, ...
 01531  1480   NtWaitForSingleObject  ... ) == 0x0
 01720  1480   NtSetEventBoostPriority  (128, ...
 01533  1564   NtWaitForSingleObject  ... ) == 0x0
 01721  1564   NtSetEventBoostPriority  (128, ...
 01536  1784   NtWaitForSingleObject  ... ) == 0x0
 01722  1784   NtSetEventBoostPriority  (128, ...
 01552  1068   NtWaitForSingleObject  ... ) == 0x0
 01723  1068   NtSetEventBoostPriority  (128, ...
 01564  1856   NtWaitForSingleObject  ... ) == 0x0
 01724  1856   NtSetEventBoostPriority  (128, ...
 01586  1572   NtWaitForSingleObject  ... ) == 0x0
 01725  1572   NtSetEventBoostPriority  (128, ...
 01598  1604   NtWaitForSingleObject  ... ) == 0x0
 01726  1604   NtSetEventBoostPriority  (128, ...
 01611  1596   NtWaitForSingleObject  ... ) == 0x0
 01727  1596   NtSetEventBoostPriority  (128, ...
 01623  1132   NtWaitForSingleObject  ... ) == 0x0
 01728  1132   NtSetEventBoostPriority  (128, ...
 01645   948   NtWaitForSingleObject  ... ) == 0x0
 01729   948   NtSetEventBoostPriority  (128, ...
 01657  1064   NtWaitForSingleObject  ... ) == 0x0
 01730  1064   NtSetEventBoostPriority  (128, ...
 01670   188   NtWaitForSingleObject  ... ) == 0x0
 01731   188   NtSetEventBoostPriority  (128, ...
 01682  1240   NtWaitForSingleObject  ... ) == 0x0
 01732  1240   NtSetEventBoostPriority  (128, ...
 01704   740   NtWaitForSingleObject  ... ) == 0x0
 01733   740   NtAllocateVirtualMemory  (-1, 3624960, 0, 4096, 4096, 4, ... 3624960, 4096, ) == 0x0
 01732  1240   NtSetEventBoostPriority  ... ) == 0x0
 01731   188   NtSetEventBoostPriority  ... ) == 0x0
 01730  1064   NtSetEventBoostPriority  ... ) == 0x0
 01729   948   NtSetEventBoostPriority  ... ) == 0x0
 01728  1132   NtSetEventBoostPriority  ... ) == 0x0
 01727  1596   NtSetEventBoostPriority  ... ) == 0x0
 01726  1604   NtSetEventBoostPriority  ... ) == 0x0
 01725  1572   NtSetEventBoostPriority  ... ) == 0x0
 01724  1856   NtSetEventBoostPriority  ... ) == 0x0
 01723  1068   NtSetEventBoostPriority  ... ) == 0x0
 01722  1784   NtSetEventBoostPriority  ... ) == 0x0
 01721  1564   NtSetEventBoostPriority  ... ) == 0x0
 01720  1480   NtSetEventBoostPriority  ... ) == 0x0
 01719  1664   NtSetEventBoostPriority  ... ) == 0x0
 01734   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01735   740   NtSetEventBoostPriority  (128, ...
 01736  1240   NtTestAlert  (...
 01737   188   NtTestAlert  (...
 01738  1064   NtTestAlert  (...
 01739   948   NtTestAlert  (...
 01740  1132   NtTestAlert  (...
 01741  1596   NtTestAlert  (...
 01742  1604   NtTestAlert  (...
 01743  1572   NtTestAlert  (...
 01744  1856   NtTestAlert  (...
 01745  1068   NtTestAlert  (...
 01746  1784   NtTestAlert  (...
 01747  1564   NtWaitForSingleObject  (128, 0, 0x0, ...
 01748  1664   NtWaitForSingleObject  (128, 0, 0x0, ...
 01734   896   NtCreateThread  ... 264, {1252, 1796}, ) == 0x0
 01716   120   NtWaitForSingleObject  ... ) == 0x0
 01735   740   NtSetEventBoostPriority  ... ) == 0x0
 01736  1240   NtTestAlert  ... ) == 0x0
 01737   188   NtTestAlert  ... ) == 0x0
 01738  1064   NtTestAlert  ... ) == 0x0
 01739   948   NtTestAlert  ... ) == 0x0
 01740  1132   NtTestAlert  ... ) == 0x0
 01741  1596   NtTestAlert  ... ) == 0x0
 01742  1604   NtTestAlert  ... ) == 0x0
 01743  1572   NtTestAlert  ... ) == 0x0
 01744  1856   NtTestAlert  ... ) == 0x0
 01745  1068   NtTestAlert  ... ) == 0x0
 01746  1784   NtTestAlert  ... ) == 0x0
 01749   120   NtSetEventBoostPriority  (128, ...
 01750   896   NtQueryInformationThread  (264, Basic, 28, ...
 01751   740   NtTestAlert  (...
 01752  1240   NtContinue  (35716400, 1, ...
 01753   188   NtContinue  (34667824, 1, ...
 01754  1064   NtContinue  (33619248, 1, ...
 01755   948   NtContinue  (32570672, 1, ...
 01756  1132   NtContinue  (31522096, 1, ...
 01757  1596   NtContinue  (30473520, 1, ...
 01758  1604   NtContinue  (29424944, 1, ...
 01759  1572   NtContinue  (28376368, 1, ...
 01760  1856   NtContinue  (27327792, 1, ...
 01761  1068   NtContinue  (26279216, 1, ...
 01747  1564   NtWaitForSingleObject  ... ) == 0x0
 01749   120   NtSetEventBoostPriority  ... ) == 0x0
 01762  1784   NtContinue  (25230640, 1, ...
 01750   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=1796,}, 0x0, ) == 0x0
 01751   740   NtTestAlert  ... ) == 0x0
 01763  1240   NtRegisterThreadTerminatePort  (24, ...
 01764   188   NtRegisterThreadTerminatePort  (24, ...
 01765  1064   NtRegisterThreadTerminatePort  (24, ...
 01766   948   NtRegisterThreadTerminatePort  (24, ...
 01767  1132   NtRegisterThreadTerminatePort  (24, ...
 01768  1596   NtRegisterThreadTerminatePort  (24, ...
 01769  1604   NtRegisterThreadTerminatePort  (24, ...
 01770  1572   NtRegisterThreadTerminatePort  (24, ...
 01771  1856   NtRegisterThreadTerminatePort  (24, ...
 01772  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11595888, ... }, 11595888, ...
 01773  1068   NtRegisterThreadTerminatePort  (24, ...
 01774  1480   NtTestAlert  (...
 01775  1784   NtRegisterThreadTerminatePort  (24, ...
 01776   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\4\7\0\0" ...  ...
 01777   740   NtContinue  (36764976, 1, ...
 01763  1240   NtRegisterThreadTerminatePort  ... ) == 0x0
 01764   188   NtRegisterThreadTerminatePort  ... ) == 0x0
 01765  1064   NtRegisterThreadTerminatePort  ... ) == 0x0
 01766   948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01767  1132   NtRegisterThreadTerminatePort  ... ) == 0x0
 01768  1596   NtRegisterThreadTerminatePort  ... ) == 0x0
 01769  1604   NtRegisterThreadTerminatePort  ... ) == 0x0
 01770  1572   NtRegisterThreadTerminatePort  ... ) == 0x0
 01772  1564   NtQueryAttributesFile  ... ) == 0x0
 01771  1856   NtRegisterThreadTerminatePort  ... ) == 0x0
 01773  1068   NtRegisterThreadTerminatePort  ... ) == 0x0
 01774  1480   NtTestAlert  ... ) == 0x0
 01775  1784   NtRegisterThreadTerminatePort  ... ) == 0x0
 01778   740   NtRegisterThreadTerminatePort  (24, ...
 01779  1240   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01780   188   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01781  1064   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01782   948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01783  1132   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01784  1596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01785  1604   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01786  1564   NtSetEventBoostPriority  (128, ...
 01787  1572   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01788  1856   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01789  1068   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01790  1480   NtContinue  (24182064, 1, ...
 01791  1784   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01792   120   NtTestAlert  (...
 01776   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\4\7\0\0" )  ) == 0x0
 01778   740   NtRegisterThreadTerminatePort  ... ) == 0x0
 01779  1240   NtDuplicateObject  ... 260, ) == 0x0
 01780   188   NtDuplicateObject  ... 296, ) == 0x0
 01781  1064   NtDuplicateObject  ... 304, ) == 0x0
 01782   948   NtDuplicateObject  ... 308, ) == 0x0
 01783  1132   NtDuplicateObject  ... 312, ) == 0x0
 01784  1596   NtDuplicateObject  ... 316, ) == 0x0
 01785  1604   NtDuplicateObject  ... 320, ) == 0x0
 01748  1664   NtWaitForSingleObject  ... ) == 0x0
 01786  1564   NtSetEventBoostPriority  ... ) == 0x0
 01787  1572   NtDuplicateObject  ... 324, ) == 0x0
 01788  1856   NtDuplicateObject  ... 328, ) == 0x0
 01793  1480   NtRegisterThreadTerminatePort  (24, ...
 01789  1068   NtDuplicateObject  ... 332, ) == 0x0
 01792   120   NtTestAlert  ... ) == 0x0
 01794   896   NtResumeThread  (264, ...
 01795   740   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01796  1240   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01797   188   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01798  1064   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01799   948   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01800  1132   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01801  1596   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01802  1604   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01803  1664   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01804  1564   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01805  1572   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01806  1856   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01793  1480   NtRegisterThreadTerminatePort  ... ) == 0x0
 01807  1068   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01808   120   NtContinue  (37813552, 1, ...
 01794   896   NtResumeThread  ... 1, ) == 0x0
 01795   740   NtDuplicateObject  ... 336, ) == 0x0
 01796  1240   NtWaitForSingleObject  ... ) == 0x102
 01797   188   NtWaitForSingleObject  ... ) == 0x102
 01798  1064   NtWaitForSingleObject  ... ) == 0x102
 01799   948   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01800  1132   NtCreateEvent  ... 340, ) == 0x0
 01801  1596   NtCreateEvent  ... 344, ) == 0x0
 01802  1604   NtCreateEvent  ... 348, ) == 0x0
 01803  1664   NtCreateEvent  ... 352, ) == 0x0
 01804  1564   NtOpenKey  ... 356, ) == 0x0
 01805  1572   NtCreateEvent  ... 360, ) == 0x0
 01806  1856   NtCreateEvent  ... 364, ) == 0x0
 01809  1480   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01807  1068   NtCreateEvent  ... 368, ) == 0x0
 01810   120   NtRegisterThreadTerminatePort  (24, ...
 01811   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01812   740   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01813  1240   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01814   188   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01815  1064   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01816   948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01817  1132   NtWaitForSingleObject  (340, 0, 0x0, ...
 01818  1596   NtClose  (344, ...
 01819  1604   NtClose  (348, ...
 01791  1784   NtDuplicateObject  ... 372, ) == 0x0
 01820  1796   NtTestAlert  (...
 01821  1564   NtQueryValueKey  (356,  (356, "Transports", Partial, 144, ... , Partial, 144, ...
 01822  1572   NtClose  (360, ...
 01823  1856   NtClose  (364, ...
 01824  1664   NtClose  (352, ...
 01825  1068   NtClose  (368, ...
 01810   120   NtRegisterThreadTerminatePort  ... ) == 0x0
 01811   896   NtAllocateVirtualMemory  ... 38862848, 1048576, ) == 0x0
 01812   740   NtCreateEvent  ... 376, ) == 0x0
 01813  1240   NtCreateEvent  ... 380, ) == 0x0
 01814   188   NtCreateEvent  ... 384, ) == 0x0
 01815  1064   NtCreateEvent  ... 388, ) == 0x0
 01816   948   NtCreateEvent  ... 392, ) == 0x0
 01818  1596   NtClose  ... ) == 0x0
 01819  1604   NtClose  ... ) == 0x0
 01826  1784   NtWaitForSingleObject  (340, 0, 0x0, ...
 01820  1796   NtTestAlert  ... ) == 0x0
 01821  1564   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01822  1572   NtClose  ... ) == 0x0
 01823  1856   NtClose  ... ) == 0x0
 01824  1664   NtClose  ... ) == 0x0
 01825  1068   NtClose  ... ) == 0x0
 01827   120   NtWaitForSingleObject  (340, 0, 0x0, ...
 01828   896   NtAllocateVirtualMemory  (-1, 39903232, 0, 8192, 4096, 4, ...
 01829   740   NtClose  (376, ...
 01809  1480   NtCreateEvent  ... 368, ) == 0x0
 01830  1240   NtClose  (380, ...
 01831   188   NtClose  (384, ...
 01832   948   NtClose  (392, ...
 01833  1596   NtWaitForSingleObject  (340, 0, 0x0, ...
 01834  1604   NtWaitForSingleObject  (340, 0, 0x0, ...
 01835  1796   NtContinue  (38862128, 1, ...
 01836  1564   NtQueryValueKey  (356,  (356, "Transports", Partial, 144, ... , Partial, 144, ...
 01837  1572   NtWaitForSingleObject  (340, 0, 0x0, ...
 01838  1856   NtWaitForSingleObject  (340, 0, 0x0, ...
 01839  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 01840  1068   NtWaitForSingleObject  (340, 0, 0x0, ...
 01841  1064   NtClose  (388, ...
 01828   896   NtAllocateVirtualMemory  ... 39903232, 8192, ) == 0x0
 01842  1480   NtClose  (368, ...
 01830  1240   NtClose  ... ) == 0x0
 01831   188   NtClose  ... ) == 0x0
 01829   740   NtClose  ... ) == 0x0
 01832   948   NtClose  ... ) == 0x0
 01843  1796   NtRegisterThreadTerminatePort  (24, ...
 01836  1564   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01841  1064   NtClose  ... ) == 0x0
 01844   896   NtProtectVirtualMemory  (-1, (0x260e000), 4096, 260, ...
 01842  1480   NtClose  ... ) == 0x0
 01845  1240   NtWaitForSingleObject  (340, 0, 0x0, ...
 01846   188   NtWaitForSingleObject  (340, 0, 0x0, ...
 01847   740   NtWaitForSingleObject  (340, 0, 0x0, ...
 01848   948   NtSetEventBoostPriority  (340, ...
 01843  1796   NtRegisterThreadTerminatePort  ... ) == 0x0
 01849  1564   NtClose  (356, ...
 01850  1064   NtWaitForSingleObject  (340, 0, 0x0, ...
 01844   896   NtProtectVirtualMemory  ... (0x260e000), 4096, 4, ) == 0x0
 01851  1480   NtWaitForSingleObject  (340, 0, 0x0, ...
 01817  1132   NtWaitForSingleObject  ... ) == 0x0
 01848   948   NtSetEventBoostPriority  ... ) == 0x0
 01849  1564   NtClose  ... ) == 0x0
 01852   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01853  1132   NtSetEventBoostPriority  (340, ...
 01854   948   NtWaitForSingleObject  (340, 0, 0x0, ...
 01855  1564   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01826  1784   NtWaitForSingleObject  ... ) == 0x0
 01853  1132   NtSetEventBoostPriority  ... ) == 0x0
 01852   896   NtCreateThread  ... 356, {1252, 212}, ) == 0x0
 01856  1784   NtSetEventBoostPriority  (340, ...
 01855  1564   NtOpenKey  ... 368, ) == 0x0
 01857  1796   NtWaitForSingleObject  (340, 0, 0x0, ...
 01827   120   NtWaitForSingleObject  ... ) == 0x0
 01856  1784   NtSetEventBoostPriority  ... ) == 0x0
 01858   896   NtQueryInformationThread  (356, Basic, 28, ...
 01859  1564   NtQueryValueKey  (368,  (368, "Mapping", Partial, 144, ... , Partial, 144, ...
 01860   120   NtSetEventBoostPriority  (340, ...
 01861  1132   NtWaitForSingleObject  (340, 0, 0x0, ...
 01862  1784   NtWaitForSingleObject  (340, 0, 0x0, ...
 01858   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=212,}, 0x0, ) == 0x0
 01833  1596   NtWaitForSingleObject  ... ) == 0x0
 01863   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\1\0\0\344\4\0\0\324\0\0\0" ...  ...
 01864  1596   NtSetEventBoostPriority  (340, ...
 01863   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\1\0\0\344\4\0\0\324\0\0\0" )  ) == 0x0
 01834  1604   NtWaitForSingleObject  ... ) == 0x0
 01865   896   NtResumeThread  (356, ...
 01866  1604   NtSetEventBoostPriority  (340, ...
 01865   896   NtResumeThread  ... 1, ) == 0x0
 01837  1572   NtWaitForSingleObject  ... ) == 0x0
 01866  1604   NtSetEventBoostPriority  ... ) == 0x0
 01864  1596   NtSetEventBoostPriority  ... ) == 0x0
 01860   120   NtSetEventBoostPriority  ... ) == 0x0
 01859  1564   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01867   212   NtTestAlert  (...
 01868  1572   NtSetEventBoostPriority  (340, ...
 01869  1604   NtWaitForSingleObject  (340, 0, 0x0, ...
 01870  1596   NtWaitForSingleObject  (340, 0, 0x0, ...
 01871   120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01872  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 01867   212   NtTestAlert  ... ) == 0x0
 01839  1664   NtWaitForSingleObject  ... ) == 0x0
 01871   120   NtDuplicateObject  ... 388, ) == 0x0
 01873   212   NtContinue  (39910704, 1, ...
 01874  1664   NtSetEventBoostPriority  (340, ...
 01868  1572   NtSetEventBoostPriority  ... ) == 0x0
 01875   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01876   212   NtRegisterThreadTerminatePort  (24, ...
 01838  1856   NtWaitForSingleObject  ... ) == 0x0
 01874  1664   NtSetEventBoostPriority  ... ) == 0x0
 01877  1572   NtWaitForSingleObject  (340, 0, 0x0, ...
 01875   896   NtAllocateVirtualMemory  ... 39911424, 1048576, ) == 0x0
 01878  1856   NtSetEventBoostPriority  (340, ...
 01876   212   NtRegisterThreadTerminatePort  ... ) == 0x0
 01879   120   NtWaitForSingleObject  (340, 0, 0x0, ...
 01845  1240   NtWaitForSingleObject  ... ) == 0x0
 01880   896   NtAllocateVirtualMemory  (-1, 40951808, 0, 8192, 4096, 4, ...
 01878  1856   NtSetEventBoostPriority  ... ) == 0x0
 01881  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 01882  1240   NtSetEventBoostPriority  (340, ...
 01880   896   NtAllocateVirtualMemory  ... 40951808, 8192, ) == 0x0
 01883  1856   NtWaitForSingleObject  (340, 0, 0x0, ...
 01846   188   NtWaitForSingleObject  ... ) == 0x0
 01882  1240   NtSetEventBoostPriority  ... ) == 0x0
 01884   896   NtProtectVirtualMemory  (-1, (0x270e000), 4096, 260, ...
 01885   188   NtSetEventBoostPriority  (340, ...
 01886   212   NtWaitForSingleObject  (340, 0, 0x0, ...
 01847   740   NtWaitForSingleObject  ... ) == 0x0
 01885   188   NtSetEventBoostPriority  ... ) == 0x0
 01884   896   NtProtectVirtualMemory  ... (0x270e000), 4096, 4, ) == 0x0
 01887   740   NtSetEventBoostPriority  (340, ...
 01888  1240   NtWaitForSingleObject  (172, 0, 0x0, ...
 01889   188   NtWaitForSingleObject  (172, 0, 0x0, ...
 01840  1068   NtWaitForSingleObject  ... ) == 0x0
 01887   740   NtSetEventBoostPriority  ... ) == 0x0
 01890  1068   NtSetEventBoostPriority  (340, ...
 01891   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01850  1064   NtWaitForSingleObject  ... ) == 0x0
 01891   896   NtCreateThread  ... 392, {1252, 1256}, ) == 0x0
 01892  1064   NtSetEventBoostPriority  (340, ...
 01893   896   NtQueryInformationThread  (392, Basic, 28, ...
 01851  1480   NtWaitForSingleObject  ... ) == 0x0
 01892  1064   NtSetEventBoostPriority  ... ) == 0x0
 01894  1480   NtSetEventBoostPriority  (340, ...
 01893   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=1256,}, 0x0, ) == 0x0
 01890  1068   NtSetEventBoostPriority  ... ) == 0x0
 01895   740   NtWaitForSingleObject  (340, 0, 0x0, ...
 01854   948   NtWaitForSingleObject  ... ) == 0x0
 01894  1480   NtSetEventBoostPriority  ... ) == 0x0
 01896   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\350\4\0\0" ...  ...
 01897  1068   NtWaitForSingleObject  (340, 0, 0x0, ...
 01898   948   NtSetEventBoostPriority  (340, ...
 01899  1064   NtWaitForSingleObject  (172, 0, 0x0, ...
 01857  1796   NtWaitForSingleObject  ... ) == 0x0
 01898   948   NtSetEventBoostPriority  ... ) == 0x0
 01900  1796   NtSetEventBoostPriority  (340, ...
 01901  1480   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01896   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81909, 0}  ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\350\4\0\0" )  ) == 0x0
 01861  1132   NtWaitForSingleObject  ... ) == 0x0
 01900  1796   NtSetEventBoostPriority  ... ) == 0x0
 01901  1480   NtDuplicateObject  ... 376, ) == 0x0
 01902  1132   NtSetEventBoostPriority  (340, ...
 01903   896   NtResumeThread  (392, ...
 01904  1796   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01862  1784   NtWaitForSingleObject  ... ) == 0x0
 01902  1132   NtSetEventBoostPriority  ... ) == 0x0
 01905  1480   NtWaitForSingleObject  (340, 0, 0x0, ...
 01903   896   NtResumeThread  ... 1, ) == 0x0
 01906   948   NtWaitForSingleObject  (340, 0, 0x0, ...
 01907  1784   NtSetEventBoostPriority  (340, ...
 01908  1132   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01909   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01869  1604   NtWaitForSingleObject  ... ) == 0x0
 01907  1784   NtSetEventBoostPriority  ... ) == 0x0
 01904  1796   NtDuplicateObject  ... 384, ) == 0x0
 01910  1256   NtTestAlert  (...
 01911  1604   NtSetEventBoostPriority  (340, ...
 01909   896   NtAllocateVirtualMemory  ... 40960000, 1048576, ) == 0x0
 01912  1784   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01913  1796   NtWaitForSingleObject  (340, 0, 0x0, ...
 01870  1596   NtWaitForSingleObject  ... ) == 0x0
 01911  1604   NtSetEventBoostPriority  ... ) == 0x0
 01910  1256   NtTestAlert  ... ) == 0x0
 01914   896   NtAllocateVirtualMemory  (-1, 42000384, 0, 8192, 4096, 4, ...
 01908  1132   NtCreateEvent  ... 380, ) == 0x0
 01915  1596   NtSetEventBoostPriority  (340, ...
 01912  1784   NtCreateEvent  ... 352, ) == 0x0
 01916  1256   NtContinue  (40959280, 1, ...
 01917  1604   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01872  1564   NtWaitForSingleObject  ... ) == 0x0
 01915  1596   NtSetEventBoostPriority  ... ) == 0x0
 01918  1132   NtWaitForSingleObject  (380, 0, 0x0, ...
 01919  1784   NtClose  (352, ...
 01920  1256   NtRegisterThreadTerminatePort  (24, ...
 01921  1564   NtSetEventBoostPriority  (340, ...
 01917  1604   NtCreateEvent  ... 364, ) == 0x0
 01914   896   NtAllocateVirtualMemory  ... 42000384, 8192, ) == 0x0
 01919  1784   NtClose  ... ) == 0x0
 01877  1572   NtWaitForSingleObject  ... ) == 0x0
 01921  1564   NtSetEventBoostPriority  ... ) == 0x0
 01920  1256   NtRegisterThreadTerminatePort  ... ) == 0x0
 01922  1604   NtClose  (364, ...
 01923   896   NtProtectVirtualMemory  (-1, (0x280e000), 4096, 260, ...
 01924  1572   NtSetEventBoostPriority  (340, ...
 01925  1784   NtWaitForSingleObject  (380, 0, 0x0, ...
 01926  1596   NtWaitForSingleObject  (380, 0, 0x0, ...
 01927  1564   NtQueryValueKey  (368,  (368, "Mapping", Partial, 144, ... , Partial, 144, ...
 01922  1604   NtClose  ... ) == 0x0
 01879   120   NtWaitForSingleObject  ... ) == 0x0
 01924  1572   NtSetEventBoostPriority  ... ) == 0x0
 01923   896   NtProtectVirtualMemory  ... (0x280e000), 4096, 4, ) == 0x0
 01927  1564   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01928   120   NtSetEventBoostPriority  (340, ...
 01929  1604   NtWaitForSingleObject  (380, 0, 0x0, ...
 01930  1256   NtWaitForSingleObject  (340, 0, 0x0, ...
 01931   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01881  1664   NtWaitForSingleObject  ... ) == 0x0
 01928   120   NtSetEventBoostPriority  ... ) == 0x0
 01932  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 01933  1664   NtSetEventBoostPriority  (340, ...
 01931   896   NtCreateThread  ... 364, {1252, 1536}, ) == 0x0
 01934   120   NtWaitForSingleObject  (340, 0, 0x0, ...
 01883  1856   NtWaitForSingleObject  ... ) == 0x0
 01933  1664   NtSetEventBoostPriority  ... ) == 0x0
 01935   896   NtQueryInformationThread  (364, Basic, 28, ...
 01936  1572   NtWaitForSingleObject  (380, 0, 0x0, ...
 01937  1856   NtSetEventBoostPriority  (340, ...
 01938  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 01886   212   NtWaitForSingleObject  ... ) == 0x0
 01937  1856   NtSetEventBoostPriority  ... ) == 0x0
 01935   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=1536,}, 0x0, ) == 0x0
 01939   212   NtSetEventBoostPriority  (340, ...
 01940   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\0\6\0\0" ...  ...
 01895   740   NtWaitForSingleObject  ... ) == 0x0
 01939   212   NtSetEventBoostPriority  ... ) == 0x0
 01941   740   NtSetEventBoostPriority  (340, ...
 01940   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\0\6\0\0" )  ) == 0x0
 01897  1068   NtWaitForSingleObject  ... ) == 0x0
 01941   740   NtSetEventBoostPriority  ... ) == 0x0
 01942   212   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01943  1068   NtSetEventBoostPriority  (340, ...
 01944   896   NtResumeThread  (364, ...
 01945   740   NtWaitForSingleObject  (380, 0, 0x0, ...
 01946  1856   NtWaitForSingleObject  (380, 0, 0x0, ...
 01905  1480   NtWaitForSingleObject  ... ) == 0x0
 01943  1068   NtSetEventBoostPriority  ... ) == 0x0
 01944   896   NtResumeThread  ... 1, ) == 0x0
 01942   212   NtDuplicateObject  ... 352, ) == 0x0
 01947  1480   NtSetEventBoostPriority  (340, ...
 01948  1536   NtTestAlert  (...
 01949  1068   NtWaitForSingleObject  (380, 0, 0x0, ...
 01906   948   NtWaitForSingleObject  ... ) == 0x0
 01947  1480   NtSetEventBoostPriority  ... ) == 0x0
 01950   212   NtWaitForSingleObject  (340, 0, 0x0, ...
 01948  1536   NtTestAlert  ... ) == 0x0
 01951   948   NtSetEventBoostPriority  (340, ...
 01952   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01913  1796   NtWaitForSingleObject  ... ) == 0x0
 01951   948   NtSetEventBoostPriority  ... ) == 0x0
 01953  1536   NtContinue  (42007856, 1, ...
 01954  1796   NtSetEventBoostPriority  (340, ...
 01952   896   NtAllocateVirtualMemory  ... 42008576, 1048576, ) == 0x0
 01955   948   NtSetEventBoostPriority  (380, ...
 01930  1256   NtWaitForSingleObject  ... ) == 0x0
 01954  1796   NtSetEventBoostPriority  ... ) == 0x0
 01956  1536   NtRegisterThreadTerminatePort  (24, ...
 01957   896   NtAllocateVirtualMemory  (-1, 43048960, 0, 8192, 4096, 4, ...
 01958  1480   NtWaitForSingleObject  (340, 0, 0x0, ...
 01959  1256   NtSetEventBoostPriority  (340, ...
 01918  1132   NtWaitForSingleObject  ... ) == 0x0
 01955   948   NtSetEventBoostPriority  ... ) == 0x0
 01956  1536   NtRegisterThreadTerminatePort  ... ) == 0x0
 01957   896   NtAllocateVirtualMemory  ... 43048960, 8192, ) == 0x0
 01932  1564   NtWaitForSingleObject  ... ) == 0x0
 01959  1256   NtSetEventBoostPriority  ... ) == 0x0
 01960  1132   NtWaitForSingleObject  (340, 0, 0x0, ...
 01961   948   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01962  1796   NtWaitForSingleObject  (340, 0, 0x0, ...
 01963  1564   NtSetEventBoostPriority  (340, ...
 01964   896   NtProtectVirtualMemory  (-1, (0x290e000), 4096, 260, ...
 01965  1256   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01961   948   NtWaitForSingleObject  ... ) == 0x102
 01934   120   NtWaitForSingleObject  ... ) == 0x0
 01963  1564   NtSetEventBoostPriority  ... ) == 0x0
 01964   896   NtProtectVirtualMemory  ... (0x290e000), 4096, 4, ) == 0x0
 01966  1536   NtWaitForSingleObject  (340, 0, 0x0, ...
 01967   120   NtSetEventBoostPriority  (340, ...
 01968   948   NtWaitForSingleObject  (340, 0, 0x0, ...
 01965  1256   NtDuplicateObject  ... 360, ) == 0x0
 01969  1564   NtQueryValueKey  (368,  (368, "Mapping", Partial, 152, ... , Partial, 152, ...
 01938  1664   NtWaitForSingleObject  ... ) == 0x0
 01970  1256   NtWaitForSingleObject  (340, 0, 0x0, ...
 01969  1564   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01971  1664   NtSetEventBoostPriority  (340, ...
 01972  1564   NtClose  (368, ...
 01950   212   NtWaitForSingleObject  ... ) == 0x0
 01972  1564   NtClose  ... ) == 0x0
 01973   212   NtSetEventBoostPriority  (340, ...
 01974  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 01958  1480   NtWaitForSingleObject  ... ) == 0x0
 01973   212   NtSetEventBoostPriority  ... ) == 0x0
 01975  1480   NtSetEventBoostPriority  (340, ...
 01971  1664   NtSetEventBoostPriority  ... ) == 0x0
 01967   120   NtSetEventBoostPriority  ... ) == 0x0
 01976   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01960  1132   NtWaitForSingleObject  ... ) == 0x0
 01975  1480   NtSetEventBoostPriority  ... ) == 0x0
 01977  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 01978   120   NtWaitForSingleObject  (340, 0, 0x0, ...
 01979  1132   NtSetEventBoostPriority  (340, ...
 01976   896   NtCreateThread  ... 368, {1252, 1648}, ) == 0x0
 01980  1480   NtWaitForSingleObject  (340, 0, 0x0, ...
 01962  1796   NtWaitForSingleObject  ... ) == 0x0
 01979  1132   NtSetEventBoostPriority  ... ) == 0x0
 01981   896   NtQueryInformationThread  (368, Basic, 28, ...
 01982   212   NtWaitForSingleObject  (340, 0, 0x0, ...
 01983  1796   NtSetEventBoostPriority  (340, ...
 01981   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1648,}, 0x0, ) == 0x0
 01966  1536   NtWaitForSingleObject  ... ) == 0x0
 01983  1796   NtSetEventBoostPriority  ... ) == 0x0
 01984  1536   NtSetEventBoostPriority  (340, ...
 01985   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0p\6\0\0" ...  ...
 01968   948   NtWaitForSingleObject  ... ) == 0x0
 01984  1536   NtSetEventBoostPriority  ... ) == 0x0
 01986  1796   NtWaitForSingleObject  (340, 0, 0x0, ...
 01987   948   NtSetEventBoostPriority  (340, ...
 01988  1536   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01989  1132   NtSetEventBoostPriority  (380, ...
 01985   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81911, 0}  ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0p\6\0\0" )  ) == 0x0
 01970  1256   NtWaitForSingleObject  ... ) == 0x0
 01987   948   NtSetEventBoostPriority  ... ) == 0x0
 01925  1784   NtWaitForSingleObject  ... ) == 0x0
 01989  1132   NtSetEventBoostPriority  ... ) == 0x0
 01990  1256   NtSetEventBoostPriority  (340, ...
 01991   896   NtResumeThread  (368, ...
 01988  1536   NtDuplicateObject  ... 348, ) == 0x0
 01992  1784   NtSetEventBoostPriority  (380, ...
 01974  1564   NtWaitForSingleObject  ... ) == 0x0
 01990  1256   NtSetEventBoostPriority  ... ) == 0x0
 01993  1132   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01991   896   NtResumeThread  ... 1, ) == 0x0
 01926  1596   NtWaitForSingleObject  ... ) == 0x0
 01994  1564   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01992  1784   NtSetEventBoostPriority  ... ) == 0x0
 01995  1536   NtWaitForSingleObject  (340, 0, 0x0, ...
 01996   948   NtWaitForSingleObject  (172, 0, 0x0, ...
 01997  1648   NtTestAlert  (...
 01993  1132   NtWaitForSingleObject  ... ) == 0x102
 01998  1596   NtWaitForSingleObject  (340, 0, 0x0, ...
 01994  1564   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01999   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02000  1256   NtWaitForSingleObject  (340, 0, 0x0, ...
 01997  1648   NtTestAlert  ... ) == 0x0
 02001  1132   NtWaitForSingleObject  (340, 0, 0x0, ...
 02002  1784   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01999   896   NtAllocateVirtualMemory  ... 43057152, 1048576, ) == 0x0
 02003  1648   NtContinue  (43056432, 1, ...
 02004  1564   NtSetEventBoostPriority  (340, ...
 02002  1784   NtWaitForSingleObject  ... ) == 0x102
 02005   896   NtAllocateVirtualMemory  (-1, 44097536, 0, 8192, 4096, 4, ...
 02006  1648   NtRegisterThreadTerminatePort  (24, ...
 01977  1664   NtWaitForSingleObject  ... ) == 0x0
 02004  1564   NtSetEventBoostPriority  ... ) == 0x0
 02007  1784   NtWaitForSingleObject  (340, 0, 0x0, ...
 02008  1664   NtSetEventBoostPriority  (340, ...
 02006  1648   NtRegisterThreadTerminatePort  ... ) == 0x0
 02009  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 01978   120   NtWaitForSingleObject  ... ) == 0x0
 02008  1664   NtSetEventBoostPriority  ... ) == 0x0
 02005   896   NtAllocateVirtualMemory  ... 44097536, 8192, ) == 0x0
 02010   120   NtSetEventBoostPriority  (340, ...
 02011  1648   NtWaitForSingleObject  (340, 0, 0x0, ...
 01980  1480   NtWaitForSingleObject  ... ) == 0x0
 02010   120   NtSetEventBoostPriority  ... ) == 0x0
 02012   896   NtProtectVirtualMemory  (-1, (0x2a0e000), 4096, 260, ...
 02013  1480   NtSetEventBoostPriority  (340, ...
 02014  1664   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01982   212   NtWaitForSingleObject  ... ) == 0x0
 02012   896   NtProtectVirtualMemory  ... (0x2a0e000), 4096, 4, ) == 0x0
 02014  1664   NtCreateEvent  ... 344, ) == 0x0
 02015   212   NtSetEventBoostPriority  (340, ...
 02016   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02017  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01986  1796   NtWaitForSingleObject  ... ) == 0x0
 02015   212   NtSetEventBoostPriority  ... ) == 0x0
 02016   896   NtCreateThread  ... 396, {1252, 1688}, ) == 0x0
 02018  1796   NtSetEventBoostPriority  (340, ...
 02017  1664   NtDuplicateObject  ... 400, ) == 0x0
 02019   212   NtWaitForSingleObject  (380, 0, 0x0, ...
 01995  1536   NtWaitForSingleObject  ... ) == 0x0
 02020   896   NtQueryInformationThread  (396, Basic, 28, ...
 02021  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02018  1796   NtSetEventBoostPriority  ... ) == 0x0
 02013  1480   NtSetEventBoostPriority  ... ) == 0x0
 02022   120   NtWaitForSingleObject  (380, 0, 0x0, ...
 02023  1536   NtSetEventBoostPriority  (340, ...
 02024  1796   NtWaitForSingleObject  (380, 0, 0x0, ...
 02025  1480   NtWaitForSingleObject  (380, 0, 0x0, ...
 01998  1596   NtWaitForSingleObject  ... ) == 0x0
 02023  1536   NtSetEventBoostPriority  ... ) == 0x0
 02026  1596   NtSetEventBoostPriority  (340, ...
 02020   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1688,}, 0x0, ) == 0x0
 02000  1256   NtWaitForSingleObject  ... ) == 0x0
 02026  1596   NtSetEventBoostPriority  ... ) == 0x0
 02027  1256   NtSetEventBoostPriority  (340, ...
 02028   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\230\6\0\0" ...  ...
 02029  1536   NtWaitForSingleObject  (340, 0, 0x0, ...
 02001  1132   NtWaitForSingleObject  ... ) == 0x0
 02027  1256   NtSetEventBoostPriority  ... ) == 0x0
 02028   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81912, 0}  ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\230\6\0\0" )  ) == 0x0
 02030  1132   NtSetEventBoostPriority  (340, ...
 02031  1256   NtWaitForSingleObject  (340, 0, 0x0, ...
 02007  1784   NtWaitForSingleObject  ... ) == 0x0
 02032   896   NtResumeThread  (396, ...
 02030  1132   NtSetEventBoostPriority  ... ) == 0x0
 02033  1596   NtSetEventBoostPriority  (380, ...
 02034  1784   NtSetEventBoostPriority  (340, ...
 02032   896   NtResumeThread  ... 1, ) == 0x0
 02035  1132   NtWaitForSingleObject  (172, 0, 0x0, ...
 01929  1604   NtWaitForSingleObject  ... ) == 0x0
 02033  1596   NtSetEventBoostPriority  ... ) == 0x0
 02009  1564   NtWaitForSingleObject  ... ) == 0x0
 02034  1784   NtSetEventBoostPriority  ... ) == 0x0
 02036  1688   NtTestAlert  (...
 02037  1604   NtWaitForSingleObject  (340, 0, 0x0, ...
 02038  1564   NtSetEventBoostPriority  (340, ...
 02039  1596   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02040   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02011  1648   NtWaitForSingleObject  ... ) == 0x0
 02038  1564   NtSetEventBoostPriority  ... ) == 0x0
 02036  1688   NtTestAlert  ... ) == 0x0
 02039  1596   NtWaitForSingleObject  ... ) == 0x102
 02041  1648   NtSetEventBoostPriority  (340, ...
 02040   896   NtAllocateVirtualMemory  ... 44105728, 1048576, ) == 0x0
 02042  1784   NtWaitForSingleObject  (172, 0, 0x0, ...
 02043  1688   NtContinue  (44105008, 1, ...
 02021  1664   NtWaitForSingleObject  ... ) == 0x0
 02041  1648   NtSetEventBoostPriority  ... ) == 0x0
 02044  1596   NtWaitForSingleObject  (172, 0, 0x0, ...
 02045   896   NtAllocateVirtualMemory  (-1, 45146112, 0, 8192, 4096, 4, ...
 02046  1664   NtSetEventBoostPriority  (340, ...
 02047  1688   NtRegisterThreadTerminatePort  (24, ...
 02048  1648   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02049  1564   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 02029  1536   NtWaitForSingleObject  ... ) == 0x0
 02046  1664   NtSetEventBoostPriority  ... ) == 0x0
 02045   896   NtAllocateVirtualMemory  ... 45146112, 8192, ) == 0x0
 02047  1688   NtRegisterThreadTerminatePort  ... ) == 0x0
 02050  1536   NtSetEventBoostPriority  (340, ...
 02049  1564   NtOpenKey  ... 404, ) == 0x0
 02048  1648   NtDuplicateObject  ... 408, ) == 0x0
 02051   896   NtProtectVirtualMemory  (-1, (0x2b0e000), 4096, 260, ...
 02052  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02031  1256   NtWaitForSingleObject  ... ) == 0x0
 02050  1536   NtSetEventBoostPriority  ... ) == 0x0
 02053  1564   NtQueryValueKey  (404,  (404, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 02054  1648   NtWaitForSingleObject  (340, 0, 0x0, ...
 02051   896   NtProtectVirtualMemory  ... (0x2b0e000), 4096, 4, ) == 0x0
 02055  1256   NtSetEventBoostPriority  (340, ...
 02056  1536   NtWaitForSingleObject  (380, 0, 0x0, ...
 02053  1564   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02057  1688   NtWaitForSingleObject  (340, 0, 0x0, ...
 02037  1604   NtWaitForSingleObject  ... ) == 0x0
 02055  1256   NtSetEventBoostPriority  ... ) == 0x0
 02058   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02059  1564   NtQueryValueKey  (404,  (404, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 02060  1604   NtSetEventBoostPriority  (340, ...
 02061  1256   NtWaitForSingleObject  (380, 0, 0x0, ...
 02058   896   NtCreateThread  ... 412, {1252, 1944}, ) == 0x0
 02052  1664   NtWaitForSingleObject  ... ) == 0x0
 02060  1604   NtSetEventBoostPriority  ... ) == 0x0
 02059  1564   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02062  1664   NtSetEventBoostPriority  (340, ...
 02063   896   NtQueryInformationThread  (412, Basic, 28, ...
 02064  1604   NtSetEventBoostPriority  (380, ...
 02054  1648   NtWaitForSingleObject  ... ) == 0x0
 02062  1664   NtSetEventBoostPriority  ... ) == 0x0
 02063   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1944,}, 0x0, ) == 0x0
 02065  1648   NtSetEventBoostPriority  (340, ...
 01936  1572   NtWaitForSingleObject  ... ) == 0x0
 02064  1604   NtSetEventBoostPriority  ... ) == 0x0
 02066  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02057  1688   NtWaitForSingleObject  ... ) == 0x0
 02067  1572   NtWaitForSingleObject  (340, 0, 0x0, ...
 02065  1648   NtSetEventBoostPriority  ... ) == 0x0
 02068   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\230\7\0\0" ...  ...
 02069  1604   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02070  1564   NtQueryValueKey  (404,  (404, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 02071  1688   NtSetEventBoostPriority  (340, ...
 02069  1604   NtWaitForSingleObject  ... ) == 0x102
 02067  1572   NtWaitForSingleObject  ... ) == 0x0
 02071  1688   NtSetEventBoostPriority  ... ) == 0x0
 02070  1564   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02072  1572   NtSetEventBoostPriority  (340, ...
 02073  1604   NtWaitForSingleObject  (340, 0, 0x0, ...
 02074  1688   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02066  1664   NtWaitForSingleObject  ... ) == 0x0
 02072  1572   NtSetEventBoostPriority  ... ) == 0x0
 02075  1564   NtQueryValueKey  (404,  (404, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 02076  1648   NtWaitForSingleObject  (340, 0, 0x0, ...
 02068   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\230\7\0\0" )  ) == 0x0
 02077  1664   NtSetEventBoostPriority  (340, ...
 02074  1688   NtDuplicateObject  ... 416, ) == 0x0
 02075  1564   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 02073  1604   NtWaitForSingleObject  ... ) == 0x0
 02078   896   NtResumeThread  (412, ...
 02079  1688   NtWaitForSingleObject  (340, 0, 0x0, ...
 02080  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11596844, ... }, 11596844, ...
 02081  1604   NtSetEventBoostPriority  (340, ...
 02078   896   NtResumeThread  ... 1, ) == 0x0
 02080  1564   NtQueryAttributesFile  ... ) == 0x0
 02076  1648   NtWaitForSingleObject  ... ) == 0x0
 02082   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02081  1604   NtSetEventBoostPriority  ... ) == 0x0
 02077  1664   NtSetEventBoostPriority  ... ) == 0x0
 02083  1572   NtSetEventBoostPriority  (380, ...
 02084  1944   NtWaitForSingleObject  (128, 0, 0x0, ...
 02085  1648   NtSetEventBoostPriority  (340, ...
 02082   896   NtAllocateVirtualMemory  ... 45154304, 1048576, ) == 0x0
 02086  1604   NtWaitForSingleObject  (172, 0, 0x0, ...
 02087  1664   NtWaitForSingleObject  (380, 0, 0x0, ...
 01946  1856   NtWaitForSingleObject  ... ) == 0x0
 02083  1572   NtSetEventBoostPriority  ... ) == 0x0
 02079  1688   NtWaitForSingleObject  ... ) == 0x0
 02085  1648   NtSetEventBoostPriority  ... ) == 0x0
 02088   896   NtAllocateVirtualMemory  (-1, 46194688, 0, 8192, 4096, 4, ...
 02089  1856   NtWaitForSingleObject  (340, 0, 0x0, ...
 02090  1688   NtSetEventBoostPriority  (340, ...
 02091  1572   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02092  1648   NtWaitForSingleObject  (380, 0, 0x0, ...
 02093  1564   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 02089  1856   NtWaitForSingleObject  ... ) == 0x0
 02090  1688   NtSetEventBoostPriority  ... ) == 0x0
 02091  1572   NtWaitForSingleObject  ... ) == 0x102
 02088   896   NtAllocateVirtualMemory  ... 46194688, 8192, ) == 0x0
 02094  1856   NtSetEventBoostPriority  (380, ...
 02093  1564   NtOpenFile  ... 420, {status=0x0, info=1}, ) == 0x0
 02095  1572   NtWaitForSingleObject  (172, 0, 0x0, ...
 01945   740   NtWaitForSingleObject  ... ) == 0x0
 02094  1856   NtSetEventBoostPriority  ... ) == 0x0
 02096   896   NtProtectVirtualMemory  (-1, (0x2c0e000), 4096, 260, ...
 02097  1564   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 420, ...
 02098  1688   NtWaitForSingleObject  (380, 0, 0x0, ...
 02099   740   NtSetEventBoostPriority  (380, ...
 02096   896   NtProtectVirtualMemory  ... (0x2c0e000), 4096, 4, ) == 0x0
 02097  1564   NtCreateSection  ... 424, ) == 0x0
 01949  1068   NtWaitForSingleObject  ... ) == 0x0
 02100   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02101  1564   NtClose  (420, ...
 02102  1068   NtSetEventBoostPriority  (380, ...
 02100   896   NtCreateThread  ... 428, {1252, 240}, ) == 0x0
 02101  1564   NtClose  ... ) == 0x0
 02019   212   NtWaitForSingleObject  ... ) == 0x0
 02102  1068   NtSetEventBoostPriority  ... ) == 0x0
 02103   896   NtQueryInformationThread  (428, Basic, 28, ...
 02099   740   NtSetEventBoostPriority  ... ) == 0x0
 02104  1856   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02105   212   NtSetEventBoostPriority  (380, ...
 02106  1068   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02107  1564   NtMapViewOfSection  (424, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02108   740   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02022   120   NtWaitForSingleObject  ... ) == 0x0
 02104  1856   NtWaitForSingleObject  ... ) == 0x102
 02105   212   NtSetEventBoostPriority  ... ) == 0x0
 02103   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=240,}, 0x0, ) == 0x0
 02107  1564   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 02109   120   NtSetEventBoostPriority  (380, ...
 02110  1856   NtWaitForSingleObject  (172, 0, 0x0, ...
 02111   212   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02112   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0\360\0\0\0" ...  ...
 02113  1564   NtClose  (424, ...
 02024  1796   NtWaitForSingleObject  ... ) == 0x0
 02109   120   NtSetEventBoostPriority  ... ) == 0x0
 02112   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81914, 0}  ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0\360\0\0\0" )  ) == 0x0
 02114  1796   NtSetEventBoostPriority  (380, ...
 02113  1564   NtClose  ... ) == 0x0
 02115   120   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02025  1480   NtWaitForSingleObject  ... ) == 0x0
 02114  1796   NtSetEventBoostPriority  ... ) == 0x0
 02116   896   NtResumeThread  (428, ...
 02106  1068   NtWaitForSingleObject  ... ) == 0x102
 02108   740   NtWaitForSingleObject  ... ) == 0x102
 02111   212   NtWaitForSingleObject  ... ) == 0x102
 02117  1480   NtSetEventBoostPriority  (380, ...
 02115   120   NtWaitForSingleObject  ... ) == 0x102
 02116   896   NtResumeThread  ... 1, ) == 0x0
 02118  1068   NtWaitForSingleObject  (172, 0, 0x0, ...
 02119   740   NtWaitForSingleObject  (172, 0, 0x0, ...
 02061  1256   NtWaitForSingleObject  ... ) == 0x0
 02117  1480   NtSetEventBoostPriority  ... ) == 0x0
 02120   212   NtWaitForSingleObject  (172, 0, 0x0, ...
 02121   120   NtWaitForSingleObject  (172, 0, 0x0, ...
 02122  1796   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02123  1564   NtUnmapViewOfSection  (-1, 0x360000, ...
 02124   240   NtWaitForSingleObject  (128, 0, 0x0, ...
 02125  1256   NtSetEventBoostPriority  (380, ...
 02126   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02122  1796   NtWaitForSingleObject  ... ) == 0x102
 02123  1564   NtUnmapViewOfSection  ... ) == 0x0
 02056  1536   NtWaitForSingleObject  ... ) == 0x0
 02125  1256   NtSetEventBoostPriority  ... ) == 0x0
 02126   896   NtAllocateVirtualMemory  ... 46202880, 1048576, ) == 0x0
 02127  1796   NtWaitForSingleObject  (172, 0, 0x0, ...
 02128  1536   NtSetEventBoostPriority  (380, ...
 02129  1564   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11597152, ... }, 11597152, ...
 02130  1480   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02131   896   NtAllocateVirtualMemory  (-1, 47243264, 0, 8192, 4096, 4, ...
 02087  1664   NtWaitForSingleObject  ... ) == 0x0
 02129  1564   NtQueryAttributesFile  ... ) == 0x0
 02130  1480   NtWaitForSingleObject  ... ) == 0x102
 02131   896   NtAllocateVirtualMemory  ... 47243264, 8192, ) == 0x0
 02132  1664   NtSetEventBoostPriority  (380, ...
 02133  1564   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 02134  1480   NtWaitForSingleObject  (172, 0, 0x0, ...
 02135   896   NtProtectVirtualMemory  (-1, (0x2d0e000), 4096, 260, ...
 02092  1648   NtWaitForSingleObject  ... ) == 0x0
 02132  1664   NtSetEventBoostPriority  ... ) == 0x0
 02128  1536   NtSetEventBoostPriority  ... ) == 0x0
 02136  1256   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02137  1648   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 02135   896   NtProtectVirtualMemory  ... (0x2d0e000), 4096, 4, ) == 0x0
 02133  1564   NtOpenFile  ... 424, {status=0x0, info=1}, ) == 0x0
 02138  1536   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02137  1648   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 02136  1256   NtWaitForSingleObject  ... ) == 0x102
 02139  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02140  1564   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 424, ...
 02141  1648   NtSetEventBoostPriority  (340, ...
 02142  1256   NtWaitForSingleObject  (340, 0, 0x0, ...
 02139  1664   NtWaitForSingleObject  ... ) == 0x0
 02140  1564   NtCreateSection  ... 420, ) == 0x0
 02143  1664   NtSetEventBoostPriority  (340, ...
 02144  1564   NtQuerySection  (420, Image, 48, ...
 02142  1256   NtWaitForSingleObject  ... ) == 0x0
 02143  1664   NtSetEventBoostPriority  ... ) == 0x0
 02145  1256   NtWaitForSingleObject  (172, 0, 0x0, ...
 02144  1564   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02146  1664   NtWaitForSingleObject  (380, 0, 0x0, ...
 02147  1564   NtClose  (424, ...
 02141  1648   NtSetEventBoostPriority  ... ) == 0x0
 02148   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02138  1536   NtWaitForSingleObject  ... ) == 0x102
 02147  1564   NtClose  ... ) == 0x0
 02148   896   NtCreateThread  ... 424, {1252, 496}, ) == 0x0
 02149  1536   NtWaitForSingleObject  (172, 0, 0x0, ...
 02150  1564   NtMapViewOfSection  (420, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02151   896   NtQueryInformationThread  (424, Basic, 28, ...
 02150  1564   NtMapViewOfSection  ... (0x71a90000), 0x0, 32768, ) == 0x0
 02151   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=496,}, 0x0, ) == 0x0
 02152  1564   NtClose  (420, ...
 02153   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\360\1\0\0" ...  ...
 02152  1564   NtClose  ... ) == 0x0
 02154  1564   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ... (0x71a91000), 4096, 32, ) == 0x0
 02155  1564   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 02156  1564   NtFlushInstructionCache  (-1, 1906905088, 128, ...
 02157  1648   NtSetEventBoostPriority  (380, ...
 02153   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81915, 0}  ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\360\1\0\0" )  ) == 0x0
 02098  1688   NtWaitForSingleObject  ... ) == 0x0
 02157  1648   NtSetEventBoostPriority  ... ) == 0x0
 02158  1688   NtSetEventBoostPriority  (380, ...
 02159   896   NtResumeThread  (424, ...
 02146  1664   NtWaitForSingleObject  ... ) == 0x0
 02158  1688   NtSetEventBoostPriority  ... ) == 0x0
 02160  1648   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02161  1664   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 02159   896   NtResumeThread  ... 1, ) == 0x0
 02162  1688   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02161  1664   NtOpenFile  ... 420, {status=0x0, info=0}, ) == 0x0
 02160  1648   NtWaitForSingleObject  ... ) == 0x102
 02163   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02156  1564   NtFlushInstructionCache  ... ) == 0x0
 02164   496   NtWaitForSingleObject  (128, 0, 0x0, ...
 02165  1664   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"W\333\307c;\220\251k\245\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... W\333\307c;\220\251k\245\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02166  1648   NtWaitForSingleObject  (172, 0, 0x0, ...
 02163   896   NtAllocateVirtualMemory  ... 47251456, 1048576, ) == 0x0
 02167  1564   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... }, ...
 02168  1664   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02162  1688   NtWaitForSingleObject  ... ) == 0x102
 02169   896   NtAllocateVirtualMemory  (-1, 48291840, 0, 8192, 4096, 4, ...
 02167  1564   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02170  1688   NtWaitForSingleObject  (172, 0, 0x0, ...
 02168  1664   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02171  1564   NtSetEventBoostPriority  (128, ...
 02172  1664   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02169   896   NtAllocateVirtualMemory  ... 48291840, 8192, ) == 0x0
 02172  1664   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02173   896   NtProtectVirtualMemory  (-1, (0x2e0e000), 4096, 260, ...
 02174  1664   NtQuerySystemInformation  (Performance, 312, ...
 02173   896   NtProtectVirtualMemory  ... (0x2e0e000), 4096, 4, ) == 0x0
 02174  1664   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02175   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02176  1664   NtQuerySystemInformation  (Exception, 16, ...
 02175   896   NtCreateThread  ... 432, {1252, 1744}, ) == 0x0
 02084  1944   NtWaitForSingleObject  ... ) == 0x0
 02171  1564   NtSetEventBoostPriority  ... ) == 0x0
 02177   896   NtQueryInformationThread  (432, Basic, 28, ...
 02178  1944   NtSetEventBoostPriority  (128, ...
 02179  1564   NtClose  (404, ...
 02176  1664   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02124   240   NtWaitForSingleObject  ... ) == 0x0
 02178  1944   NtSetEventBoostPriority  ... ) == 0x0
 02179  1564   NtClose  ... ) == 0x0
 02180   240   NtSetEventBoostPriority  (128, ...
 02181  1664   NtQuerySystemInformation  (Lookaside, 32, ...
 02177   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=1744,}, 0x0, ) == 0x0
 02164   496   NtWaitForSingleObject  ... ) == 0x0
 02180   240   NtSetEventBoostPriority  ... ) == 0x0
 02182  1564   NtWaitForSingleObject  (128, 0, 0x0, ...
 02181  1664   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02183   496   NtSetEventBoostPriority  (128, ...
 02184   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\320\6\0\0" ...  ...
 02185  1944   NtTestAlert  (...
 02182  1564   NtWaitForSingleObject  ... ) == 0x0
 02183   496   NtSetEventBoostPriority  ... ) == 0x0
 02186  1664   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02184   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\320\6\0\0" )  ) == 0x0
 02187  1564   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11599488, 67, ... }, 0x0, 0, 3, 3, 0, 11599488, 67, ...
 02185  1944   NtTestAlert  ... ) == 0x0
 02188   240   NtTestAlert  (...
 02186  1664   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02187  1564   NtCreateFile  ... 404, {status=0x0, info=0}, ) == 0x0
 02189   896   NtResumeThread  (432, ...
 02190  1944   NtContinue  (45153584, 1, ...
 02188   240   NtTestAlert  ... ) == 0x0
 02191  1664   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02192   496   NtTestAlert  (...
 02189   896   NtResumeThread  ... 1, ) == 0x0
 02193  1944   NtRegisterThreadTerminatePort  (24, ...
 02194   240   NtContinue  (46202160, 1, ...
 02195  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x1207b,  (404, 148, 0x0, 0x0, 0x1207b, "\7\0\0\0\250q\250q%\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 02196  1744   NtTestAlert  (...
 02192   496   NtTestAlert  ... ) == 0x0
 02191  1664   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02193  1944   NtRegisterThreadTerminatePort  ... ) == 0x0
 02197   240   NtRegisterThreadTerminatePort  (24, ...
 02195  1564   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 02196  1744   NtTestAlert  ... ) == 0x0
 02198   496   NtContinue  (47250736, 1, ...
 02199  1664   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02200  1944   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02197   240   NtRegisterThreadTerminatePort  ... ) == 0x0
 02201  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x1207b,  (404, 148, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", 16, 16, ... , 16, 16, ...
 02202  1744   NtContinue  (48299312, 1, ...
 02203   496   NtRegisterThreadTerminatePort  (24, ...
 02199  1664   NtCreateKey  ... -2147482756, 2, ) == 0x0
 02204   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02205   240   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02201  1564   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 02206  1744   NtRegisterThreadTerminatePort  (24, ...
 02203   496   NtRegisterThreadTerminatePort  ... ) == 0x0
 02207  1664   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\25\231u\221qR\32\223\224w\203P\324J\310\340\375\336w\364\261\247TWn\212\342\4\377\266W\236\347\34\33\271\274vr\205\354.=\21\317\306Y\210\246\324;q$y\tx\303\332\222\254\367\310\257\+\24\272DK\\234Z\332\363m\36\3742G", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "\25\231u\221qR\32\223\224w\203P\324J\310\340\375\336w\364\261\247TWn\212\342\4\377\266W\236\347\34\33\271\274vr\205\354.=\21\317\306Y\210\246\324;q$y\tx\303\332\222\254\367\310\257\+\24\272DK\\234Z\332\363m\36\3742G", 80, ... , 80, ...
 02204   896   NtAllocateVirtualMemory  ... 48300032, 1048576, ) == 0x0
 02200  1944   NtDuplicateObject  ... 436, ) == 0x0
 02208  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x12047,  (404, 148, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\224\375\260\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 02206  1744   NtRegisterThreadTerminatePort  ... ) == 0x0
 02209   496   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 02207  1664   NtSetValueKey  ... ) == 0x0
 02210   896   NtAllocateVirtualMemory  (-1, 49340416, 0, 8192, 4096, 4, ...
 02211  1944   NtWaitForSingleObject  (340, 0, 0x0, ...
 02208  1564   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 02205   240   NtDuplicateObject  ... 440, ) == 0x0
 02212  1744   NtWaitForSingleObject  (340, 0, 0x0, ...
 02213  1664   NtClose  (-2147482756, ...
 02210   896   NtAllocateVirtualMemory  ... 49340416, 8192, ) == 0x0
 02209   496   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 02214   240   NtWaitForSingleObject  (340, 0, 0x0, ...
 02215  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 02216   896   NtProtectVirtualMemory  (-1, (0x2f0e000), 4096, 260, ...
 02217   496   NtSetEventBoostPriority  (340, ...
 02216   896   NtProtectVirtualMemory  ... (0x2f0e000), 4096, 4, ) == 0x0
 02211  1944   NtWaitForSingleObject  ... ) == 0x0
 02217   496   NtSetEventBoostPriority  ... ) == 0x0
 02213  1664   NtClose  ... ) == 0x0
 02218  1944   NtSetEventBoostPriority  (340, ...
 02219   496   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02212  1744   NtWaitForSingleObject  ... ) == 0x0
 02218  1944   NtSetEventBoostPriority  ... ) == 0x0
 02165  1664   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\341x\34\36\206\14n~g\371\4\371\370\340\3473\37\214\266\236\216@_\301\72l\15\260\366\276\325}\253\275\324\255\37t\273\373\2546fOu\366\217~\342\235\206F\5)x\214U\15\211\357Eu/n\305\373\344\1\357;\247\215.1\6\201\306!\301d\320\201`\317[Y\15q\212\370\317\351\307:\20\322P\251|_\3038\302\203\344z\244\331\271\310\212\206M\15\313\253\226p\4\374\2035\24U\362Ket\226\236\257,\365\6FGZH~|\301\330\360\320\346\364\215\177\331\317\233\251\316\315\325\371\20)C\217\27\17+=N\312\32:d[\344\242> \10f=\335\267\23t\360\333\2503u\17\33\255\1H\266*u\310\324", ) \315\325\371\20)C\217\27\17+=N\312\32:d[\344\242> \10f=\335\267\23t\360\333\2503u\17\33\255\1H\266*u\310\324", ) == 0x0
 02220  1744   NtSetEventBoostPriority  (340, ...
 02219   496   NtDuplicateObject  ... 444, ) == 0x0
 02221   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02214   240   NtWaitForSingleObject  ... ) == 0x0
 02220  1744   NtSetEventBoostPriority  ... ) == 0x0
 02222  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02223   496   NtWaitForSingleObject  (340, 0, 0x0, ...
 02224   240   NtSetEventBoostPriority  (340, ...
 02221   896   NtCreateThread  ... 448, {1252, 1128}, ) == 0x0
 02225  1744   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02226  1944   NtWaitForSingleObject  (340, 0, 0x0, ...
 02215  1564   NtWaitForSingleObject  ... ) == 0x0
 02224   240   NtSetEventBoostPriority  ... ) == 0x0
 02227   896   NtQueryInformationThread  (448, Basic, 28, ...
 02228  1564   NtSetEventBoostPriority  (340, ...
 02225  1744   NtDuplicateObject  ... 452, ) == 0x0
 02222  1664   NtWaitForSingleObject  ... ) == 0x0
 02228  1564   NtSetEventBoostPriority  ... ) == 0x0
 02227   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=1128,}, 0x0, ) == 0x0
 02229  1664   NtSetEventBoostPriority  (340, ...
 02230  1744   NtWaitForSingleObject  (340, 0, 0x0, ...
 02231  1564   NtWaitForSingleObject  (96, 0, {0, 0}, ...
 02223   496   NtWaitForSingleObject  ... ) == 0x0
 02229  1664   NtSetEventBoostPriority  ... ) == 0x0
 02232   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0h\4\0\0" ...  ...
 02233   240   NtWaitForSingleObject  (340, 0, 0x0, ...
 02234   496   NtSetEventBoostPriority  (340, ...
 02231  1564   NtWaitForSingleObject  ... ) == 0x102
 02226  1944   NtWaitForSingleObject  ... ) == 0x0
 02235  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 02236  1944   NtSetEventBoostPriority  (340, ...
 02230  1744   NtWaitForSingleObject  ... ) == 0x0
 02237  1744   NtSetEventBoostPriority  (340, ...
 02233   240   NtWaitForSingleObject  ... ) == 0x0
 02238   240   NtSetEventBoostPriority  (340, ...
 02235  1564   NtWaitForSingleObject  ... ) == 0x0
 02239  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x12003,  (404, 148, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 02238   240   NtSetEventBoostPriority  ... ) == 0x0
 02240   240   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02237  1744   NtSetEventBoostPriority  ... ) == 0x0
 02236  1944   NtSetEventBoostPriority  ... ) == 0x0
 02234   496   NtSetEventBoostPriority  ... ) == 0x0
 02241  1664   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02232   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81917, 0}  ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0h\4\0\0" )  ) == 0x0
 02239  1564   NtDeviceIoControlFile  ... {status=0x0, info=456},  ... {status=0x0, info=456}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02240   240   NtWaitForSingleObject  ... ) == 0x102
 02242  1944   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02243   496   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02241  1664   NtCreateEvent  ... 460, ) == 0x0
 02244   896   NtResumeThread  (448, ...
 02245  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x12047,  (404, 148, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02246   240   NtWaitForSingleObject  (172, 0, 0x0, ...
 02247  1744   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02248  1664   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 16838148, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 16838148, 188, ...
 02244   896   NtResumeThread  ... 1, ) == 0x0
 02245  1564   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02247  1744   NtWaitForSingleObject  ... ) == 0x102
 02249   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02250  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x12037,  (404, 148, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 02251  1744   NtWaitForSingleObject  (172, 0, 0x0, ...
 02249   896   NtAllocateVirtualMemory  ... 49348608, 1048576, ) == 0x0
 02250  1564   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02252   896   NtAllocateVirtualMemory  (-1, 50388992, 0, 8192, 4096, 4, ...
 02242  1944   NtWaitForSingleObject  ... ) == 0x102
 02243   496   NtWaitForSingleObject  ... ) == 0x102
 02253  1128   NtTestAlert  (...
 02248  1664   NtConnectPort  ... 464, 0x0, 0x0, 0x0, 188, ) == 0x0
 02254  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x1200b,  (404, 148, 0x0, 0x0, 0x1200b, "\0\376\260\0\5\0\0\0\0\320\24\0", 12, 0, ... , 12, 0, ...
 02255  1944   NtWaitForSingleObject  (172, 0, 0x0, ...
 02256   496   NtWaitForSingleObject  (172, 0, 0x0, ...
 02253  1128   NtTestAlert  ... ) == 0x0
 02257  1664   NtRequestWaitReplyPort  (464, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721}  (464, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\02\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\233>\254\24636\261\362\2507\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\2007\25\0}\367\375\33x\1\24\0\2407\25\0h\1\24\0\0\0\0\0\0\0\0\0\2407\25\0P\0\0\0\2507\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\0\1\372\31\221|\30\364\0\1\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02254  1564   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02258  1128   NtContinue  (49347888, 1, ...
 02252   896   NtAllocateVirtualMemory  ... 50388992, 8192, ) == 0x0
 02259  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x12047,  (404, 148, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\260\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02260  1128   NtRegisterThreadTerminatePort  (24, ...
 02261   896   NtProtectVirtualMemory  (-1, (0x300e000), 4096, 260, ...
 02259  1564   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02260  1128   NtRegisterThreadTerminatePort  ... ) == 0x0
 02261   896   NtProtectVirtualMemory  ... (0x300e000), 4096, 4, ) == 0x0
 02262  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 02257  1664   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1664, 81919, 0}  ... {200, 224, reply, 0, 1252, 1664, 81919, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\233>\254\24636\261\362\2507\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\2007\25\0}\367\375\33x\1\24\0\2407\25\0h\1\24\0\0\0\0\0\0\0\0\0\2407\25\0P\0\0\0\2507\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\0\1\372\31\221|\30\364\0\1\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02263   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02262  1564   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02264  1664   NtRequestWaitReplyPort  (464, {64, 88, new_msg, 0, 0, 0, 0, 0}  (464, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 02263   896   NtCreateThread  ... 468, {1252, 768}, ) == 0x0
 02265  1128   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02266   896   NtQueryInformationThread  (468, Basic, 28, ...
 02265  1128   NtDuplicateObject  ... 472, ) == 0x0
 02264  1664   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 1664, 81920, 0}  ... {52, 76, reply, 0, 1252, 1664, 81920, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 02267  1564   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 02268  1128   NtWaitForSingleObject  (340, 0, 0x0, ...
 02269  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02267  1564   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 02266   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=768,}, 0x0, ) == 0x0
 02270  1564   NtSetEventBoostPriority  (340, ...
 02271   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\0\3\0\0" ...  ...
 02268  1128   NtWaitForSingleObject  ... ) == 0x0
 02270  1564   NtSetEventBoostPriority  ... ) == 0x0
 02272  1128   NtSetEventBoostPriority  (340, ...
 02271   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\0\3\0\0" )  ) == 0x0
 02272  1128   NtSetEventBoostPriority  ... ) == 0x0
 02273  1564   NtWaitForSingleObject  (340, 0, 0x0, ...
 02274   896   NtResumeThread  (468, ...
 02269  1664   NtWaitForSingleObject  ... ) == 0x0
 02274   896   NtResumeThread  ... 1, ) == 0x0
 02275  1664   NtSetEventBoostPriority  (340, ...
 02276  1128   NtWaitForSingleObject  (340, 0, 0x0, ...
 02277   768   NtTestAlert  (...
 02273  1564   NtWaitForSingleObject  ... ) == 0x0
 02275  1664   NtSetEventBoostPriority  ... ) == 0x0
 02278  1564   NtSetEventBoostPriority  (340, ...
 02277   768   NtTestAlert  ... ) == 0x0
 02276  1128   NtWaitForSingleObject  ... ) == 0x0
 02278  1564   NtSetEventBoostPriority  ... ) == 0x0
 02279  1664   NtClose  (460, ...
 02280  1128   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02281   768   NtContinue  (50396464, 1, ...
 02282   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02280  1128   NtWaitForSingleObject  ... ) == 0x102
 02279  1664   NtClose  ... ) == 0x0
 02283   768   NtRegisterThreadTerminatePort  (24, ...
 02282   896   NtAllocateVirtualMemory  ... 50397184, 1048576, ) == 0x0
 02284  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14y>f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14y>f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02285  1128   NtWaitForSingleObject  (172, 0, 0x0, ...
 02283   768   NtRegisterThreadTerminatePort  ... ) == 0x0
 02286   896   NtAllocateVirtualMemory  (-1, 51437568, 0, 8192, 4096, 4, ...
 02287  1564   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02288  1664   NtClose  (464, ...
 02286   896   NtAllocateVirtualMemory  ... 51437568, 8192, ) == 0x0
 02287  1564   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02288  1664   NtClose  ... ) == 0x0
 02289   896   NtProtectVirtualMemory  (-1, (0x310e000), 4096, 260, ...
 02290  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02291  1664   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02289   896   NtProtectVirtualMemory  ... (0x310e000), 4096, 4, ) == 0x0
 02290  1564   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02291  1664   NtCreateKey  ... 464, 2, ) == 0x0
 02292   768   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ...
 02293  1564   NtQuerySystemInformation  (Performance, 312, ...
 02294  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02292   768   NtAllocateVirtualMemory  ... 1396736, 4096, ) == 0x0
 02295   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02294  1664   NtOpenKey  ... 460, ) == 0x0
 02296   768   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02295   896   NtCreateThread  ... 476, {1252, 1864}, ) == 0x0
 02293  1564   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02296   768   NtDuplicateObject  ... 480, ) == 0x0
 02297   896   NtQueryInformationThread  (476, Basic, 28, ...
 02298  1564   NtQuerySystemInformation  (Exception, 16, ...
 02299   768   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02297   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1864,}, 0x0, ) == 0x0
 02298  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02300   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0H\7\0\0" ...  ...
 02301  1564   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02302  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02303  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02304  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 02305  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "F\2335\35cP\202y\7M\263\321\304r\337\214\16\233\332\230\216\266\3t\236\17\10\200\237\241U@\177}\217\334\366%\326\200\236SN\220\303\210w\230}t\24\4h\260\276L\310\345.\203>I4\24J\205\345-8\277\20\232\1\321NH#\274\322\1", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "F\2335\35cP\202y\7M\263\321\304r\337\214\16\233\332\230\216\266\3t\236\17\10\200\237\241U@\177}\217\334\366%\326\200\236SN\220\303\210w\230}t\24\4h\260\276L\310\345.\203>I4\24J\205\345-8\277\20\232\1\321NH#\274\322\1", 80, ... , 80, ...
 02306  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02299   768   NtWaitForSingleObject  ... ) == 0x102
 02300   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0H\7\0\0" )  ) == 0x0
 02306  1664   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02307   768   NtWaitForSingleObject  (172, 0, 0x0, ...
 02308   896   NtResumeThread  (476, ...
 02309  1664   NtQueryValueKey  (464,  (464, "Hostname", Partial, 144, ... , Partial, 144, ...
 02308   896   NtResumeThread  ... 1, ) == 0x0
 02309  1664   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02310   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02311  1664   NtQueryValueKey  (464,  (464, "Hostname", Partial, 144, ... , Partial, 144, ...
 02310   896   NtAllocateVirtualMemory  ... 51445760, 1048576, ) == 0x0
 02311  1664   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02312   896   NtAllocateVirtualMemory  (-1, 52486144, 0, 8192, 4096, 4, ...
 02305  1564   NtSetValueKey  ... ) == 0x0
 02313  1864   NtTestAlert  (...
 02314  1664   NtClose  (464, ...
 02315  1564   NtClose  (-2147481484, ...
 02313  1864   NtTestAlert  ... ) == 0x0
 02314  1664   NtClose  ... ) == 0x0
 02315  1564   NtClose  ... ) == 0x0
 02316  1864   NtContinue  (51445040, 1, ...
 02317  1664   NtClose  (460, ...
 02312   896   NtAllocateVirtualMemory  ... 52486144, 8192, ) == 0x0
 02318  1864   NtRegisterThreadTerminatePort  (24, ...
 02317  1664   NtClose  ... ) == 0x0
 02319   896   NtProtectVirtualMemory  (-1, (0x320e000), 4096, 260, ...
 02318  1864   NtRegisterThreadTerminatePort  ... ) == 0x0
 02320  1664   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02319   896   NtProtectVirtualMemory  ... (0x320e000), 4096, 4, ) == 0x0
 02284  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\247\177\340\334\31f\2\234v\367\213\246\0s\322\306\212\247\261\3226h\4\213:S\261\374"\200t\205\315x\25#j\376\321ig\316$\207&kUo\212'$\272a\241(m\274ZDm,8iN\30\36\345\263M\37M!d\204,u\364h\5"\277\336\241\261\2\20y\377.\26}\374\33\260\26,\21H\21O\23\331h\253\13\237l\314\227\316\214X\260\253\237\2610H\324{\207\2341\31;\362\321\304\373\237O\340\34\177\370AqF`\223\230j\344\275\357-\272\363\267\314[\326xA\\267,Yw\266,\337\331\364\&\364g\1\3^\253#\377\362\20\326\346\266\205\307L\347\25Lc\230\325\275\263r\270\371\321F\235\312\344\22\4\343N\227Ydcqx\1\257$\253O\232M\221\317n\22H\267\264`\353\357\2424\50\231\266\10\304a\32=\365\257\356\237\27\216\210\250^:5\264\21|\2552m\372*", ) \200t\205\315x\25#j\376\321ig\316$\207&kUo\212'$\272a\241(m\274ZDm,8iN\30\36\345\263M\37M!d\204,u\364h\5 ... {status=0x0, info=256}, "\247\177\340\334\31f\2\234v\367\213\246\0s\322\306\212\247\261\3226h\4\213:S\261\374"\200t\205\315x\25#j\376\321ig\316$\207&kUo\212'$\272a\241(m\274ZDm,8iN\30\36\345\263M\37M!d\204,u\364h\5"\277\336\241\261\2\20y\377.\26}\374\33\260\26,\21H\21O\23\331h\253\13\237l\314\227\316\214X\260\253\237\2610H\324{\207\2341\31;\362\321\304\373\237O\340\34\177\370AqF`\223\230j\344\275\357-\272\363\267\314[\326xA\\267,Yw\266,\337\331\364\&\364g\1\3^\253#\377\362\20\326\346\266\205\307L\347\25Lc\230\325\275\263r\270\371\321F\235\312\344\22\4\343N\227Ydcqx\1\257$\253O\232M\221\317n\22H\267\264`\353\357\2424\50\231\266\10\304a\32=\365\257\356\237\27\216\210\250^:5\264\21|\2552m\372*", ) , ) == 0x0
 02320  1664   NtCreateEvent  ... 460, ) == 0x0
 02321   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02322  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14\31I\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14\31I\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02323  1864   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02321   896   NtCreateThread  ... 464, {1252, 388}, ) == 0x0
 02324  1564   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02323  1864   NtDuplicateObject  ... 484, ) == 0x0
 02325   896   NtQueryInformationThread  (464, Basic, 28, ...
 02324  1564   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02326  1864   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02327  1664   NtWaitForSingleObject  (460, 0, 0x0, ...
 02328  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02326  1864   NtWaitForSingleObject  ... ) == 0x102
 02328  1564   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02329  1864   NtWaitForSingleObject  (172, 0, 0x0, ...
 02325   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=388,}, 0x0, ) == 0x0
 02330  1564   NtQuerySystemInformation  (Performance, 312, ...
 02331   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\204\1\0\0" ...  ...
 02330  1564   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02331   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\204\1\0\0" )  ) == 0x0
 02332  1564   NtQuerySystemInformation  (Exception, 16, ...
 02333   896   NtResumeThread  (464, ...
 02332  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02333   896   NtResumeThread  ... 1, ) == 0x0
 02334  1564   NtQuerySystemInformation  (Lookaside, 32, ...
 02335   388   NtTestAlert  (...
 02334  1564   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02335   388   NtTestAlert  ... ) == 0x0
 02336   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02337   388   NtContinue  (52493616, 1, ...
 02336   896   NtAllocateVirtualMemory  ... 52494336, 1048576, ) == 0x0
 02338   388   NtRegisterThreadTerminatePort  (24, ...
 02339   896   NtAllocateVirtualMemory  (-1, 53534720, 0, 8192, 4096, 4, ...
 02338   388   NtRegisterThreadTerminatePort  ... ) == 0x0
 02339   896   NtAllocateVirtualMemory  ... 53534720, 8192, ) == 0x0
 02340  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02341   896   NtProtectVirtualMemory  (-1, (0x330e000), 4096, 260, ...
 02340  1564   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02341   896   NtProtectVirtualMemory  ... (0x330e000), 4096, 4, ) == 0x0
 02342  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02343   388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02342  1564   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02343   388   NtDuplicateObject  ... 488, ) == 0x0
 02344  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02345   388   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02344  1564   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02345   388   NtWaitForSingleObject  ... ) == 0x102
 02346   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02347   388   NtWaitForSingleObject  (172, 0, 0x0, ...
 02346   896   NtCreateThread  ... 492, {1252, 1644}, ) == 0x0
 02348  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "TH\1\312t|5\201=V+\222\216;/MQY\277\7\352Pn\350\213\14\376\277<\14\374|3\200P\23\25\22\313^&\264\354\205\0\242\34\261\222q\35\312\35\265\332\306DK#J\317\37b\313gk3\205\224.=\340\256\201/@\356c\361[", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "TH\1\312t|5\201=V+\222\216;/MQY\277\7\352Pn\350\213\14\376\277<\14\374|3\200P\23\25\22\313^&\264\354\205\0\242\34\261\222q\35\312\35\265\332\306DK#J\317\37b\313gk3\205\224.=\340\256\201/@\356c\361[", 80, ... , 80, ...
 02349   896   NtQueryInformationThread  (492, Basic, 28, ...
 02348  1564   NtSetValueKey  ... ) == 0x0
 02349   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1644,}, 0x0, ) == 0x0
 02350  1564   NtClose  (-2147481484, ...
 02351   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0l\6\0\0" ...  ...
 02350  1564   NtClose  ... ) == 0x0
 02322  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\344K\370!\235OE\337\273W] \315H\7\1\313U7\234\15\14&2M;7;9}\336\301\30\326\240\363s\235\335\204\301\373\26\211u\361 M,\201!\3725d4<{\225\300X\207\325\370\243\277\201\252B>\254\314osdr\7\5il\342Z{\317\305"E)\307\0\265$\20\220\260\26\33'\333X\243\210?\222"\325\335\253\251y\372\14WH\235\271Iy\221\254k\246\10\235\12\233\206O\57\265\205\312\320)\3503T\220\220\210\324HA\27\324\17\361\201\352q\271 #\316\205\274\245\313\253\235\376\31u\207?\360\335\265U\247A\263\20\347f\215\316{\221\242\241\204\2160\371\302\27\225v\307\371\356\325\12\17\215\221*\361\10<\321)T\3342\13\360uH\210)g\345j\35580\246Z\10nW02\25#\337\277\260\12\325\0\32t\205\345Y\355l\248c\361[\353\302\223x\226!\301\215\12\257", ) E)\307\0\265$\20\220\260\26\33'\333X\243\210?\222 ... {status=0x0, info=256}, "\344K\370!\235OE\337\273W] \315H\7\1\313U7\234\15\14&2M;7;9}\336\301\30\326\240\363s\235\335\204\301\373\26\211u\361 M,\201!\3725d4<{\225\300X\207\325\370\243\277\201\252B>\254\314osdr\7\5il\342Z{\317\305"E)\307\0\265$\20\220\260\26\33'\333X\243\210?\222"\325\335\253\251y\372\14WH\235\271Iy\221\254k\246\10\235\12\233\206O\57\265\205\312\320)\3503T\220\220\210\324HA\27\324\17\361\201\352q\271 #\316\205\274\245\313\253\235\376\31u\207?\360\335\265U\247A\263\20\347f\215\316{\221\242\241\204\2160\371\302\27\225v\307\371\356\325\12\17\215\221*\361\10<\321)T\3342\13\360uH\210)g\345j\35580\246Z\10nW02\25#\337\277\260\12\325\0\32t\205\345Y\355l\248c\361[\353\302\223x\226!\301\215\12\257", ) , ) == 0x0
 02352  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02353  1564   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02354  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02355  1564   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02351   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0l\6\0\0" )  ) == 0x0
 02356   896   NtResumeThread  (492, ... 1, ) == 0x0
 02357   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 53542912, 1048576, ) == 0x0
 02358   896   NtAllocateVirtualMemory  (-1, 54583296, 0, 8192, 4096, 4, ... 54583296, 8192, ) == 0x0
 02359   896   NtProtectVirtualMemory  (-1, (0x340e000), 4096, 260, ... (0x340e000), 4096, 4, ) == 0x0
 02360   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 496, {1252, 776}, ) == 0x0
 02361   896   NtQueryInformationThread  (496, Basic, 28, ...
 02362  1564   NtQuerySystemInformation  (Exception, 16, ...
 02363  1644   NtTestAlert  (...
 02362  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02363  1644   NtTestAlert  ... ) == 0x0
 02364  1564   NtQuerySystemInformation  (Lookaside, 32, ...
 02365  1644   NtContinue  (53542192, 1, ...
 02364  1564   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02366  1644   NtRegisterThreadTerminatePort  (24, ...
 02367  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02366  1644   NtRegisterThreadTerminatePort  ... ) == 0x0
 02367  1564   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02361   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=776,}, 0x0, ) == 0x0
 02368  1644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02369   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\0\10\3\0\0" ...  ...
 02368  1644   NtDuplicateObject  ... 500, ) == 0x0
 02369   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\0\10\3\0\0" )  ) == 0x0
 02370  1644   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02371   896   NtResumeThread  (496, ...
 02370  1644   NtWaitForSingleObject  ... ) == 0x102
 02371   896   NtResumeThread  ... 1, ) == 0x0
 02372  1644   NtWaitForSingleObject  (172, 0, 0x0, ...
 02373  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02374   776   NtTestAlert  (...
 02375   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02373  1564   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02374   776   NtTestAlert  ... ) == 0x0
 02375   896   NtAllocateVirtualMemory  ... 54591488, 1048576, ) == 0x0
 02376  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02377   776   NtContinue  (54590768, 1, ...
 02378   896   NtAllocateVirtualMemory  (-1, 55631872, 0, 8192, 4096, 4, ...
 02376  1564   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02379   776   NtRegisterThreadTerminatePort  (24, ...
 02378   896   NtAllocateVirtualMemory  ... 55631872, 8192, ) == 0x0
 02380  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\234\2338\242\31\333?\337\366\205\251\346\345U\5\274\314\20\13`R6, 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\234\2338\242\31\333?\337\366\205\251\346\345U\5\274\314\20\13`R6, 80, ... , 80, ...
 02379   776   NtRegisterThreadTerminatePort  ... ) == 0x0
 02381   896   NtProtectVirtualMemory  (-1, (0x350e000), 4096, 260, ...
 02380  1564   NtSetValueKey  ... ) == 0x0
 02381   896   NtProtectVirtualMemory  ... (0x350e000), 4096, 4, ) == 0x0
 02382   776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02383  1564   NtClose  (-2147481484, ...
 02382   776   NtDuplicateObject  ... 504, ) == 0x0
 02383  1564   NtClose  ... ) == 0x0
 02384   776   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02352  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "X\375TG\260\251\345Kle\253\10\276CJ\234Z6\217\253\251\371\314\227E/\221\1@\16`\335u\351\272\316\324d\168y\251\270/\370\352k\231\342\245\347\237\301%n\202\205T\256N\351\262\23#\21^\363\375k( \205\323\377D\356\37W\255+\274\321\371}\337Z\247\215\13\221\233v~$B>\224\7\310\322Z\377nH\316\w\233\35\34\0,v\243\364\205\233*Zb\264\227J\344\264r{Y\267\21\327+L\250"w\23\202z\241\352\226g|d\345\234#}3\31Z\32\357\257-\222C\3554\361&\365\36\24\3520GE6\322v\367KPZ\377\4\224\65\25\203?\272\4\255C\203\263g\361\34\353\22\263\31}\235O1\316\37\220\203\372\353\246\220;k\214\371\206\321\260E\31\213D\324\303\267a\245N\33]t\235\!d\357(.\343\32yng\302\231\323Cc\351\231"\25t.\205\24\242\10", ) w\23\202z\241\352\226g|d\345\234#}3\31Z\32\357\257-\222C\3554\361&\365\36\24\3520GE6\322v\367KPZ\377\4\224\65\25\203?\272\4\255C\203\263g\361\34\353\22\263\31}\235O1\316\37\220\203\372\353\246\220;k\214\371\206\321\260E\31\213D\324\303\267a\245N\33]t\235\!d\357(.\343\32yng\302\231\323Cc\351\231 ... {status=0x0, info=256}, "X\375TG\260\251\345Kle\253\10\276CJ\234Z6\217\253\251\371\314\227E/\221\1@\16`\335u\351\272\316\324d\168y\251\270/\370\352k\231\342\245\347\237\301%n\202\205T\256N\351\262\23#\21^\363\375k( \205\323\377D\356\37W\255+\274\321\371}\337Z\247\215\13\221\233v~$B>\224\7\310\322Z\377nH\316\w\233\35\34\0,v\243\364\205\233*Zb\264\227J\344\264r{Y\267\21\327+L\250"w\23\202z\241\352\226g|d\345\234#}3\31Z\32\357\257-\222C\3554\361&\365\36\24\3520GE6\322v\367KPZ\377\4\224\65\25\203?\272\4\255C\203\263g\361\34\353\22\263\31}\235O1\316\37\220\203\372\353\246\220;k\214\371\206\321\260E\31\213D\324\303\267a\245N\33]t\235\!d\357(.\343\32yng\302\231\323Cc\351\231"\25t.\205\24\242\10", ) , ) == 0x0
 02384   776   NtWaitForSingleObject  ... ) == 0x102
 02385  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02386   776   NtWaitForSingleObject  (172, 0, 0x0, ...
 02387  1564   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02388   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02387  1564   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02388   896   NtCreateThread  ... 508, {1252, 1920}, ) == 0x0
 02389   896   NtQueryInformationThread  (508, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=1920,}, 0x0, ) == 0x0
 02390   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\200\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\200\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\200\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\200\7\0\0" )  ) == 0x0
 02391   896   NtResumeThread  (508, ... 1, ) == 0x0
 02392   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 55640064, 1048576, ) == 0x0
 02393   896   NtAllocateVirtualMemory  (-1, 56680448, 0, 8192, 4096, 4, ...
 02394  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02395  1920   NtTestAlert  (...
 02394  1564   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02395  1920   NtTestAlert  ... ) == 0x0
 02396  1564   NtQuerySystemInformation  (Performance, 312, ...
 02397  1920   NtContinue  (55639344, 1, ...
 02396  1564   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02398  1920   NtRegisterThreadTerminatePort  (24, ...
 02399  1564   NtQuerySystemInformation  (Exception, 16, ...
 02398  1920   NtRegisterThreadTerminatePort  ... ) == 0x0
 02399  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02393   896   NtAllocateVirtualMemory  ... 56680448, 8192, ) == 0x0
 02400  1920   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02401   896   NtProtectVirtualMemory  (-1, (0x360e000), 4096, 260, ...
 02400  1920   NtDuplicateObject  ... 512, ) == 0x0
 02401   896   NtProtectVirtualMemory  ... (0x360e000), 4096, 4, ) == 0x0
 02402  1920   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02403   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02402  1920   NtWaitForSingleObject  ... ) == 0x102
 02403   896   NtCreateThread  ... 516, {1252, 1396}, ) == 0x0
 02404  1920   NtWaitForSingleObject  (172, 0, 0x0, ...
 02405   896   NtQueryInformationThread  (516, Basic, 28, ...
 02406  1564   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02407  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02408  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02409  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 02410  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\354C\201\264R\310t\346M\324\331\272Z3\225R\206\16\341\273\177|\377|\2001\203[\355\346u\10[\266$S\220\3134\265\234j\271\255\235\377\221\25\336\365/A\340\307\305\35/\216\215c\230%\23\317\230\236\331ST\7\247\13\232\233-\22%m#m", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\354C\201\264R\310t\346M\324\331\272Z3\225R\206\16\341\273\177|\377|\2001\203[\355\346u\10[\266$S\220\3134\265\234j\271\255\235\377\221\25\336\365/A\340\307\305\35/\216\215c\230%\23\317\230\236\331ST\7\247\13\232\233-\22%m#m", 80, ... ) , 80, ... ) == 0x0
 02411  1564   NtClose  (-2147481484, ... ) == 0x0
 02405   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=1396,}, 0x0, ) == 0x0
 02412   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0t\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0t\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0t\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0t\5\0\0" )  ) == 0x0
 02413   896   NtResumeThread  (516, ... 1, ) == 0x0
 02414   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 56688640, 1048576, ) == 0x0
 02415   896   NtAllocateVirtualMemory  (-1, 57729024, 0, 8192, 4096, 4, ... 57729024, 8192, ) == 0x0
 02416   896   NtProtectVirtualMemory  (-1, (0x370e000), 4096, 260, ... (0x370e000), 4096, 4, ) == 0x0
 02385  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "|\367\240%\222\\343P\35764Ojp\364\3077\265\302\343g\221\2450Q\31\261\347\347U\3\205!5b-\26\15`\304c\13\326\363\235\260DW<3\202K"\33\2s\264K\270\230\363V\2769\371\211DBeE7\222Z\221\3h~v\22\13d\32\2471\2326\355\273\276Y\252\272\345\25\370\16\2\25Ae\250\242\200\303\371\306\247\360\361\251\236\311`\245y\336\37Rb.\312|\224\310/\17\257\22\24\311O\330c\262\271\325\207d\330\376IfL$\34\251nM\247\2mf\241l;\343\303\11[h\212SzT4M"\364\321e\313\370\12G`\270\305?\326\207:b\22G!\256\303\32U\341\231\331\204\256k\265\254R\314n4\337\204\264\217\233\323\274\344\375\2\231\25\200\27\302\261D\207<\205\206\226`\177\224\220\312\226c4\215-\2343+\345\356\366(\37\277:\356\324\6^A\323\223\260\253\16,\235", ) \33\2s\264K\270\230\363V\2769\371\211DBeE7\222Z\221\3h~v\22\13d\32\2471\2326\355\273\276Y\252\272\345\25\370\16\2\25Ae\250\242\200\303\371\306\247\360\361\251\236\311`\245y\336\37Rb.\312|\224\310/\17\257\22\24\311O\330c\262\271\325\207d\330\376IfL$\34\251nM\247\2mf\241l;\343\303\11[h\212SzT4M ... {status=0x0, info=256}, "|\367\240%\222\\343P\35764Ojp\364\3077\265\302\343g\221\2450Q\31\261\347\347U\3\205!5b-\26\15`\304c\13\326\363\235\260DW<3\202K"\33\2s\264K\270\230\363V\2769\371\211DBeE7\222Z\221\3h~v\22\13d\32\2471\2326\355\273\276Y\252\272\345\25\370\16\2\25Ae\250\242\200\303\371\306\247\360\361\251\236\311`\245y\336\37Rb.\312|\224\310/\17\257\22\24\311O\330c\262\271\325\207d\330\376IfL$\34\251nM\247\2mf\241l;\343\303\11[h\212SzT4M"\364\321e\313\370\12G`\270\305?\326\207:b\22G!\256\303\32U\341\231\331\204\256k\265\254R\314n4\337\204\264\217\233\323\274\344\375\2\231\25\200\27\302\261D\207<\205\206\226`\177\224\220\312\226c4\215-\2343+\345\356\366(\37\277:\356\324\6^A\323\223\260\253\16,\235", ) , ) == 0x0
 02417  1396   NtTestAlert  (...
 02418  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02417  1396   NtTestAlert  ... ) == 0x0
 02419  1564   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02420  1396   NtContinue  (56687920, 1, ...
 02419  1564   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02421  1396   NtRegisterThreadTerminatePort  (24, ...
 02422  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02421  1396   NtRegisterThreadTerminatePort  ... ) == 0x0
 02422  1564   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02423   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02424  1396   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02423   896   NtCreateThread  ... 520, {1252, 1852}, ) == 0x0
 02424  1396   NtDuplicateObject  ... 524, ) == 0x0
 02425   896   NtQueryInformationThread  (520, Basic, 28, ...
 02426  1396   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02425   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=1852,}, 0x0, ) == 0x0
 02426  1396   NtWaitForSingleObject  ... ) == 0x102
 02427   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0<\7\0\0" ...  ...
 02428  1396   NtWaitForSingleObject  (172, 0, 0x0, ...
 02427   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0<\7\0\0" )  ) == 0x0
 02429  1564   NtQuerySystemInformation  (Performance, 312, ...
 02430   896   NtResumeThread  (520, ...
 02429  1564   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02430   896   NtResumeThread  ... 1, ) == 0x0
 02431  1564   NtQuerySystemInformation  (Exception, 16, ...
 02432   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02431  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02432   896   NtAllocateVirtualMemory  ... 57737216, 1048576, ) == 0x0
 02433  1564   NtQuerySystemInformation  (Lookaside, 32, ...
 02434   896   NtAllocateVirtualMemory  (-1, 58777600, 0, 8192, 4096, 4, ...
 02433  1564   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02435  1852   NtTestAlert  (...
 02434   896   NtAllocateVirtualMemory  ... 58777600, 8192, ) == 0x0
 02435  1852   NtTestAlert  ... ) == 0x0
 02436   896   NtProtectVirtualMemory  (-1, (0x380e000), 4096, 260, ...
 02437  1852   NtContinue  (57736496, 1, ...
 02436   896   NtProtectVirtualMemory  ... (0x380e000), 4096, 4, ) == 0x0
 02438  1852   NtRegisterThreadTerminatePort  (24, ...
 02439   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02438  1852   NtRegisterThreadTerminatePort  ... ) == 0x0
 02439   896   NtCreateThread  ... 528, {1252, 800}, ) == 0x0
 02440  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02441   896   NtQueryInformationThread  (528, Basic, 28, ...
 02440  1564   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02442  1852   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02443  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02442  1852   NtDuplicateObject  ... 532, ) == 0x0
 02443  1564   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02444  1852   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02445  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02444  1852   NtWaitForSingleObject  ... ) == 0x102
 02445  1564   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02446  1852   NtWaitForSingleObject  (172, 0, 0x0, ...
 02441   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=800,}, 0x0, ) == 0x0
 02447  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "H\366w\374\213A\273\243p\245\214\3\210\347\253\30Z8\31&\36e,}6^H5\3116\332\311\37H\235bh\266\265\305\307\2P\212&\13\35\317\304\210*\372A\30\2530=\206y),A\345_\274\232Jhz\266n\230\215\230YQ\34>\306\350", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "H\366w\374\213A\273\243p\245\214\3\210\347\253\30Z8\31&\36e,}6^H5\3116\332\311\37H\235bh\266\265\305\307\2P\212&\13\35\317\304\210*\372A\30\2530=\206y),A\345_\274\232Jhz\266n\230\215\230YQ\34>\306\350", 80, ... , 80, ...
 02448   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0 \3\0\0" ...  ...
 02447  1564   NtSetValueKey  ... ) == 0x0
 02448   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0 \3\0\0" )  ) == 0x0
 02449  1564   NtClose  (-2147481484, ...
 02450   896   NtResumeThread  (528, ...
 02449  1564   NtClose  ... ) == 0x0
 02450   896   NtResumeThread  ... 1, ) == 0x0
 02418  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "|\311\316\216\367\205VH\206ph\332\303AX\232\273}.\11T(d\303\23\2543D\221#I\27\22\376\3346\337\361B\251H\301\16\1\5\316A\364\357\367I\30\2762k*5\264\374\343m@\334\334\351\243\267F\22\323\262o\25\351'\337\30\375\273r\264^UU\236;\342\217\264\26\33jE\222x\347{\253\216n\212H\267\25\260\22:\317\2:|\315\213\302\5\337\311l\367\341\375\376L*o\307\27\327Ib\230\261\1\2541\336\247\303\373\236S\353\242\352\355qC)/*\342\237p\333$\302Cp]\252\25\203\343\311\307\216\373{\200\240\213\214\260H\1\333\16\243\247\272\1\231\252cEZ\24wT\361NZE[\34\20\337\1\16\32\4\366|J\215z\205\274\0\1\250I\364H.g\250\226\315\350$\356\17\201Tu[\363\17s\321\22\2\4\13X%7f*?\366\362\352\307\1\303v\201\334'\200\340.\21\264", ) , ) == 0x0
 02451   800   NtTestAlert  (...
 02452  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02451   800   NtTestAlert  ... ) == 0x0
 02453   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02454   800   NtContinue  (58785072, 1, ...
 02453   896   NtAllocateVirtualMemory  ... 58785792, 1048576, ) == 0x0
 02455   800   NtRegisterThreadTerminatePort  (24, ...
 02456   896   NtAllocateVirtualMemory  (-1, 59826176, 0, 8192, 4096, 4, ...
 02455   800   NtRegisterThreadTerminatePort  ... ) == 0x0
 02456   896   NtAllocateVirtualMemory  ... 59826176, 8192, ) == 0x0
 02457  1564   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02458   896   NtProtectVirtualMemory  (-1, (0x390e000), 4096, 260, ...
 02457  1564   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02458   896   NtProtectVirtualMemory  ... (0x390e000), 4096, 4, ) == 0x0
 02459  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02460   800   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02459  1564   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02460   800   NtDuplicateObject  ... 536, ) == 0x0
 02461  1564   NtQuerySystemInformation  (Performance, 312, ...
 02462   800   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 02461  1564   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02462   800   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 02463   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02464   800   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02463   896   NtCreateThread  ... 540, {1252, 1176}, ) == 0x0
 02465   896   NtQueryInformationThread  (540, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=1176,}, 0x0, ) == 0x0
 02466   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\230\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\230\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\230\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\230\4\0\0" )  ) == 0x0
 02467   896   NtResumeThread  (540, ... 1, ) == 0x0
 02468   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 59834368, 1048576, ) == 0x0
 02469   896   NtAllocateVirtualMemory  (-1, 60874752, 0, 8192, 4096, 4, ...
 02470  1564   NtQuerySystemInformation  (Exception, 16, ...
 02471  1176   NtTestAlert  (...
 02464   800   NtWaitForSingleObject  ... ) == 0x102
 02470  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02471  1176   NtTestAlert  ... ) == 0x0
 02472   800   NtWaitForSingleObject  (172, 0, 0x0, ...
 02473  1564   NtQuerySystemInformation  (Lookaside, 32, ...
 02474  1176   NtContinue  (59833648, 1, ...
 02473  1564   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02475  1176   NtRegisterThreadTerminatePort  (24, ...
 02476  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02475  1176   NtRegisterThreadTerminatePort  ... ) == 0x0
 02476  1564   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02469   896   NtAllocateVirtualMemory  ... 60874752, 8192, ) == 0x0
 02477  1176   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02478   896   NtProtectVirtualMemory  (-1, (0x3a0e000), 4096, 260, ...
 02477  1176   NtDuplicateObject  ... 544, ) == 0x0
 02478   896   NtProtectVirtualMemory  ... (0x3a0e000), 4096, 4, ) == 0x0
 02479  1176   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02480   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02479  1176   NtWaitForSingleObject  ... ) == 0x102
 02480   896   NtCreateThread  ... 548, {1252, 1828}, ) == 0x0
 02481  1176   NtWaitForSingleObject  (172, 0, 0x0, ...
 02482   896   NtQueryInformationThread  (548, Basic, 28, ...
 02483  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02484  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 02485  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\310\327\345\202a<\377"R\245\221\373danP\350S\16\3\331\24\233X\213\313vdM_\350}\363\304\273;\5\24]Y\201\30\15':1F\4\270\203k\202\334\13~\277\310\271\370\322\203\311~:\253\226F\177\271wFc\25\373\262\262\7\374\340:", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\310\327\345\202a<\377"R\245\221\373danP\350S\16\3\331\24\233X\213\313vdM_\350}\363\304\273;\5\24]Y\201\30\15':1F\4\270\203k\202\334\13~\277\310\271\370\322\203\311~:\253\226F\177\271wFc\25\373\262\262\7\374\340:", 80, ... ) R\245\221\373danP\350S\16\3\331\24\233X\213\313vdM_\350}\363\304\273;\5\24]Y\201\30\15':1F\4\270\203k\202\334\13~\277\310\271\370\322\203\311~:\253\226F\177\271wFc\25\373\262\262\7\374\340:", 80, ... ) == 0x0
 02486  1564   NtClose  (-2147481484, ... ) == 0x0
 02452  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "PXmhi\23\252\362;\241\253\333\276\273[\227\363\235Z\247\223\352\236\350Jw\25\377\22\376d\363\24\237wB\315\353\214[\320j\252\2\266\207\340~2\252\251\220L\201\5y\344WE\3308\227J+\\246g\344\3447\230o\34\332|\310\214*\270\373\310\350\225\250\24\251w\336\15\325*\336\10?\11\340l\3264\300\366%%\17\265\301\334\09u\16z\10\2278\320"\353\32\353\\33\206\26\330\256v\264\177\335\367K.\300@\3\204\333)V\312\16\3013\264\3\g\354\375WRjp\200\365\220\1\226E\304\2152v\264\373\241\371\244\234\336\274KT\16\15#\221\2453P\330\233\241\315#\327#\251\363y\363U\32\366\272^\352[MP+ktk\202z\13<\226\264\325\13\177\256\370\277+\266\367O\201\242\353\212F\331\2248\215\321\32@\364!3qdT\26(\311\273\4\26_\30\354Ny\322\271\276`\263\202", ) \353\32\353\\33\206\26\330\256v\264\177\335\367K.\300@\3\204\333)V\312\16\3013\264\3\g\354\375WRjp\200\365\220\1\226E\304\2152v\264\373\241\371\244\234\336\274KT\16\15#\221\2453P\330\233\241\315#\327#\251\363y\363U\32\366\272^\352[MP+ktk\202z\13<\226\264\325\13\177\256\370\277+\266\367O\201\242\353\212F\331\2248\215\321\32@\364!3qdT\26(\311\273\4\26_\30\354Ny\322\271\276`\263\202", ) == 0x0
 02487  1564   NtDeviceIoControlFile  (420, 0, 0x0, 0x0, 0x390008,  (420, 0, 0x0, 0x0, 0x390008, "\7\272A\177\225\350"7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... 7\254\33n\262\260\14\31I\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c=L\272\373\372\325c];f\366s\365\306O\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02488  1564   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02482   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=1828,}, 0x0, ) == 0x0
 02489   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0$\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0$\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0$\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0$\7\0\0" )  ) == 0x0
 02490   896   NtResumeThread  (548, ... 1, ) == 0x0
 02491   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 60882944, 1048576, ) == 0x0
 02492   896   NtAllocateVirtualMemory  (-1, 61923328, 0, 8192, 4096, 4, ... 61923328, 8192, ) == 0x0
 02493   896   NtProtectVirtualMemory  (-1, (0x3b0e000), 4096, 260, ... (0x3b0e000), 4096, 4, ) == 0x0
 02494  1564   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02495  1828   NtTestAlert  (...
 02494  1564   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02495  1828   NtTestAlert  ... ) == 0x0
 02496  1564   NtQuerySystemInformation  (Performance, 312, ...
 02497  1828   NtContinue  (60882224, 1, ...
 02496  1564   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02498  1828   NtRegisterThreadTerminatePort  (24, ...
 02499  1564   NtQuerySystemInformation  (Exception, 16, ...
 02498  1828   NtRegisterThreadTerminatePort  ... ) == 0x0
 02499  1564   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02500   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02501  1828   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02500   896   NtCreateThread  ... 552, {1252, 1700}, ) == 0x0
 02501  1828   NtDuplicateObject  ... 556, ) == 0x0
 02502   896   NtQueryInformationThread  (552, Basic, 28, ...
 02503  1828   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02502   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1700,}, 0x0, ) == 0x0
 02503  1828   NtWaitForSingleObject  ... ) == 0x102
 02504   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\244\6\0\0" ...  ...
 02505  1828   NtWaitForSingleObject  (172, 0, 0x0, ...
 02504   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\244\6\0\0" )  ) == 0x0
 02506  1564   NtQuerySystemInformation  (Lookaside, 32, ...
 02507   896   NtResumeThread  (552, ...
 02506  1564   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02507   896   NtResumeThread  ... 1, ) == 0x0
 02508  1564   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02509   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02508  1564   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02509   896   NtAllocateVirtualMemory  ... 61931520, 1048576, ) == 0x0
 02510  1564   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02511   896   NtAllocateVirtualMemory  (-1, 62971904, 0, 8192, 4096, 4, ...
 02510  1564   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02512  1700   NtTestAlert  (...
 02511   896   NtAllocateVirtualMemory  ... 62971904, 8192, ) == 0x0
 02512  1700   NtTestAlert  ... ) == 0x0
 02513   896   NtProtectVirtualMemory  (-1, (0x3c0e000), 4096, 260, ...
 02514  1700   NtContinue  (61930800, 1, ...
 02513   896   NtProtectVirtualMemory  ... (0x3c0e000), 4096, 4, ) == 0x0
 02515  1700   NtRegisterThreadTerminatePort  (24, ...
 02516   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02515  1700   NtRegisterThreadTerminatePort  ... ) == 0x0
 02516   896   NtCreateThread  ... 560, {1252, 384}, ) == 0x0
 02517  1564   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02518   896   NtQueryInformationThread  (560, Basic, 28, ...
 02517  1564   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02519  1700   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02520  1564   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "J+\6\337\341RC\233]\30\217x\370\32aT\225\360\366\201pHf\200c\202\310\4Pk\237\213^\333\357 \7\202\267\33\6c\243\0\256\363%2\264Z\227\11\37\27\376w\10\234\332\23$\331#q\3072\316\371LqKY\336\356\237M\362=\264\26", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "J+\6\337\341RC\233]\30\217x\370\32aT\225\360\366\201pHf\200c\202\310\4Pk\237\213^\333\357 \7\202\267\33\6c\243\0\256\363%2\264Z\227\11\37\27\376w\10\234\332\23$\331#q\3072\316\371LqKY\336\356\237M\362=\264\26", 80, ... , 80, ...
 02519  1700   NtDuplicateObject  ... 564, ) == 0x0
 02520  1564   NtSetValueKey  ... ) == 0x0
 02521  1700   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02522  1564   NtClose  (-2147481484, ...
 02521  1700   NtWaitForSingleObject  ... ) == 0x102
 02522  1564   NtClose  ... ) == 0x0
 02523  1700   NtWaitForSingleObject  (172, 0, 0x0, ...
 02518   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 02487  1564   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\324\365\301\273/`Sh\330\213\346 F\220\314\312\371G\330V(\313\350\252V\313\320\25-\314\274\261\31\336\226\15\362s\255\274\3644\277H\254\344C\356\373D\11{\177\263aT\10\333\203\332\35\337e\313\3\231t\211=\355\231b\12\221w\25\350.\34\305GK\255(\264\l\227.d$\354\377\263G\233\351\350y\346k\243B'\257^3\217\242\210\231\23\376\233\333,\1\235\344\14\303\316A\242o\371+m$^dH\314\3475f\250b\245\23\221\323\355\27\262Nz_\324\2537\211\200\32y\260\27\316\211I(\20\242\30tS,\372{\254M\345\311\314B)\273\16\365\6\27##\201l\0\210\311sH\26\21\332v(P\366\333Uu\3\3f+!\355\160c*\344\233\160RK"(4\3128\31k\375\263\0i!\264\25\1\352\312U\257k!'\2209\177Ep\377\307\17\370\24P\376\330\326\305=", ) (4\3128\31k\375\263\0i!\264\25\1\352\312U\257k!'\2209\177Ep\377\307\17\370\24P\376\330\326\305=", ) == 0x0
 02524   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\200\1\0\0" ...  ...
 02525  1564   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02524   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 02525  1564   NtCreateEvent  ... 568, ) == 0x0
 02526   896   NtResumeThread  (560, ...
 02527  1564   NtSetEventBoostPriority  (460, ...
 02526   896   NtResumeThread  ... 1, ) == 0x0
 02327  1664   NtWaitForSingleObject  ... ) == 0x0
 02527  1564   NtSetEventBoostPriority  ... ) == 0x0
 02528   384   NtTestAlert  (...
 02529  1664   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02530  1564   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ...
 02529  1664   NtCreateEvent  ... 572, ) == 0x0
 02528   384   NtTestAlert  ... ) == 0x0
 02531   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02532  1664   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 16837996, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 16837996, 188, ...
 02533   384   NtContinue  (62979376, 1, ...
 02531   896   NtAllocateVirtualMemory  ... 62980096, 1048576, ) == 0x0
 02530  1564   NtConnectPort  ... 576, 0x0, 0x0, 0x0, 188, ) == 0x0
 02534   384   NtRegisterThreadTerminatePort  (24, ...
 02535   896   NtAllocateVirtualMemory  (-1, 64020480, 0, 8192, 4096, 4, ...
 02536  1564   NtRequestWaitReplyPort  (576, {200, 224, new_msg, 0, 2883626, 1364448, 12, 2}  (576, {200, 224, new_msg, 0, 2883626, 1364448, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\3\0\4\0\0\0\0;\24\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\34 \!\325[\262\350xg\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\320e\25\00\15A\333x\1\24\0pg\25\0h\1\24\0\0\0\0\0\0\0\0\0pg\25\0P\0\0\0xg\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 02534   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 02535   896   NtAllocateVirtualMemory  ... 64020480, 8192, ) == 0x0
 02536  1564   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1564, 81936, 0}  ... {200, 224, reply, 0, 1252, 1564, 81936, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0;\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\34 \!\325[\262\350xg\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\320e\25\00\15A\333x\1\24\0pg\25\0h\1\24\0\0\0\0\0\0\0\0\0pg\25\0P\0\0\0xg\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 02532  1664   NtConnectPort  ... 580, 0x0, 0x0, 0x0, 188, ) == 0x0
 02537   896   NtProtectVirtualMemory  (-1, (0x3d0e000), 4096, 260, ...
 02538  1564   NtRequestWaitReplyPort  (576, {44, 68, new_msg, 56, 0, 0, 0, 0}  (576, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0Pi\25\0\322\0\0\0" ...  ...
 02539  1664   NtRequestWaitReplyPort  (580, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721}  (580, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0 f\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\233H\363\356\24\0\206z\360g\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\310g\25\0/K+\316x\1\24\0\350g\25\0h\1\24\0\0\0\0\0\0\0\0\0\350g\25\0P\0\0\0\360g\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\0\1\372\31\221|\200\363\0\1\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02537   896   NtProtectVirtualMemory  ... (0x3d0e000), 4096, 4, ) == 0x0
 02540   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02539  1664   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1664, 81938, 0}  ... {200, 224, reply, 0, 1252, 1664, 81938, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\233H\363\356\24\0\206z\360g\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\310g\25\0/K+\316x\1\24\0\350g\25\0h\1\24\0\0\0\0\0\0\0\0\0\350g\25\0P\0\0\0\360g\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\0\1\372\31\221|\200\363\0\1\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02538  1564   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1564, 81939, 0}  ... {40, 64, reply, 0, 1252, 1564, 81939, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 02540   384   NtDuplicateObject  ... 584, ) == 0x0
 02541  1664   NtRequestWaitReplyPort  (580, {44, 68, new_msg, 0, 1252, 1664, 81920, 0}  (580, {44, 68, new_msg, 0, 1252, 1664, 81920, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 02542  1564   NtRequestWaitReplyPort  (576, {64, 88, new_msg, 56, 1310720, 11596276, 1403208, 0}  (576, {64, 88, new_msg, 56, 1310720, 11596276, 1403208, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\250j\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02543   384   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02544   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02543   384   NtWaitForSingleObject  ... ) == 0x102
 02544   896   NtCreateThread  ... 588, {1252, 1168}, ) == 0x0
 02542  1564   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1564, 81940, 0}  ... {64, 88, reply, 56, 1252, 1564, 81940, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\250j\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02545   384   NtWaitForSingleObject  (172, 0, 0x0, ...
 02546   896   NtQueryInformationThread  (588, Basic, 28, ...
 02547  1564   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ...
 02541  1664   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1664, 81941, 0}  ... {40, 64, reply, 0, 1252, 1664, 81941, 0} "\2\356Q\200\4\0\0\0@\14\250\201\0\320\372\177\220kt\367\370\37`\300lkt\367X\353Q\200\320\1\0\0X-\12\0" )  ) == 0x0
 02546   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 02548  1664   NtWaitForSingleObject  (340, 0, 0x0, ...
 02549   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\220\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 02550   896   NtResumeThread  (588, ... 1, ) == 0x0
 02551   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 64028672, 1048576, ) == 0x0
 02552   896   NtAllocateVirtualMemory  (-1, 65069056, 0, 8192, 4096, 4, ...
 02547  1564   NtAllocateVirtualMemory  ... 1404928, 4096, ) == 0x0
 02553  1168   NtTestAlert  (...
 02554  1564   NtSetEventBoostPriority  (340, ...
 02553  1168   NtTestAlert  ... ) == 0x0
 02548  1664   NtWaitForSingleObject  ... ) == 0x0
 02554  1564   NtSetEventBoostPriority  ... ) == 0x0
 02555  1664   NtRequestWaitReplyPort  (580, {64, 88, new_msg, 56, 1382704, 16838508, 16838608, 0}  (580, {64, 88, new_msg, 56, 1382704, 16838508, 16838608, 0} "\10\357\0\1@\0\25\0\346\277\347w\320\357\0\1l\357\0\1\20\0\0\0\250.\362v\244\31\25\0\1\0\0\0Hp\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0(\14\25\0" ...  ...
 02556  1168   NtContinue  (64027952, 1, ...
 02557  1564   NtRequestWaitReplyPort  (576, {44, 68, new_msg, 56, 1252, 1564, 81939, 0}  (576, {44, 68, new_msg, 56, 1252, 1564, 81939, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0Pi\25\0\322\0\0\0" ...  ...
 02558  1168   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02557  1564   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1564, 81944, 0}  ... {40, 64, reply, 0, 1252, 1564, 81944, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 02552   896   NtAllocateVirtualMemory  ... 65069056, 8192, ) == 0x0
 02555  1664   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1664, 81943, 0}  ... {64, 88, reply, 56, 1252, 1664, 81943, 0} "\10\357\0\1@\0\25\0\346\277\347w\320\357\0\1l\357\0\1\20\0\0\0\250.\362v\244\31\25\0\1\0\0\0Hp\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0(\14\25\0" )  ) == 0x0
 02559  1168   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02560   896   NtProtectVirtualMemory  (-1, (0x3e0e000), 4096, 260, ...
 02561  1664   NtClose  (572, ...
 02559  1168   NtDuplicateObject  ... 592, ) == 0x0
 02560   896   NtProtectVirtualMemory  ... (0x3e0e000), 4096, 4, ) == 0x0
 02561  1664   NtClose  ... ) == 0x0
 02562  1168   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02563   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02564  1664   NtClose  (580, ...
 02562  1168   NtWaitForSingleObject  ... ) == 0x102
 02563   896   NtCreateThread  ... 572, {1252, 428}, ) == 0x0
 02564  1664   NtClose  ... ) == 0x0
 02565  1168   NtWaitForSingleObject  (172, 0, 0x0, ...
 02566   896   NtQueryInformationThread  (572, Basic, 28, ...
 02567  1664   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02568  1564   NtRequestWaitReplyPort  (576, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (576, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\250}\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02566   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 02569   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 02570   896   NtResumeThread  (572, ... 1, ) == 0x0
 02568  1564   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1564, 81946, 0}  ... {64, 88, reply, 56, 1252, 1564, 81946, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\250}\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02567  1664   NtCreateKey  ... 580, 2, ) == 0x0
 02571   428   NtTestAlert  (...
 02572  1564   NtRequestWaitReplyPort  (576, {44, 68, new_msg, 56, 1252, 1564, 81944, 0}  (576, {44, 68, new_msg, 56, 1252, 1564, 81944, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0Pi\25\0\322\0\0\0" ...  ...
 02573  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02571   428   NtTestAlert  ... ) == 0x0
 02573  1664   NtOpenKey  ... 596, ) == 0x0
 02574   428   NtContinue  (65076528, 1, ...
 02572  1564   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1564, 81948, 0}  ... {40, 64, reply, 0, 1252, 1564, 81948, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 02575  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02576   428   NtRegisterThreadTerminatePort  (24, ...
 02577   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02575  1664   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02576   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 02577   896   NtAllocateVirtualMemory  ... 65077248, 1048576, ) == 0x0
 02578  1664   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 02579  1564   NtRequestWaitReplyPort  (576, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (576, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\360F\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02580   896   NtAllocateVirtualMemory  (-1, 66117632, 0, 8192, 4096, 4, ...
 02581   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02580   896   NtAllocateVirtualMemory  ... 66117632, 8192, ) == 0x0
 02581   428   NtDuplicateObject  ... 600, ) == 0x0
 02579  1564   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1564, 81949, 0}  ... {64, 88, reply, 56, 1252, 1564, 81949, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\360F\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02582   896   NtProtectVirtualMemory  (-1, (0x3f0e000), 4096, 260, ...
 02583   428   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02584  1564   NtClose  (568, ...
 02582   896   NtProtectVirtualMemory  ... (0x3f0e000), 4096, 4, ) == 0x0
 02583   428   NtWaitForSingleObject  ... ) == 0x102
 02584  1564   NtClose  ... ) == 0x0
 02578  1664   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02585   428   NtWaitForSingleObject  (172, 0, 0x0, ...
 02586  1564   NtClose  (576, ...
 02587  1664   NtQueryValueKey  (580,  (580, "Domain", Partial, 144, ... , Partial, 144, ...
 02588   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02587  1664   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02588   896   NtCreateThread  ... 568, {1252, 900}, ) == 0x0
 02589  1664   NtQueryValueKey  (580,  (580, "Domain", Partial, 144, ... , Partial, 144, ...
 02590   896   NtQueryInformationThread  (568, Basic, 28, ...
 02589  1664   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02590   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 02591  1664   NtClose  (580, ...
 02592   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0\204\3\0\0" ...  ...
 02586  1564   NtClose  ... ) == 0x0
 02593  1564   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 576, ) == 0x0
 02594  1564   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02595  1564   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 604, ) == 0x0
 02596  1564   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02597  1564   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02598  1564   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11595968,  (0xc0100080, {24, 0, 0x40, 0, 11595968, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02591  1664   NtClose  ... ) == 0x0
 02592   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 02599  1664   NtClose  (596, ...
 02600   896   NtResumeThread  (568, ...
 02599  1664   NtClose  ... ) == 0x0
 02600   896   NtResumeThread  ... 1, ) == 0x0
 02601  1664   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 02602   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02601  1664   NtOpenKey  ... 596, ) == 0x0
 02602   896   NtAllocateVirtualMemory  ... 66125824, 1048576, ) == 0x0
 02603  1664   NtQueryValueKey  (596,  (596, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 02604   896   NtAllocateVirtualMemory  (-1, 67166208, 0, 8192, 4096, 4, ...
 02598  1564   NtCreateFile  ... 580, {status=0x0, info=1}, ) == 0x0
 02605   900   NtAllocateVirtualMemory  (-1, 3629056, 0, 4096, 4096, 4, ...
 02603  1664   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02606  1564   NtSetInformationFile  (580, 11596024, 8, Pipe, ...
 02605   900   NtAllocateVirtualMemory  ... 3629056, 4096, ) == 0x0
 02607  1664   NtClose  (596, ...
 02606  1564   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02608   900   NtTestAlert  (...
 02607  1664   NtClose  ... ) == 0x0
 02604   896   NtAllocateVirtualMemory  ... 67166208, 8192, ) == 0x0
 02608   900   NtTestAlert  ... ) == 0x0
 02609  1664   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 16837584, ... }, 16837584, ...
 02610   896   NtProtectVirtualMemory  (-1, (0x400e000), 4096, 260, ...
 02611   900   NtContinue  (66125104, 1, ...
 02609  1664   NtQueryAttributesFile  ... ) == 0x0
 02610   896   NtProtectVirtualMemory  ... (0x400e000), 4096, 4, ) == 0x0
 02612  1564   NtSetInformationFile  (580, 11596012, 8, Completion, ...
 02613  1664   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02614   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02612  1564   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02615   900   NtRegisterThreadTerminatePort  (24, ...
 02614   896   NtCreateThread  ... 596, {1252, 1372}, ) == 0x0
 02616  1564   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02615   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 02617   896   NtQueryInformationThread  (596, Basic, 28, ...
 02616  1564   NtSetInformationThread  ... ) == 0x0
 02618   900   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02613  1664   NtOpenFile  ... 608, {status=0x0, info=1}, ) == 0x0
 02619  1564   NtWriteFile  (580, 205, 0, 0,  (580, 205, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 02618   900   NtDuplicateObject  ... 612, ) == 0x0
 02620  1664   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 608, ...
 02619  1564   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 02621   900   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02620  1664   NtCreateSection  ... 616, ) == 0x0
 02617   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 02622  1664   NtClose  (608, ...
 02623   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\\5\0\0" ...  ...
 02622  1664   NtClose  ... ) == 0x0
 02623   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 02624  1664   NtMapViewOfSection  (616, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02625   896   NtResumeThread  (596, ...
 02626  1564   NtReadFile  (580, 205, 0, 0, 1024, {0, 0}, 0, ...
 02621   900   NtWaitForSingleObject  ... ) == 0x102
 02625   896   NtResumeThread  ... 1, ) == 0x0
 02626  1564   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02627   900   NtWaitForSingleObject  (172, 0, 0x0, ...
 02624  1664   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 02628  1372   NtWaitForSingleObject  (128, 0, 0x0, ...
 02629  1564   NtFsControlFile  (580, 205, 0x0, 0x0, 0x11c017,  (580, 205, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\260\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 02630  1664   NtClose  (616, ...
 02629  1564   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02630  1664   NtClose  ... ) == 0x0
 02631  1564   NtFsControlFile  (580, 205, 0x0, 0x0, 0x11c017,  (580, 205, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351\1\0\0\0\1\0\0\0&\0(\00I\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 02632  1664   NtUnmapViewOfSection  (-1, 0x360000, ...
 02631  1564   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351\0\0\0\0", ) , ) == 0x103
 02632  1664   NtUnmapViewOfSection  ... ) == 0x0
 02633   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02634  1664   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 16837892, ... }, 16837892, ...
 02633   896   NtAllocateVirtualMemory  ... 67174400, 1048576, ) == 0x0
 02635  1564   NtFsControlFile  (580, 205, 0x0, 0x0, 0x11c017,  (580, 205, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351", 44, 1024, ... , 44, 1024, ...
 02636   896   NtAllocateVirtualMemory  (-1, 68214784, 0, 8192, 4096, 4, ...
 02635  1564   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\320L\25\0\1\0\0\0\334L\25\0 \0\0\0\1\0\0\0\30\0\32\0\350L\25\0\4M\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\08M\25\0\1\0\0\0\5\0i\0HM\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02636   896   NtAllocateVirtualMemory  ... 68214784, 8192, ) == 0x0
 02637  1564   NtClose  (604, ...
 02638   896   NtProtectVirtualMemory  (-1, (0x410e000), 4096, 260, ...
 02637  1564   NtClose  ... ) == 0x0
 02638   896   NtProtectVirtualMemory  ... (0x410e000), 4096, 4, ) == 0x0
 02639  1564   NtClose  (580, ...
 02634  1664   NtQueryAttributesFile  ... ) == 0x0
 02639  1564   NtClose  ... ) == 0x0
 02640  1664   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02641   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02640  1664   NtOpenFile  ... 580, {status=0x0, info=1}, ) == 0x0
 02641   896   NtCreateThread  ... 604, {1252, 1300}, ) == 0x0
 02642  1664   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 580, ...
 02643   896   NtQueryInformationThread  (604, Basic, 28, ...
 02642  1664   NtCreateSection  ... 616, ) == 0x0
 02643   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 02644  1664   NtQuerySection  (616, Image, 48, ...
 02645   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\24\5\0\0" ...  ...
 02646  1564   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1330592, 0x0, 11597892, 188, ... 608, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 1}, 0x0, 1330592, 0x0, 11597892, 188, ... 608, 0x0, 0x0, 0x0, 188, ) == 0x0
 02647  1564   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02648  1564   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02649  1564   NtRequestWaitReplyPort  (608, {200, 224, new_msg, 0, 1364448, 12, 2, 1310977}  (608, {200, 224, new_msg, 0, 1364448, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\332\273NY\307Hn~\364\271t\24\333!\244p\12\0\0\0(pZ\345\244\20\217\0\0\0\0\350n\25\0z\225\235c\220eSB(\0\0\0\213\300\0\355\0\0\24\0\240\366\260\0\16#w\3\0\0\0\0xg\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 1564, 81955, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\332\273NY\307Hn~\364\271t\24\333!\244p\12\0\0\0(pZ\345\244\20\217\0\0\0\0\350n\25\0z\225\235c\220eSB(\0\0\0\213\300\0\355\0\0\24\0\240\366\260\0\16#w\3\0\0\0\0xg\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ... {200, 224, reply, 0, 1252, 1564, 81955, 0}  (608, {200, 224, new_msg, 0, 1364448, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\332\273NY\307Hn~\364\271t\24\333!\244p\12\0\0\0(pZ\345\244\20\217\0\0\0\0\350n\25\0z\225\235c\220eSB(\0\0\0\213\300\0\355\0\0\24\0\240\366\260\0\16#w\3\0\0\0\0xg\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 1252, 1564, 81955, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\332\273NY\307Hn~\364\271t\24\333!\244p\12\0\0\0(pZ\345\244\20\217\0\0\0\0\350n\25\0z\225\235c\220eSB(\0\0\0\213\300\0\355\0\0\24\0\240\366\260\0\16#w\3\0\0\0\0xg\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02650  1564   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02644  1664   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02645   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 02651  1664   NtClose  (580, ...
 02652   896   NtResumeThread  (604, ...
 02651  1664   NtClose  ... ) == 0x0
 02652   896   NtResumeThread  ... 1, ) == 0x0
 02653  1664   NtMapViewOfSection  (616, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02654   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02653  1664   NtMapViewOfSection  ... (0x76fb0000), 0x0, 32768, ) == 0x0
 02654   896   NtAllocateVirtualMemory  ... 68222976, 1048576, ) == 0x0
 02655  1664   NtClose  (616, ...
 02656   896   NtAllocateVirtualMemory  (-1, 69263360, 0, 8192, 4096, 4, ...
 02657  1564   NtRequestWaitReplyPort  (608, {56, 80, new_msg, 0, 44, 3, 20, 0}  (608, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0\32\235JO\235\342d\324\312\304\340\351\1\0\0\0\0\0\0\0&\0(\0\224\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02658  1300   NtWaitForSingleObject  (128, 0, 0x0, ...
 02655  1664   NtClose  ... ) == 0x0
 02659  1664   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02660  1664   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02661  1664   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02662  1664   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02663  1664   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02664  1664   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02656   896   NtAllocateVirtualMemory  ... 69263360, 8192, ) == 0x0
 02665   896   NtProtectVirtualMemory  (-1, (0x420e000), 4096, 260, ... (0x420e000), 4096, 4, ) == 0x0
 02666   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 616, {1252, 1024}, ) == 0x0
 02667   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 02668   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 02669   896   NtResumeThread  (616, ... 1, ) == 0x0
 02664  1664   NtFlushInstructionCache  ... ) == 0x0
 02670  1024   NtWaitForSingleObject  (128, 0, 0x0, ...
 02671  1664   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 580, ) }, ... 580, ) == 0x0
 02672  1664   NtMapViewOfSection  (580, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 02673  1664   NtClose  (580, ... ) == 0x0
 02674  1664   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02675   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 69271552, 1048576, ) == 0x0
 02676   896   NtAllocateVirtualMemory  (-1, 70311936, 0, 8192, 4096, 4, ... 70311936, 8192, ) == 0x0
 02677   896   NtProtectVirtualMemory  (-1, (0x430e000), 4096, 260, ... (0x430e000), 4096, 4, ) == 0x0
 02678   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 580, {1252, 1776}, ) == 0x0
 02679   896   NtQueryInformationThread  (580, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 02680   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\360\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\360\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\360\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 02681   896   NtResumeThread  (580, ... 1, ) == 0x0
 02682   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 70320128, 1048576, ) == 0x0
 02683   896   NtAllocateVirtualMemory  (-1, 71360512, 0, 8192, 4096, 4, ...
 02684  1776   NtWaitForSingleObject  (128, 0, 0x0, ...
 02683   896   NtAllocateVirtualMemory  ... 71360512, 8192, ) == 0x0
 02685   896   NtProtectVirtualMemory  (-1, (0x440e000), 4096, 260, ... (0x440e000), 4096, 4, ) == 0x0
 02686   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 500}, ) == 0x0
 02687   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 02688   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 02689   896   NtResumeThread  (620, ... 1, ) == 0x0
 02690   500   NtWaitForSingleObject  (128, 0, 0x0, ...
 02691   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 71368704, 1048576, ) == 0x0
 02692   896   NtAllocateVirtualMemory  (-1, 72409088, 0, 8192, 4096, 4, ... 72409088, 8192, ) == 0x0
 02693   896   NtProtectVirtualMemory  (-1, (0x450e000), 4096, 260, ... (0x450e000), 4096, 4, ) == 0x0
 02694   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 1884}, ) == 0x0
 02695   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 02696   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 02697   896   NtResumeThread  (624, ... 1, ) == 0x0
 02698   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 72417280, 1048576, ) == 0x0
 02699   896   NtAllocateVirtualMemory  (-1, 73457664, 0, 8192, 4096, 4, ...
 02700  1884   NtWaitForSingleObject  (128, 0, 0x0, ...
 02699   896   NtAllocateVirtualMemory  ... 73457664, 8192, ) == 0x0
 02701   896   NtProtectVirtualMemory  (-1, (0x460e000), 4096, 260, ... (0x460e000), 4096, 4, ) == 0x0
 02702   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 628, {1252, 1308}, ) == 0x0
 02703   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 02704   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\34\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\34\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\34\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 02705   896   NtResumeThread  (628, ... 1, ) == 0x0
 02706  1308   NtWaitForSingleObject  (128, 0, 0x0, ...
 02707   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 73465856, 1048576, ) == 0x0
 02708   896   NtAllocateVirtualMemory  (-1, 74506240, 0, 8192, 4096, 4, ... 74506240, 8192, ) == 0x0
 02709   896   NtProtectVirtualMemory  (-1, (0x470e000), 4096, 260, ... (0x470e000), 4096, 4, ) == 0x0
 02710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 1676}, ) == 0x0
 02711   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 02712   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\214\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\214\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\214\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 02713   896   NtResumeThread  (632, ... 1, ) == 0x0
 02714   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74514432, 1048576, ) == 0x0
 02715   896   NtAllocateVirtualMemory  (-1, 75554816, 0, 8192, 4096, 4, ...
 02716  1676   NtWaitForSingleObject  (128, 0, 0x0, ...
 02715   896   NtAllocateVirtualMemory  ... 75554816, 8192, ) == 0x0
 02717   896   NtProtectVirtualMemory  (-1, (0x480e000), 4096, 260, ... (0x480e000), 4096, 4, ) == 0x0
 02718   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1252, 1620}, ) == 0x0
 02719   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 02720   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0T\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0T\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0T\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 02721   896   NtResumeThread  (636, ... 1, ) == 0x0
 02722  1620   NtWaitForSingleObject  (128, 0, 0x0, ...
 02723   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 75563008, 1048576, ) == 0x0
 02724   896   NtAllocateVirtualMemory  (-1, 76603392, 0, 8192, 4096, 4, ... 76603392, 8192, ) == 0x0
 02725   896   NtProtectVirtualMemory  (-1, (0x490e000), 4096, 260, ... (0x490e000), 4096, 4, ) == 0x0
 02726   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 1296}, ) == 0x0
 02727   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 02728   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\20\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 02729   896   NtResumeThread  (640, ... 1, ) == 0x0
 02730   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 76611584, 1048576, ) == 0x0
 02731   896   NtAllocateVirtualMemory  (-1, 77651968, 0, 8192, 4096, 4, ...
 02732  1296   NtWaitForSingleObject  (128, 0, 0x0, ...
 02731   896   NtAllocateVirtualMemory  ... 77651968, 8192, ) == 0x0
 02733   896   NtProtectVirtualMemory  (-1, (0x4a0e000), 4096, 260, ... (0x4a0e000), 4096, 4, ) == 0x0
 02734   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 440}, ) == 0x0
 02735   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 02736   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\270\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\270\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\270\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 02737   896   NtResumeThread  (644, ... 1, ) == 0x0
 02738   440   NtWaitForSingleObject  (128, 0, 0x0, ...
 02739   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 77660160, 1048576, ) == 0x0
 02740   896   NtAllocateVirtualMemory  (-1, 78700544, 0, 8192, 4096, 4, ... 78700544, 8192, ) == 0x0
 02741   896   NtProtectVirtualMemory  (-1, (0x4b0e000), 4096, 260, ... (0x4b0e000), 4096, 4, ) == 0x0
 02742   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 648, {1252, 1588}, ) == 0x0
 02743   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 02744   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\04\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\04\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\04\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 02745   896   NtResumeThread  (648, ... 1, ) == 0x0
 02746   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78708736, 1048576, ) == 0x0
 02747   896   NtAllocateVirtualMemory  (-1, 79749120, 0, 8192, 4096, 4, ...
 02748  1588   NtWaitForSingleObject  (128, 0, 0x0, ...
 02747   896   NtAllocateVirtualMemory  ... 79749120, 8192, ) == 0x0
 02749   896   NtProtectVirtualMemory  (-1, (0x4c0e000), 4096, 260, ... (0x4c0e000), 4096, 4, ) == 0x0
 02750   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 2044}, ) == 0x0
 02751   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 02752   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\374\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 02753   896   NtResumeThread  (652, ... 1, ) == 0x0
 02754  2044   NtWaitForSingleObject  (128, 0, 0x0, ...
 02755   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 79757312, 1048576, ) == 0x0
 02756   896   NtAllocateVirtualMemory  (-1, 80797696, 0, 8192, 4096, 4, ... 80797696, 8192, ) == 0x0
 02757   896   NtProtectVirtualMemory  (-1, (0x4d0e000), 4096, 260, ... (0x4d0e000), 4096, 4, ) == 0x0
 02758   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1252, 588}, ) == 0x0
 02759   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 02760   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0L\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0L\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0L\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 02761   896   NtResumeThread  (656, ... 1, ) == 0x0
 02762   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 80805888, 1048576, ) == 0x0
 02763   896   NtAllocateVirtualMemory  (-1, 81846272, 0, 8192, 4096, 4, ...
 02764   588   NtWaitForSingleObject  (128, 0, 0x0, ...
 02763   896   NtAllocateVirtualMemory  ... 81846272, 8192, ) == 0x0
 02765   896   NtProtectVirtualMemory  (-1, (0x4e0e000), 4096, 260, ... (0x4e0e000), 4096, 4, ) == 0x0
 02766   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 660, {1252, 1652}, ) == 0x0
 02767   896   NtQueryInformationThread  (660, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 02768   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0t\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0t\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0t\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 02769   896   NtResumeThread  (660, ... 1, ) == 0x0
 02770  1652   NtWaitForSingleObject  (128, 0, 0x0, ...
 02771   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 81854464, 1048576, ) == 0x0
 02772   896   NtAllocateVirtualMemory  (-1, 82894848, 0, 8192, 4096, 4, ... 82894848, 8192, ) == 0x0
 02773   896   NtProtectVirtualMemory  (-1, (0x4f0e000), 4096, 260, ... (0x4f0e000), 4096, 4, ) == 0x0
 02774   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 1376}, ) == 0x0
 02775   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 02776   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0`\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 02777   896   NtResumeThread  (664, ... 1, ) == 0x0
 02778   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 82903040, 1048576, ) == 0x0
 02779   896   NtAllocateVirtualMemory  (-1, 83943424, 0, 8192, 4096, 4, ...
 02780  1376   NtWaitForSingleObject  (128, 0, 0x0, ...
 02779   896   NtAllocateVirtualMemory  ... 83943424, 8192, ) == 0x0
 02781   896   NtProtectVirtualMemory  (-1, (0x500e000), 4096, 260, ... (0x500e000), 4096, 4, ) == 0x0
 02782   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1252, 1436}, ) == 0x0
 02783   896   NtQueryInformationThread  (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 02784   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\234\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 02785   896   NtResumeThread  (668, ... 1, ) == 0x0
 02786  1436   NtWaitForSingleObject  (128, 0, 0x0, ...
 02787   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 83951616, 1048576, ) == 0x0
 02788   896   NtAllocateVirtualMemory  (-1, 84992000, 0, 8192, 4096, 4, ... 84992000, 8192, ) == 0x0
 02789   896   NtProtectVirtualMemory  (-1, (0x510e000), 4096, 260, ... (0x510e000), 4096, 4, ) == 0x0
 02790   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 672, {1252, 1368}, ) == 0x0
 02791   896   NtQueryInformationThread  (672, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 02792   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0X\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0X\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0X\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 02793   896   NtResumeThread  (672, ... 1, ) == 0x0
 02794   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 85000192, 1048576, ) == 0x0
 02795   896   NtAllocateVirtualMemory  (-1, 86040576, 0, 8192, 4096, 4, ...
 02796  1368   NtWaitForSingleObject  (128, 0, 0x0, ...
 02795   896   NtAllocateVirtualMemory  ... 86040576, 8192, ) == 0x0
 02797   896   NtProtectVirtualMemory  (-1, (0x520e000), 4096, 260, ... (0x520e000), 4096, 4, ) == 0x0
 02798   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1252, 724}, ) == 0x0
 02799   896   NtQueryInformationThread  (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 02800   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\324\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 02801   896   NtResumeThread  (676, ... 1, ) == 0x0
 02802   724   NtWaitForSingleObject  (128, 0, 0x0, ...
 02803   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 86048768, 1048576, ) == 0x0
 02804   896   NtAllocateVirtualMemory  (-1, 87089152, 0, 8192, 4096, 4, ... 87089152, 8192, ) == 0x0
 02805   896   NtProtectVirtualMemory  (-1, (0x530e000), 4096, 260, ... (0x530e000), 4096, 4, ) == 0x0
 02806   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 680, {1252, 1276}, ) == 0x0
 02807   896   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 02808   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\374\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\374\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\374\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 02809   896   NtResumeThread  (680, ... 1, ) == 0x0
 02810   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 87097344, 1048576, ) == 0x0
 02811   896   NtAllocateVirtualMemory  (-1, 88137728, 0, 8192, 4096, 4, ...
 02812  1276   NtWaitForSingleObject  (128, 0, 0x0, ...
 02811   896   NtAllocateVirtualMemory  ... 88137728, 8192, ) == 0x0
 02813   896   NtProtectVirtualMemory  (-1, (0x540e000), 4096, 260, ... (0x540e000), 4096, 4, ) == 0x0
 02814   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 684, {1252, 220}, ) == 0x0
 02815   896   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 02816   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\334\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 02817   896   NtResumeThread  (684, ... 1, ) == 0x0
 02818   220   NtWaitForSingleObject  (128, 0, 0x0, ...
 02819   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 88145920, 1048576, ) == 0x0
 02820   896   NtAllocateVirtualMemory  (-1, 89186304, 0, 8192, 4096, 4, ... 89186304, 8192, ) == 0x0
 02821   896   NtProtectVirtualMemory  (-1, (0x550e000), 4096, 260, ... (0x550e000), 4096, 4, ) == 0x0
 02822   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1252, 1328}, ) == 0x0
 02823   896   NtQueryInformationThread  (688, Basic, 28, ...
 02824  1664   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 02823   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 02825   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\00\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 02826   896   NtResumeThread  (688, ... 1, ) == 0x0
 02827   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 89194496, 1048576, ) == 0x0
 02828   896   NtAllocateVirtualMemory  (-1, 90234880, 0, 8192, 4096, 4, ... 90234880, 8192, ) == 0x0
 02829   896   NtProtectVirtualMemory  (-1, (0x560e000), 4096, 260, ... (0x560e000), 4096, 4, ) == 0x0
 02824  1664   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 02830  1328   NtWaitForSingleObject  (128, 0, 0x0, ...
 02831  1664   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02832  1664   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02833  1664   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02834  1664   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02835  1664   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02836  1664   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02837   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1252, 1152}, ) == 0x0
 02838   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 02839   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\200\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 02840   896   NtResumeThread  (692, ... 1, ) == 0x0
 02841   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 90243072, 1048576, ) == 0x0
 02842   896   NtAllocateVirtualMemory  (-1, 91283456, 0, 8192, 4096, 4, ...
 02836  1664   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02843  1152   NtWaitForSingleObject  (128, 0, 0x0, ...
 02844  1664   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02842   896   NtAllocateVirtualMemory  ... 91283456, 8192, ) == 0x0
 02845   896   NtProtectVirtualMemory  (-1, (0x570e000), 4096, 260, ... (0x570e000), 4096, 4, ) == 0x0
 02846   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 696, {1252, 1228}, ) == 0x0
 02847   896   NtQueryInformationThread  (696, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 02848   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\314\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\314\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\314\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 02849   896   NtResumeThread  (696, ... 1, ) == 0x0
 02850  1228   NtWaitForSingleObject  (128, 0, 0x0, ...
 02851   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 91291648, 1048576, ) == 0x0
 02852   896   NtAllocateVirtualMemory  (-1, 92332032, 0, 8192, 4096, 4, ... 92332032, 8192, ) == 0x0
 02853   896   NtProtectVirtualMemory  (-1, (0x580e000), 4096, 260, ... (0x580e000), 4096, 4, ) == 0x0
 02854   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 700, {1252, 1484}, ) == 0x0
 02855   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 02856   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 02857   896   NtResumeThread  (700, ... 1, ) == 0x0
 02858   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 92340224, 1048576, ) == 0x0
 02859   896   NtAllocateVirtualMemory  (-1, 93380608, 0, 8192, 4096, 4, ...
 02860  1484   NtWaitForSingleObject  (128, 0, 0x0, ...
 02859   896   NtAllocateVirtualMemory  ... 93380608, 8192, ) == 0x0
 02861   896   NtProtectVirtualMemory  (-1, (0x590e000), 4096, 260, ... (0x590e000), 4096, 4, ) == 0x0
 02862   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 1120}, ) == 0x0
 02863   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 02864   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0`\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 02865   896   NtResumeThread  (704, ... 1, ) == 0x0
 02866  1120   NtWaitForSingleObject  (128, 0, 0x0, ...
 02867   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 93388800, 1048576, ) == 0x0
 02868   896   NtAllocateVirtualMemory  (-1, 94429184, 0, 8192, 4096, 4, ... 94429184, 8192, ) == 0x0
 02869   896   NtProtectVirtualMemory  (-1, (0x5a0e000), 4096, 260, ... (0x5a0e000), 4096, 4, ) == 0x0
 02870   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 708, {1252, 876}, ) == 0x0
 02871   896   NtQueryInformationThread  (708, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 02872   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0l\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 02873   896   NtResumeThread  (708, ... 1, ) == 0x0
 02874   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 94437376, 1048576, ) == 0x0
 02875   896   NtAllocateVirtualMemory  (-1, 95477760, 0, 8192, 4096, 4, ...
 02876   876   NtWaitForSingleObject  (128, 0, 0x0, ...
 02875   896   NtAllocateVirtualMemory  ... 95477760, 8192, ) == 0x0
 02877   896   NtProtectVirtualMemory  (-1, (0x5b0e000), 4096, 260, ... (0x5b0e000), 4096, 4, ) == 0x0
 02878   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 712, {1252, 860}, ) == 0x0
 02879   896   NtQueryInformationThread  (712, Basic, 28, ...
 02657  1564   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 1564, 81956, 0}  ... {44, 68, reply, 0, 1252, 1564, 81956, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02880  1564   NtRaiseException  (11598352, 11597612, 1, ...
 02881  1564   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 02882  1564   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02883  1564   NtContinue  (11596580, 0, ...
 02884  1564   NtDeviceIoControlFile  (404, 148, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ... {status=0x0, info=0}, "", ) == 0x103
 02885  1564   NtWaitForSingleObject  (148, 1, {-5000000, -1}, ...
 02879   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02886   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02887   896   NtResumeThread  (712, ... 1, ) == 0x0
 02888   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 95485952, 1048576, ) == 0x0
 02889   896   NtAllocateVirtualMemory  (-1, 96526336, 0, 8192, 4096, 4, ... 96526336, 8192, ) == 0x0
 02890   896   NtProtectVirtualMemory  (-1, (0x5c0e000), 4096, 260, ... (0x5c0e000), 4096, 4, ) == 0x0
 02891   860   NtWaitForSingleObject  (128, 0, 0x0, ...
 02892   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 716, {1252, 780}, ) == 0x0
 02893   896   NtQueryInformationThread  (716, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02894   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02895   896   NtResumeThread  (716, ... 1, ) == 0x0
 02896   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 96534528, 1048576, ) == 0x0
 02897   896   NtAllocateVirtualMemory  (-1, 97574912, 0, 8192, 4096, 4, ...
 02898   780   NtWaitForSingleObject  (128, 0, 0x0, ...
 02897   896   NtAllocateVirtualMemory  ... 97574912, 8192, ) == 0x0
 02899   896   NtProtectVirtualMemory  (-1, (0x5d0e000), 4096, 260, ... (0x5d0e000), 4096, 4, ) == 0x0
 02900   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 720, {1252, 1268}, ) == 0x0
 02901   896   NtQueryInformationThread  (720, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02902   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81988, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 02903   896   NtResumeThread  (720, ... 1, ) == 0x0
 02904  1268   NtWaitForSingleObject  (128, 0, 0x0, ...
 02905   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 97583104, 1048576, ) == 0x0
 02906   896   NtAllocateVirtualMemory  (-1, 98623488, 0, 8192, 4096, 4, ... 98623488, 8192, ) == 0x0
 02907   896   NtProtectVirtualMemory  (-1, (0x5e0e000), 4096, 260, ... (0x5e0e000), 4096, 4, ) == 0x0
 02908   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 724, {1252, 1736}, ) == 0x0
 02909   896   NtQueryInformationThread  (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02910   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81989, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02911   896   NtResumeThread  (724, ... 1, ) == 0x0
 02912   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 98631680, 1048576, ) == 0x0
 02913   896   NtAllocateVirtualMemory  (-1, 99672064, 0, 8192, 4096, 4, ...
 02914  1736   NtWaitForSingleObject  (128, 0, 0x0, ...
 02913   896   NtAllocateVirtualMemory  ... 99672064, 8192, ) == 0x0
 02915   896   NtProtectVirtualMemory  (-1, (0x5f0e000), 4096, 260, ... (0x5f0e000), 4096, 4, ) == 0x0
 02916   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 728, {1252, 380}, ) == 0x0
 02917   896   NtQueryInformationThread  (728, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 02918   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81990, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 02919   896   NtResumeThread  (728, ... 1, ) == 0x0
 02920   380   NtWaitForSingleObject  (128, 0, 0x0, ...
 02921   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 99680256, 1048576, ) == 0x0
 02922   896   NtAllocateVirtualMemory  (-1, 100720640, 0, 8192, 4096, 4, ... 100720640, 8192, ) == 0x0
 02923   896   NtProtectVirtualMemory  (-1, (0x600e000), 4096, 260, ... (0x600e000), 4096, 4, ) == 0x0
 02924   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 732, {1252, 1336}, ) == 0x0
 02925   896   NtQueryInformationThread  (732, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02926   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81991, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02927   896   NtResumeThread  (732, ... 1, ) == 0x0
 02928   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 100728832, 1048576, ) == 0x0
 02929   896   NtAllocateVirtualMemory  (-1, 101769216, 0, 8192, 4096, 4, ...
 02930  1336   NtWaitForSingleObject  (128, 0, 0x0, ...
 02929   896   NtAllocateVirtualMemory  ... 101769216, 8192, ) == 0x0
 02931   896   NtProtectVirtualMemory  (-1, (0x610e000), 4096, 260, ... (0x610e000), 4096, 4, ) == 0x0
 02932   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 736, {1252, 752}, ) == 0x0
 02933   896   NtQueryInformationThread  (736, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02934   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81992, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02935   896   NtResumeThread  (736, ... 1, ) == 0x0
 02936  1664   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... }, ...
 02937   752   NtWaitForSingleObject  (128, 0, 0x0, ...
 02936  1664   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02938  1664   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 740, ) == 0x0
 02939  1664   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 744, ) }, ... 744, ) == 0x0
 02940  1664   NtQueryValueKey  (744,  (744, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (744, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02941  1664   NtClose  (744, ...
 02942   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 101777408, 1048576, ) == 0x0
 02943   896   NtAllocateVirtualMemory  (-1, 102817792, 0, 8192, 4096, 4, ... 102817792, 8192, ) == 0x0
 02944   896   NtProtectVirtualMemory  (-1, (0x620e000), 4096, 260, ... (0x620e000), 4096, 4, ) == 0x0
 02945   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 748, {1252, 1808}, ) == 0x0
 02946   896   NtQueryInformationThread  (748, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5b000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 02947   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\20\7\0\0" ...  ...
 02941  1664   NtClose  ... ) == 0x0
 02948  1664   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02949  1664   NtQueryPerformanceCounter  (... {-1445037161, 16}, {3579545, 0}, ) == 0x0
 02950  1664   NtSetEventBoostPriority  (128, ...
 02947   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81993, 0}  ... {28, 56, reply, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 02951   896   NtResumeThread  (748, ... 1, ) == 0x0
 02952   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 102825984, 1048576, ) == 0x0
 02953   896   NtAllocateVirtualMemory  (-1, 103866368, 0, 8192, 4096, 4, ... 103866368, 8192, ) == 0x0
 02954   896   NtProtectVirtualMemory  (-1, (0x630e000), 4096, 260, ... (0x630e000), 4096, 4, ) == 0x0
 02955   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 744, {1252, 1380}, ) == 0x0
 02956   896   NtQueryInformationThread  (744, Basic, 28, ...
 02628  1372   NtWaitForSingleObject  ... ) == 0x0
 02950  1664   NtSetEventBoostPriority  ... ) == 0x0
 02957  1808   NtWaitForSingleObject  (128, 0, 0x0, ...
 02958  1372   NtSetEventBoostPriority  (128, ...
 02959  1664   NtWaitForSingleObject  (128, 0, 0x0, ...
 02658  1300   NtWaitForSingleObject  ... ) == 0x0
 02958  1372   NtSetEventBoostPriority  ... ) == 0x0
 02960  1300   NtSetEventBoostPriority  (128, ...
 02956   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5a000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02670  1024   NtWaitForSingleObject  ... ) == 0x0
 02960  1300   NtSetEventBoostPriority  ... ) == 0x0
 02961  1024   NtSetEventBoostPriority  (128, ...
 02962   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0d\5\0\0" ...  ...
 02963  1372   NtTestAlert  (...
 02684  1776   NtWaitForSingleObject  ... ) == 0x0
 02961  1024   NtSetEventBoostPriority  ... ) == 0x0
 02962   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81994, 0}  ... {28, 56, reply, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02964  1776   NtSetEventBoostPriority  (128, ...
 02963  1372   NtTestAlert  ... ) == 0x0
 02965  1300   NtTestAlert  (...
 02690   500   NtWaitForSingleObject  ... ) == 0x0
 02964  1776   NtSetEventBoostPriority  ... ) == 0x0
 02966   896   NtResumeThread  (744, ...
 02967  1372   NtContinue  (67173680, 1, ...
 02968   500   NtSetEventBoostPriority  (128, ...
 02965  1300   NtTestAlert  ... ) == 0x0
 02969  1024   NtTestAlert  (...
 02966   896   NtResumeThread  ... 1, ) == 0x0
 02700  1884   NtWaitForSingleObject  ... ) == 0x0
 02968   500   NtSetEventBoostPriority  ... ) == 0x0
 02970  1372   NtRegisterThreadTerminatePort  (24, ...
 02971  1300   NtContinue  (68222256, 1, ...
 02969  1024   NtTestAlert  ... ) == 0x0
 02972  1776   NtTestAlert  (...
 02973  1380   NtWaitForSingleObject  (128, 0, 0x0, ...
 02974  1884   NtSetEventBoostPriority  (128, ...
 02975   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02970  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 02976  1300   NtRegisterThreadTerminatePort  (24, ...
 02977  1024   NtContinue  (69270832, 1, ...
 02972  1776   NtTestAlert  ... ) == 0x0
 02706  1308   NtWaitForSingleObject  ... ) == 0x0
 02974  1884   NtSetEventBoostPriority  ... ) == 0x0
 02975   896   NtAllocateVirtualMemory  ... 103874560, 1048576, ) == 0x0
 02978  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02976  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 02979  1024   NtRegisterThreadTerminatePort  (24, ...
 02980  1308   NtSetEventBoostPriority  (128, ...
 02981  1776   NtContinue  (70319408, 1, ...
 02982   500   NtTestAlert  (...
 02983   896   NtAllocateVirtualMemory  (-1, 104914944, 0, 8192, 4096, 4, ...
 02984  1884   NtTestAlert  (...
 02985  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02716  1676   NtWaitForSingleObject  ... ) == 0x0
 02980  1308   NtSetEventBoostPriority  ... ) == 0x0
 02979  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 02986  1776   NtRegisterThreadTerminatePort  (24, ...
 02982   500   NtTestAlert  ... ) == 0x0
 02983   896   NtAllocateVirtualMemory  ... 104914944, 8192, ) == 0x0
 02984  1884   NtTestAlert  ... ) == 0x0
 02978  1372   NtDuplicateObject  ... 752, ) == 0x0
 02987  1676   NtSetEventBoostPriority  (128, ...
 02985  1300   NtDuplicateObject  ... 756, ) == 0x0
 02988  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02986  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 02989   500   NtContinue  (71367984, 1, ...
 02990   896   NtProtectVirtualMemory  (-1, (0x640e000), 4096, 260, ...
 02991  1884   NtContinue  (72416560, 1, ...
 02722  1620   NtWaitForSingleObject  ... ) == 0x0
 02987  1676   NtSetEventBoostPriority  ... ) == 0x0
 02992  1372   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02993  1300   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02994  1308   NtTestAlert  (...
 02995  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02996   500   NtRegisterThreadTerminatePort  (24, ...
 02990   896   NtProtectVirtualMemory  ... (0x640e000), 4096, 4, ) == 0x0
 02997  1620   NtSetEventBoostPriority  (128, ...
 02998  1884   NtRegisterThreadTerminatePort  (24, ...
 02988  1024   NtDuplicateObject  ... 760, ) == 0x0
 02992  1372   NtWaitForSingleObject  ... ) == 0x102
 02993  1300   NtWaitForSingleObject  ... ) == 0x102
 02994  1308   NtTestAlert  ... ) == 0x0
 02999  1676   NtTestAlert  (...
 02996   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 02995  1776   NtDuplicateObject  ... 764, ) == 0x0
 02732  1296   NtWaitForSingleObject  ... ) == 0x0
 02997  1620   NtSetEventBoostPriority  ... ) == 0x0
 02998  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 03000  1024   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03001  1372   NtWaitForSingleObject  (172, 0, 0x0, ...
 03002  1300   NtWaitForSingleObject  (172, 0, 0x0, ...
 03003  1308   NtContinue  (73465136, 1, ...
 02999  1676   NtTestAlert  ... ) == 0x0
 03004   500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03005  1296   NtSetEventBoostPriority  (128, ...
 03006  1776   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03007   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03008  1884   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03000  1024   NtWaitForSingleObject  ... ) == 0x102
 03009  1308   NtRegisterThreadTerminatePort  (24, ...
 03010  1676   NtContinue  (74513712, 1, ...
 03011  1620   NtTestAlert  (...
 02738   440   NtWaitForSingleObject  ... ) == 0x0
 03005  1296   NtSetEventBoostPriority  ... ) == 0x0
 03006  1776   NtWaitForSingleObject  ... ) == 0x102
 03007   896   NtCreateThread  ... 768, {1252, 1248}, ) == 0x0
 03004   500   NtDuplicateObject  ... 772, ) == 0x0
 03012  1024   NtWaitForSingleObject  (172, 0, 0x0, ...
 03009  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 03013  1676   NtRegisterThreadTerminatePort  (24, ...
 03014   440   NtSetEventBoostPriority  (128, ...
 03011  1620   NtTestAlert  ... ) == 0x0
 03008  1884   NtDuplicateObject  ... 776, ) == 0x0
 03015  1776   NtWaitForSingleObject  (172, 0, 0x0, ...
 03016   896   NtQueryInformationThread  (768, Basic, 28, ...
 03017   500   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03018  1308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02748  1588   NtWaitForSingleObject  ... ) == 0x0
 03014   440   NtSetEventBoostPriority  ... ) == 0x0
 03013  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 03019  1620   NtContinue  (75562288, 1, ...
 03020  1884   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03016   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff59000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 03017   500   NtWaitForSingleObject  ... ) == 0x102
 03021  1296   NtTestAlert  (...
 03022  1588   NtSetEventBoostPriority  (128, ...
 03018  1308   NtDuplicateObject  ... 780, ) == 0x0
 03023  1676   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03024  1620   NtRegisterThreadTerminatePort  (24, ...
 03020  1884   NtWaitForSingleObject  ... ) == 0x102
 03025   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\0\340\4\0\0" ...  ...
 03026   500   NtWaitForSingleObject  (172, 0, 0x0, ...
 02754  2044   NtWaitForSingleObject  ... ) == 0x0
 03022  1588   NtSetEventBoostPriority  ... ) == 0x0
 03021  1296   NtTestAlert  ... ) == 0x0
 03027  1308   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ...
 03028   440   NtTestAlert  (...
 03024  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 03029  1884   NtWaitForSingleObject  (172, 0, 0x0, ...
 03030  2044   NtWaitForSingleObject  (340, 0, 0x0, ...
 03023  1676   NtDuplicateObject  ... 784, ) == 0x0
 03025   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81995, 0}  ... {28, 56, reply, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 03031  1296   NtContinue  (76610864, 1, ...
 03027  1308   NtAllocateVirtualMemory  ... 1409024, 4096, ) == 0x0
 03028   440   NtTestAlert  ... ) == 0x0
 03032  1620   NtWaitForSingleObject  (340, 0, 0x0, ...
 03033  1676   NtWaitForSingleObject  (340, 0, 0x0, ...
 03034   896   NtResumeThread  (768, ...
 03035  1296   NtRegisterThreadTerminatePort  (24, ...
 03036  1308   NtSetEventBoostPriority  (340, ...
 03037   440   NtContinue  (77659440, 1, ...
 03038  1588   NtTestAlert  (...
 03034   896   NtResumeThread  ... 1, ) == 0x0
 03035  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 03030  2044   NtWaitForSingleObject  ... ) == 0x0
 03036  1308   NtSetEventBoostPriority  ... ) == 0x0
 03039   440   NtRegisterThreadTerminatePort  (24, ...
 03038  1588   NtTestAlert  ... ) == 0x0
 03040   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03041  2044   NtSetEventBoostPriority  (340, ...
 03042  1296   NtWaitForSingleObject  (340, 0, 0x0, ...
 03043  1308   NtWaitForSingleObject  (340, 0, 0x0, ...
 03039   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 03044  1588   NtContinue  (78708016, 1, ...
 03033  1676   NtWaitForSingleObject  ... ) == 0x0
 03041  2044   NtSetEventBoostPriority  ... ) == 0x0
 03040   896   NtAllocateVirtualMemory  ... 104923136, 1048576, ) == 0x0
 03045  1248   NtWaitForSingleObject  (128, 0, 0x0, ...
 03046   440   NtWaitForSingleObject  (340, 0, 0x0, ...
 03047  1676   NtSetEventBoostPriority  (340, ...
 03048  1588   NtRegisterThreadTerminatePort  (24, ...
 03049   896   NtAllocateVirtualMemory  (-1, 105963520, 0, 8192, 4096, 4, ...
 03050  2044   NtSetEventBoostPriority  (128, ...
 03032  1620   NtWaitForSingleObject  ... ) == 0x0
 03047  1676   NtSetEventBoostPriority  ... ) == 0x0
 03048  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 03051  1620   NtSetEventBoostPriority  (340, ...
 02764   588   NtWaitForSingleObject  ... ) == 0x0
 03050  2044   NtSetEventBoostPriority  ... ) == 0x0
 03049   896   NtAllocateVirtualMemory  ... 105963520, 8192, ) == 0x0
 03042  1296   NtWaitForSingleObject  ... ) == 0x0
 03052   588   NtWaitForSingleObject  (340, 0, 0x0, ...
 03053  1588   NtWaitForSingleObject  (340, 0, 0x0, ...
 03054  2044   NtTestAlert  (...
 03055   896   NtProtectVirtualMemory  (-1, (0x650e000), 4096, 260, ...
 03056  1296   NtSetEventBoostPriority  (340, ...
 03051  1620   NtSetEventBoostPriority  ... ) == 0x0
 03057  1676   NtWaitForSingleObject  (340, 0, 0x0, ...
 03054  2044   NtTestAlert  ... ) == 0x0
 03055   896   NtProtectVirtualMemory  ... (0x650e000), 4096, 4, ) == 0x0
 03043  1308   NtWaitForSingleObject  ... ) == 0x0
 03058  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03059  2044   NtContinue  (79756592, 1, ...
 03060   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03061  1308   NtSetEventBoostPriority  (340, ...
 03058  1620   NtDuplicateObject  ... 788, ) == 0x0
 03062  2044   NtRegisterThreadTerminatePort  (24, ...
 03060   896   NtCreateThread  ... 792, {1252, 2064}, ) == 0x0
 03046   440   NtWaitForSingleObject  ... ) == 0x0
 03061  1308   NtSetEventBoostPriority  ... ) == 0x0
 03056  1296   NtSetEventBoostPriority  ... ) == 0x0
 03063  1620   NtWaitForSingleObject  (340, 0, 0x0, ...
 03064   896   NtQueryInformationThread  (792, Basic, 28, ...
 03065   440   NtSetEventBoostPriority  (340, ...
 03066  1308   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03067  1296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03062  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 03052   588   NtWaitForSingleObject  ... ) == 0x0
 03067  1296   NtDuplicateObject  ... 796, ) == 0x0
 03068   588   NtSetEventBoostPriority  (340, ...
 03069  2044   NtWaitForSingleObject  (340, 0, 0x0, ...
 03065   440   NtSetEventBoostPriority  ... ) == 0x0
 03064   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff58000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 03066  1308   NtWaitForSingleObject  ... ) == 0x102
 03057  1676   NtWaitForSingleObject  ... ) == 0x0
 03068   588   NtSetEventBoostPriority  ... ) == 0x0
 03070   440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03071   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\0\20\10\0\0" ...  ...
 03072  1676   NtSetEventBoostPriority  (340, ...
 03073  1308   NtWaitForSingleObject  (340, 0, 0x0, ...
 03074  1296   NtWaitForSingleObject  (340, 0, 0x0, ...
 03070   440   NtDuplicateObject  ... 800, ) == 0x0
 03053  1588   NtWaitForSingleObject  ... ) == 0x0
 03072  1676   NtSetEventBoostPriority  ... ) == 0x0
 03071   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81996, 0}  ... {28, 56, reply, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 03075   588   NtSetEventBoostPriority  (128, ...
 03076  1588   NtSetEventBoostPriority  (340, ...
 03077  1676   NtWaitForSingleObject  (340, 0, 0x0, ...
 03078   896   NtResumeThread  (792, ...
 03063  1620   NtWaitForSingleObject  ... ) == 0x0
 02770  1652   NtWaitForSingleObject  ... ) == 0x0
 03075   588   NtSetEventBoostPriority  ... ) == 0x0
 03076  1588   NtSetEventBoostPriority  ... ) == 0x0
 03079   440   NtWaitForSingleObject  (340, 0, 0x0, ...
 03078   896   NtResumeThread  ... 1, ) == 0x0
 03080  1652   NtWaitForSingleObject  (340, 0, 0x0, ...
 03081  1620   NtSetEventBoostPriority  (340, ...
 03082   588   NtTestAlert  (...
 03083  1588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03084  2064   NtWaitForSingleObject  (128, 0, 0x0, ...
 03069  2044   NtWaitForSingleObject  ... ) == 0x0
 03081  1620   NtSetEventBoostPriority  ... ) == 0x0
 03082   588   NtTestAlert  ... ) == 0x0
 03083  1588   NtDuplicateObject  ... 804, ) == 0x0
 03085  2044   NtSetEventBoostPriority  (340, ...
 03086  1620   NtWaitForSingleObject  (340, 0, 0x0, ...
 03087   588   NtContinue  (80805168, 1, ...
 03088   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03073  1308   NtWaitForSingleObject  ... ) == 0x0
 03085  2044   NtSetEventBoostPriority  ... ) == 0x0
 03089  1588   NtWaitForSingleObject  (340, 0, 0x0, ...
 03090   588   NtRegisterThreadTerminatePort  (24, ...
 03091  1308   NtSetEventBoostPriority  (340, ...
 03088   896   NtAllocateVirtualMemory  ... 105971712, 1048576, ) == 0x0
 03092  2044   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03074  1296   NtWaitForSingleObject  ... ) == 0x0
 03091  1308   NtSetEventBoostPriority  ... ) == 0x0
 03093   896   NtAllocateVirtualMemory  (-1, 107012096, 0, 8192, 4096, 4, ...
 03094  1296   NtSetEventBoostPriority  (340, ...
 03092  2044   NtDuplicateObject  ... 808, ) == 0x0
 03090   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 03079   440   NtWaitForSingleObject  ... ) == 0x0
 03094  1296   NtSetEventBoostPriority  ... ) == 0x0
 03093   896   NtAllocateVirtualMemory  ... 107012096, 8192, ) == 0x0
 03095  2044   NtWaitForSingleObject  (340, 0, 0x0, ...
 03096   440   NtSetEventBoostPriority  (340, ...
 03097   588   NtWaitForSingleObject  (340, 0, 0x0, ...
 03098  1296   NtWaitForSingleObject  (340, 0, 0x0, ...
 03099   896   NtProtectVirtualMemory  (-1, (0x660e000), 4096, 260, ...
 03077  1676   NtWaitForSingleObject  ... ) == 0x0
 03096   440   NtSetEventBoostPriority  ... ) == 0x0
 03100  1308   NtWaitForSingleObject  (172, 0, 0x0, ...
 03101  1676   NtSetEventBoostPriority  (340, ...
 03099   896   NtProtectVirtualMemory  ... (0x660e000), 4096, 4, ) == 0x0
 03102   440   NtWaitForSingleObject  (340, 0, 0x0, ...
 03080  1652   NtWaitForSingleObject  ... ) == 0x0
 03101  1676   NtSetEventBoostPriority  ... ) == 0x0
 03103   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03104  1652   NtSetEventBoostPriority  (340, ...
 03105  1676   NtWaitForSingleObject  (340, 0, 0x0, ...
 03086  1620   NtWaitForSingleObject  ... ) == 0x0
 03104  1652   NtSetEventBoostPriority  ... ) == 0x0
 03103   896   NtCreateThread  ... 812, {1252, 2076}, ) == 0x0
 03106  1620   NtSetEventBoostPriority  (340, ...
 03089  1588   NtWaitForSingleObject  ... ) == 0x0
 03107  1588   NtSetEventBoostPriority  (340, ...
 03095  2044   NtWaitForSingleObject  ... ) == 0x0
 03108  2044   NtSetEventBoostPriority  (340, ...
 03097   588   NtWaitForSingleObject  ... ) == 0x0
 03109   588   NtSetEventBoostPriority  (340, ...
 03098  1296   NtWaitForSingleObject  ... ) == 0x0
 03110  1296   NtSetEventBoostPriority  (340, ...
 03105  1676   NtWaitForSingleObject  ... ) == 0x0
 03111  1676   NtSetEventBoostPriority  (340, ...
 03102   440   NtWaitForSingleObject  ... ) == 0x0
 03112   440   NtWaitForSingleObject  (380, 0, 0x0, ...
 03111  1676   NtSetEventBoostPriority  ... ) == 0x0
 03109   588   NtSetEventBoostPriority  ... ) == 0x0
 03108  2044   NtSetEventBoostPriority  ... ) == 0x0
 03107  1588   NtSetEventBoostPriority  ... ) == 0x0
 03113   896   NtQueryInformationThread  (812, Basic, 28, ...
 03110  1296   NtSetEventBoostPriority  ... ) == 0x0
 03106  1620   NtSetEventBoostPriority  ... ) == 0x0
 03114  1652   NtSetEventBoostPriority  (128, ...
 03115  1676   NtSetEventBoostPriority  (380, ...
 03116   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03117  1588   NtWaitForSingleObject  (380, 0, 0x0, ...
 03113   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff57000,Pid=1252,Tid=2076,}, 0x0, ) == 0x0
 03118  1296   NtWaitForSingleObject  (380, 0, 0x0, ...
 03119  1620   NtWaitForSingleObject  (380, 0, 0x0, ...
 02780  1376   NtWaitForSingleObject  ... ) == 0x0
 03114  1652   NtSetEventBoostPriority  ... ) == 0x0
 03112   440   NtWaitForSingleObject  ... ) == 0x0
 03115  1676   NtSetEventBoostPriority  ... ) == 0x0
 03116   588   NtDuplicateObject  ... 816, ) == 0x0
 03120  2044   NtWaitForSingleObject  (380, 0, 0x0, ...
 03121   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0\34\10\0\0" ...  ...
 03122  1376   NtSetEventBoostPriority  (128, ...
 03123   440   NtSetEventBoostPriority  (380, ...
 03124  1652   NtTestAlert  (...
 03125  1676   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03126   588   NtWaitForSingleObject  (380, 0, 0x0, ...
 02786  1436   NtWaitForSingleObject  ... ) == 0x0
 03118  1296   NtWaitForSingleObject  ... ) == 0x0
 03122  1376   NtSetEventBoostPriority  ... ) == 0x0
 03124  1652   NtTestAlert  ... ) == 0x0
 03125  1676   NtWaitForSingleObject  ... ) == 0x102
 03127  1436   NtSetEventBoostPriority  (128, ...
 03128  1296   NtSetEventBoostPriority  (380, ...
 03123   440   NtSetEventBoostPriority  ... ) == 0x0
 03121   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81997, 0}  ... {28, 56, reply, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0\34\10\0\0" )  ) == 0x0
 03129  1652   NtContinue  (81853744, 1, ...
 02796  1368   NtWaitForSingleObject  ... ) == 0x0
 03127  1436   NtSetEventBoostPriority  ... ) == 0x0
 03130  1676   NtWaitForSingleObject  (172, 0, 0x0, ...
 03119  1620   NtWaitForSingleObject  ... ) == 0x0
 03128  1296   NtSetEventBoostPriority  ... ) == 0x0
 03131  1376   NtTestAlert  (...
 03132   896   NtResumeThread  (812, ...
 03133  1368   NtSetEventBoostPriority  (128, ...
 03134  1652   NtRegisterThreadTerminatePort  (24, ...
 03135   440   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03136  1436   NtTestAlert  (...
 03137  1620   NtSetEventBoostPriority  (380, ...
 03131  1376   NtTestAlert  ... ) == 0x0
 02802   724   NtWaitForSingleObject  ... ) == 0x0
 03133  1368   NtSetEventBoostPriority  ... ) == 0x0
 03132   896   NtResumeThread  ... 1, ) == 0x0
 03138  1296   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03135   440   NtWaitForSingleObject  ... ) == 0x102
 03120  2044   NtWaitForSingleObject  ... ) == 0x0
 03137  1620   NtSetEventBoostPriority  ... ) == 0x0
 03136  1436   NtTestAlert  ... ) == 0x0
 03139   724   NtSetEventBoostPriority  (128, ...
 03140  1376   NtContinue  (82902320, 1, ...
 03134  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 03141  2076   NtWaitForSingleObject  (128, 0, 0x0, ...
 03142   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03138  1296   NtWaitForSingleObject  ... ) == 0x102
 03143  2044   NtSetEventBoostPriority  (380, ...
 03144   440   NtWaitForSingleObject  (172, 0, 0x0, ...
 03145  1368   NtTestAlert  (...
 02812  1276   NtWaitForSingleObject  ... ) == 0x0
 03139   724   NtSetEventBoostPriority  ... ) == 0x0
 03146  1436   NtContinue  (83950896, 1, ...
 03147  1376   NtRegisterThreadTerminatePort  (24, ...
 03148  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03142   896   NtAllocateVirtualMemory  ... 107020288, 1048576, ) == 0x0
 03126   588   NtWaitForSingleObject  ... ) == 0x0
 03143  2044   NtSetEventBoostPriority  ... ) == 0x0
 03149  1296   NtWaitForSingleObject  (172, 0, 0x0, ...
 03150  1276   NtSetEventBoostPriority  (128, ...
 03145  1368   NtTestAlert  ... ) == 0x0
 03151  1620   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03152  1436   NtRegisterThreadTerminatePort  (24, ...
 03147  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 03148  1652   NtDuplicateObject  ... 820, ) == 0x0
 03153   588   NtSetEventBoostPriority  (380, ...
 03154   896   NtAllocateVirtualMemory  (-1, 108060672, 0, 8192, 4096, 4, ...
 03155  2044   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02818   220   NtWaitForSingleObject  ... ) == 0x0
 03150  1276   NtSetEventBoostPriority  ... ) == 0x0
 03156  1368   NtContinue  (84999472, 1, ...
 03151  1620   NtWaitForSingleObject  ... ) == 0x102
 03152  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 03157  1376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03117  1588   NtWaitForSingleObject  ... ) == 0x0
 03153   588   NtSetEventBoostPriority  ... ) == 0x0
 03158  1652   NtWaitForSingleObject  (380, 0, 0x0, ...
 03159   724   NtTestAlert  (...
 03154   896   NtAllocateVirtualMemory  ... 108060672, 8192, ) == 0x0
 03160   220   NtSetEventBoostPriority  (128, ...
 03155  2044   NtWaitForSingleObject  ... ) == 0x102
 03161  1368   NtRegisterThreadTerminatePort  (24, ...
 03162  1620   NtWaitForSingleObject  (172, 0, 0x0, ...
 03163  1436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03164  1276   NtTestAlert  (...
 03165  1588   NtSetEventBoostPriority  (380, ...
 03157  1376   NtDuplicateObject  ... 824, ) == 0x0
 03159   724   NtTestAlert  ... ) == 0x0
 02830  1328   NtWaitForSingleObject  ... ) == 0x0
 03160   220   NtSetEventBoostPriority  ... ) == 0x0
 03166   896   NtProtectVirtualMemory  (-1, (0x670e000), 4096, 260, ...
 03167  2044   NtWaitForSingleObject  (172, 0, 0x0, ...
 03161  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 03168   588   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03158  1652   NtWaitForSingleObject  ... ) == 0x0
 03164  1276   NtTestAlert  ... ) == 0x0
 03169  1376   NtWaitForSingleObject  (380, 0, 0x0, ...
 03170  1328   NtSetEventBoostPriority  (128, ...
 03171   724   NtContinue  (86048048, 1, ...
 03165  1588   NtSetEventBoostPriority  ... ) == 0x0
 03163  1436   NtDuplicateObject  ... 828, ) == 0x0
 03166   896   NtProtectVirtualMemory  ... (0x670e000), 4096, 4, ) == 0x0
 03172  1368   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 03168   588   NtWaitForSingleObject  ... ) == 0x102
 03173  1652   NtWaitForSingleObject  (340, 0, 0x0, ...
 03174  1276   NtContinue  (87096624, 1, ...
 02843  1152   NtWaitForSingleObject  ... ) == 0x0
 03170  1328   NtSetEventBoostPriority  ... ) == 0x0
 03175   724   NtRegisterThreadTerminatePort  (24, ...
 03176  1588   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03177  1436   NtWaitForSingleObject  (340, 0, 0x0, ...
 03178   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03179   220   NtTestAlert  (...
 03180   588   NtWaitForSingleObject  (340, 0, 0x0, ...
 03181  1152   NtWaitForSingleObject  (340, 0, 0x0, ...
 03182  1276   NtRegisterThreadTerminatePort  (24, ...
 03172  1368   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 03175   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 03178   896   NtCreateThread  ... 832, {1252, 2096}, ) == 0x0
 03179   220   NtTestAlert  ... ) == 0x0
 03182  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 03183  1368   NtSetEventBoostPriority  (340, ...
 03184   724   NtWaitForSingleObject  (340, 0, 0x0, ...
 03185   896   NtQueryInformationThread  (832, Basic, 28, ...
 03186   220   NtContinue  (88145200, 1, ...
 03187  1276   NtWaitForSingleObject  (340, 0, 0x0, ...
 03173  1652   NtWaitForSingleObject  ... ) == 0x0
 03183  1368   NtSetEventBoostPriority  ... ) == 0x0
 03188  1328   NtTestAlert  (...
 03176  1588   NtWaitForSingleObject  ... ) == 0x102
 03189   220   NtRegisterThreadTerminatePort  (24, ...
 03185   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff56000,Pid=1252,Tid=2096,}, 0x0, ) == 0x0
 03190  1652   NtSetEventBoostPriority  (340, ...
 03191  1368   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03188  1328   NtTestAlert  ... ) == 0x0
 03192  1588   NtWaitForSingleObject  (340, 0, 0x0, ...
 03189   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 03177  1436   NtWaitForSingleObject  ... ) == 0x0
 03190  1652   NtSetEventBoostPriority  ... ) == 0x0
 03193   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\00\10\0\0" ...  ...
 03191  1368   NtDuplicateObject  ... 836, ) == 0x0
 03194  1328   NtContinue  (89193776, 1, ...
 03195  1436   NtSetEventBoostPriority  (340, ...
 03196   220   NtWaitForSingleObject  (340, 0, 0x0, ...
 03193   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81998, 0}  ... {28, 56, reply, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\00\10\0\0" )  ) == 0x0
 03197  1368   NtWaitForSingleObject  (340, 0, 0x0, ...
 03181  1152   NtWaitForSingleObject  ... ) == 0x0
 03195  1436   NtSetEventBoostPriority  ... ) == 0x0
 03198  1328   NtRegisterThreadTerminatePort  (24, ...
 03199  1652   NtSetEventBoostPriority  (380, ...
 03200   896   NtResumeThread  (832, ...
 03201  1152   NtSetEventBoostPriority  (340, ...
 03198  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 03169  1376   NtWaitForSingleObject  ... ) == 0x0
 03199  1652   NtSetEventBoostPriority  ... ) == 0x0
 03180   588   NtWaitForSingleObject  ... ) == 0x0
 03201  1152   NtSetEventBoostPriority  ... ) == 0x0
 03200   896   NtResumeThread  ... 1, ) == 0x0
 03202  1376   NtWaitForSingleObject  (340, 0, 0x0, ...
 03203  1328   NtWaitForSingleObject  (340, 0, 0x0, ...
 03204   588   NtSetEventBoostPriority  (340, ...
 03205  1652   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03206  1436   NtWaitForSingleObject  (340, 0, 0x0, ...
 03207  2096   NtWaitForSingleObject  (128, 0, 0x0, ...
 03208  1152   NtSetEventBoostPriority  (128, ...
 03209   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03184   724   NtWaitForSingleObject  ... ) == 0x0
 03204   588   NtSetEventBoostPriority  ... ) == 0x0
 03205  1652   NtWaitForSingleObject  ... ) == 0x102
 02850  1228   NtWaitForSingleObject  ... ) == 0x0
 03208  1152   NtSetEventBoostPriority  ... ) == 0x0
 03210   724   NtSetEventBoostPriority  (340, ...
 03209   896   NtAllocateVirtualMemory  ... 108068864, 1048576, ) == 0x0
 03211  1228   NtWaitForSingleObject  (340, 0, 0x0, ...
 03212  1652   NtWaitForSingleObject  (172, 0, 0x0, ...
 03192  1588   NtWaitForSingleObject  ... ) == 0x0
 03213  1152   NtTestAlert  (...
 03214   896   NtAllocateVirtualMemory  (-1, 109109248, 0, 8192, 4096, 4, ...
 03210   724   NtSetEventBoostPriority  ... ) == 0x0
 03215   588   NtWaitForSingleObject  (172, 0, 0x0, ...
 03216  1588   NtSetEventBoostPriority  (340, ...
 03213  1152   NtTestAlert  ... ) == 0x0
 03214   896   NtAllocateVirtualMemory  ... 109109248, 8192, ) == 0x0
 03217   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03187  1276   NtWaitForSingleObject  ... ) == 0x0
 03216  1588   NtSetEventBoostPriority  ... ) == 0x0
 03218  1152   NtContinue  (90242352, 1, ...
 03219   896   NtProtectVirtualMemory  (-1, (0x680e000), 4096, 260, ...
 03220  1276   NtSetEventBoostPriority  (340, ...
 03217   724   NtDuplicateObject  ... 840, ) == 0x0
 03221  1152   NtRegisterThreadTerminatePort  (24, ...
 03196   220   NtWaitForSingleObject  ... ) == 0x0
 03219   896   NtProtectVirtualMemory  ... (0x680e000), 4096, 4, ) == 0x0
 03220  1276   NtSetEventBoostPriority  ... ) == 0x0
 03222  1588   NtWaitForSingleObject  (172, 0, 0x0, ...
 03223   724   NtWaitForSingleObject  (340, 0, 0x0, ...
 03224   220   NtSetEventBoostPriority  (340, ...
 03221  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 03225  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03197  1368   NtWaitForSingleObject  ... ) == 0x0
 03226  1152   NtWaitForSingleObject  (340, 0, 0x0, ...
 03225  1276   NtDuplicateObject  ... 844, ) == 0x0
 03227  1368   NtSetEventBoostPriority  (340, ...
 03224   220   NtSetEventBoostPriority  ... ) == 0x0
 03228   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03202  1376   NtWaitForSingleObject  ... ) == 0x0
 03229   220   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03230  1376   NtSetEventBoostPriority  (340, ...
 03228   896   NtCreateThread  ... 848, {1252, 2120}, ) == 0x0
 03206  1436   NtWaitForSingleObject  ... ) == 0x0
 03230  1376   NtSetEventBoostPriority  ... ) == 0x0
 03229   220   NtDuplicateObject  ... 852, ) == 0x0
 03231  1436   NtSetEventBoostPriority  (340, ...
 03232   896   NtQueryInformationThread  (848, Basic, 28, ...
 03227  1368   NtSetEventBoostPriority  ... ) == 0x0
 03233  1276   NtWaitForSingleObject  (340, 0, 0x0, ...
 03234  1376   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03203  1328   NtWaitForSingleObject  ... ) == 0x0
 03231  1436   NtSetEventBoostPriority  ... ) == 0x0
 03232   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff55000,Pid=1252,Tid=2120,}, 0x0, ) == 0x0
 03235  1368   NtWaitForSingleObject  (340, 0, 0x0, ...
 03236  1328   NtSetEventBoostPriority  (340, ...
 03234  1376   NtWaitForSingleObject  ... ) == 0x102
 03237  1436   NtWaitForSingleObject  (340, 0, 0x0, ...
 03238   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0H\10\0\0" ...  ...
 03211  1228   NtWaitForSingleObject  ... ) == 0x0
 03239  1376   NtWaitForSingleObject  (340, 0, 0x0, ...
 03236  1328   NtSetEventBoostPriority  ... ) == 0x0
 03240   220   NtWaitForSingleObject  (340, 0, 0x0, ...
 03241  1228   NtSetEventBoostPriority  (340, ...
 03242  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03223   724   NtWaitForSingleObject  ... ) == 0x0
 03241  1228   NtSetEventBoostPriority  ... ) == 0x0
 03243   724   NtSetEventBoostPriority  (340, ...
 03242  1328   NtDuplicateObject  ... 856, ) == 0x0
 03238   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81999, 0}  ... {28, 56, reply, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0H\10\0\0" )  ) == 0x0
 03226  1152   NtWaitForSingleObject  ... ) == 0x0
 03243   724   NtSetEventBoostPriority  ... ) == 0x0
 03244  1228   NtSetEventBoostPriority  (128, ...
 03245  1152   NtSetEventBoostPriority  (340, ...
 03246   896   NtResumeThread  (848, ...
 03247   724   NtWaitForSingleObject  (340, 0, 0x0, ...
 03233  1276   NtWaitForSingleObject  ... ) == 0x0
 03245  1152   NtSetEventBoostPriority  ... ) == 0x0
 02860  1484   NtWaitForSingleObject  ... ) == 0x0
 03244  1228   NtSetEventBoostPriority  ... ) == 0x0
 03246   896   NtResumeThread  ... 1, ) == 0x0
 03248  1328   NtWaitForSingleObject  (340, 0, 0x0, ...
 03249  1276   NtSetEventBoostPriority  (340, ...
 03250  2120   NtWaitForSingleObject  (128, 0, 0x0, ...
 03251  1484   NtWaitForSingleObject  (340, 0, 0x0, ...
 03252  1228   NtTestAlert  (...
 03253   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03235  1368   NtWaitForSingleObject  ... ) == 0x0
 03249  1276   NtSetEventBoostPriority  ... ) == 0x0
 03252  1228   NtTestAlert  ... ) == 0x0
 03254  1368   NtSetEventBoostPriority  (340, ...
 03253   896   NtAllocateVirtualMemory  ... 109117440, 1048576, ) == 0x0
 03255  1276   NtWaitForSingleObject  (340, 0, 0x0, ...
 03239  1376   NtWaitForSingleObject  ... ) == 0x0
 03254  1368   NtSetEventBoostPriority  ... ) == 0x0
 03256  1228   NtContinue  (91290928, 1, ...
 03257   896   NtAllocateVirtualMemory  (-1, 110157824, 0, 8192, 4096, 4, ...
 03258  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03259  1376   NtSetEventBoostPriority  (340, ...
 03260  1228   NtRegisterThreadTerminatePort  (24, ...
 03261  1368   NtWaitForSingleObject  (340, 0, 0x0, ...
 03240   220   NtWaitForSingleObject  ... ) == 0x0
 03259  1376   NtSetEventBoostPriority  ... ) == 0x0
 03258  1152   NtDuplicateObject  ... 860, ) == 0x0
 03257   896   NtAllocateVirtualMemory  ... 110157824, 8192, ) == 0x0
 03262   220   NtSetEventBoostPriority  (340, ...
 03260  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 03263  1152   NtWaitForSingleObject  (340, 0, 0x0, ...
 03237  1436   NtWaitForSingleObject  ... ) == 0x0
 03262   220   NtSetEventBoostPriority  ... ) == 0x0
 03264   896   NtProtectVirtualMemory  (-1, (0x690e000), 4096, 260, ...
 03265  1228   NtWaitForSingleObject  (340, 0, 0x0, ...
 03266  1436   NtSetEventBoostPriority  (340, ...
 03267   220   NtWaitForSingleObject  (340, 0, 0x0, ...
 03264   896   NtProtectVirtualMemory  ... (0x690e000), 4096, 4, ) == 0x0
 03247   724   NtWaitForSingleObject  ... ) == 0x0
 03266  1436   NtSetEventBoostPriority  ... ) == 0x0
 03268  1376   NtWaitForSingleObject  (172, 0, 0x0, ...
 03269   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03270   724   NtSetEventBoostPriority  (340, ...
 03271  1436   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03269   896   NtCreateThread  ... 864, {1252, 2124}, ) == 0x0
 03248  1328   NtWaitForSingleObject  ... ) == 0x0
 03272   896   NtQueryInformationThread  (864, Basic, 28, ...
 03273  1328   NtSetEventBoostPriority  (340, ...
 03270   724   NtSetEventBoostPriority  ... ) == 0x0
 03271  1436   NtWaitForSingleObject  ... ) == 0x102
 03251  1484   NtWaitForSingleObject  ... ) == 0x0
 03273  1328   NtSetEventBoostPriority  ... ) == 0x0
 03274   724   NtWaitForSingleObject  (340, 0, 0x0, ...
 03275  1484   NtSetEventBoostPriority  (340, ...
 03276  1436   NtWaitForSingleObject  (172, 0, 0x0, ...
 03277  1328   NtWaitForSingleObject  (340, 0, 0x0, ...
 03255  1276   NtWaitForSingleObject  ... ) == 0x0
 03275  1484   NtSetEventBoostPriority  ... ) == 0x0
 03272   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff54000,Pid=1252,Tid=2124,}, 0x0, ) == 0x0
 03278  1276   NtSetEventBoostPriority  (340, ...
 03261  1368   NtWaitForSingleObject  ... ) == 0x0
 03279  1368   NtSetEventBoostPriority  (340, ...
 03263  1152   NtWaitForSingleObject  ... ) == 0x0
 03280  1152   NtSetEventBoostPriority  (340, ...
 03265  1228   NtWaitForSingleObject  ... ) == 0x0
 03281  1228   NtSetEventBoostPriority  (340, ...
 03267   220   NtWaitForSingleObject  ... ) == 0x0
 03282   220   NtSetEventBoostPriority  (340, ...
 03274   724   NtWaitForSingleObject  ... ) == 0x0
 03283   724   NtSetEventBoostPriority  (340, ...
 03277  1328   NtWaitForSingleObject  ... ) == 0x0
 03284  1328   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03285  1328   NtWaitForSingleObject  (172, 0, 0x0, ...
 03283   724   NtSetEventBoostPriority  ... ) == 0x0
 03281  1228   NtSetEventBoostPriority  ... ) == 0x0
 03280  1152   NtSetEventBoostPriority  ... ) == 0x0
 03279  1368   NtSetEventBoostPriority  ... ) == 0x0
 03286   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0L\10\0\0" ...  ...
 03282   220   NtSetEventBoostPriority  ... ) == 0x0
 03278  1276   NtSetEventBoostPriority  ... ) == 0x0
 03287  1484   NtSetEventBoostPriority  (128, ...
 03288   724   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03289  1228   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03290  1368   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03286   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82000, 0}  ... {28, 56, reply, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0L\10\0\0" )  ) == 0x0
 03291   220   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03292  1276   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02866  1120   NtWaitForSingleObject  ... ) == 0x0
 03287  1484   NtSetEventBoostPriority  ... ) == 0x0
 03288   724   NtWaitForSingleObject  ... ) == 0x102
 03289  1228   NtDuplicateObject  ... 868, ) == 0x0
 03293  1152   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03294   896   NtResumeThread  (864, ...
 03295  1120   NtSetEventBoostPriority  (128, ...
 03296  1484   NtTestAlert  (...
 03297   724   NtWaitForSingleObject  (172, 0, 0x0, ...
 03298  1228   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03293  1152   NtWaitForSingleObject  ... ) == 0x102
 02876   876   NtWaitForSingleObject  ... ) == 0x0
 03295  1120   NtSetEventBoostPriority  ... ) == 0x0
 03294   896   NtResumeThread  ... 1, ) == 0x0
 03296  1484   NtTestAlert  ... ) == 0x0
 03298  1228   NtWaitForSingleObject  ... ) == 0x102
 03299   876   NtAllocateVirtualMemory  (-1, 3633152, 0, 4096, 4096, 4, ...
 03300  1152   NtWaitForSingleObject  (172, 0, 0x0, ...
 03290  1368   NtWaitForSingleObject  ... ) == 0x102
 03291   220   NtWaitForSingleObject  ... ) == 0x102
 03292  1276   NtWaitForSingleObject  ... ) == 0x102
 03301  2124   NtWaitForSingleObject  (128, 0, 0x0, ...
 03302  1120   NtTestAlert  (...
 03303  1484   NtContinue  (92339504, 1, ...
 03299   876   NtAllocateVirtualMemory  ... 3633152, 4096, ) == 0x0
 03304  1228   NtWaitForSingleObject  (172, 0, 0x0, ...
 03305  1368   NtWaitForSingleObject  (172, 0, 0x0, ...
 03306   220   NtWaitForSingleObject  (172, 0, 0x0, ...
 03307  1276   NtWaitForSingleObject  (172, 0, 0x0, ...
 03302  1120   NtTestAlert  ... ) == 0x0
 03308  1484   NtRegisterThreadTerminatePort  (24, ...
 03309   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03310   876   NtSetEventBoostPriority  (128, ...
 03311  1120   NtContinue  (93388080, 1, ...
 03309   896   NtAllocateVirtualMemory  ... 110166016, 1048576, ) == 0x0
 02891   860   NtWaitForSingleObject  ... ) == 0x0
 03310   876   NtSetEventBoostPriority  ... ) == 0x0
 03312  1120   NtRegisterThreadTerminatePort  (24, ...
 03313   860   NtSetEventBoostPriority  (128, ...
 03314   896   NtAllocateVirtualMemory  (-1, 111206400, 0, 8192, 4096, 4, ...
 03315   876   NtTestAlert  (...
 02898   780   NtWaitForSingleObject  ... ) == 0x0
 03313   860   NtSetEventBoostPriority  ... ) == 0x0
 03312  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 03314   896   NtAllocateVirtualMemory  ... 111206400, 8192, ) == 0x0
 03316   780   NtSetEventBoostPriority  (128, ...
 03315   876   NtTestAlert  ... ) == 0x0
 03308  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 03317  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02904  1268   NtWaitForSingleObject  ... ) == 0x0
 03316   780   NtSetEventBoostPriority  ... ) == 0x0
 03318   896   NtProtectVirtualMemory  (-1, (0x6a0e000), 4096, 260, ...
 03319   876   NtContinue  (94436656, 1, ...
 03320  1484   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 03321   860   NtTestAlert  (...
 03322  1268   NtWaitForSingleObject  (340, 0, 0x0, ...
 03317  1120   NtDuplicateObject  ... 872, ) == 0x0
 03318   896   NtProtectVirtualMemory  ... (0x6a0e000), 4096, 4, ) == 0x0
 03323   876   NtRegisterThreadTerminatePort  (24, ...
 03320  1484   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 03321   860   NtTestAlert  ... ) == 0x0
 03324  1120   NtWaitForSingleObject  (340, 0, 0x0, ...
 03325   780   NtTestAlert  (...
 03326   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03327  1484   NtSetEventBoostPriority  (340, ...
 03328   860   NtContinue  (95485232, 1, ...
 03325   780   NtTestAlert  ... ) == 0x0
 03326   896   NtCreateThread  ... 876, {1252, 2140}, ) == 0x0
 03322  1268   NtWaitForSingleObject  ... ) == 0x0
 03327  1484   NtSetEventBoostPriority  ... ) == 0x0
 03329   860   NtRegisterThreadTerminatePort  (24, ...
 03330   780   NtContinue  (96533808, 1, ...
 03331  1268   NtSetEventBoostPriority  (340, ...
 03332   896   NtQueryInformationThread  (876, Basic, 28, ...
 03333  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03329   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 03324  1120   NtWaitForSingleObject  ... ) == 0x0
 03331  1268   NtSetEventBoostPriority  ... ) == 0x0
 03334   780   NtRegisterThreadTerminatePort  (24, ...
 03332   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff53000,Pid=1252,Tid=2140,}, 0x0, ) == 0x0
 03323   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 03335  1120   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03336   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03333  1484   NtDuplicateObject  ... 880, ) == 0x0
 03334   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 03337   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\3\0\0\344\4\0\0\\10\0\0" ...  ...
 03338   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03339  1268   NtSetEventBoostPriority  (128, ...
 03340  1484   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03341   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03338   876   NtDuplicateObject  ... 884, ) == 0x0
 02914  1736   NtWaitForSingleObject  ... ) == 0x0
 03339  1268   NtSetEventBoostPriority  ... ) == 0x0
 03340  1484   NtWaitForSingleObject  ... ) == 0x102
 03336   860   NtDuplicateObject  ... 888, ) == 0x0
 03335  1120   NtWaitForSingleObject  ... ) == 0x102
 03337   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82001, 0}  ... {28, 56, reply, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\3\0\0\344\4\0\0\\10\0\0" )  ) == 0x0
 03342  1736   NtSetEventBoostPriority  (128, ...
 03343   876   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03344  1268   NtTestAlert  (...
 03345  1484   NtWaitForSingleObject  (172, 0, 0x0, ...
 03346   860   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03347  1120   NtWaitForSingleObject  (172, 0, 0x0, ...
 02920   380   NtWaitForSingleObject  ... ) == 0x0
 03342  1736   NtSetEventBoostPriority  ... ) == 0x0
 03348   896   NtResumeThread  (876, ...
 03343   876   NtWaitForSingleObject  ... ) == 0x102
 03344  1268   NtTestAlert  ... ) == 0x0
 03346   860   NtWaitForSingleObject  ... ) == 0x102
 03349   380   NtSetEventBoostPriority  (128, ...
 03341   780   NtDuplicateObject  ... 892, ) == 0x0
 03348   896   NtResumeThread  ... 1, ) == 0x0
 03350  1736   NtTestAlert  (...
 03351  1268   NtContinue  (97582384, 1, ...
 02930  1336   NtWaitForSingleObject  ... ) == 0x0
 03349   380   NtSetEventBoostPriority  ... ) == 0x0
 03352   860   NtWaitForSingleObject  (172, 0, 0x0, ...
 03353   780   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03354   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03350  1736   NtTestAlert  ... ) == 0x0
 03355  1336   NtSetEventBoostPriority  (128, ...
 03356  1268   NtRegisterThreadTerminatePort  (24, ...
 03357   876   NtWaitForSingleObject  (172, 0, 0x0, ...
 03358  2140   NtWaitForSingleObject  (128, 0, 0x0, ...
 03353   780   NtWaitForSingleObject  ... ) == 0x102
 03354   896   NtAllocateVirtualMemory  ... 111214592, 1048576, ) == 0x0
 02937   752   NtWaitForSingleObject  ... ) == 0x0
 03355  1336   NtSetEventBoostPriority  ... ) == 0x0
 03359  1736   NtContinue  (98630960, 1, ...
 03360   380   NtTestAlert  (...
 03361   780   NtWaitForSingleObject  (172, 0, 0x0, ...
 03362   752   NtSetEventBoostPriority  (128, ...
 03363   896   NtAllocateVirtualMemory  (-1, 112254976, 0, 8192, 4096, 4, ...
 03356  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 03364  1736   NtRegisterThreadTerminatePort  (24, ...
 03360   380   NtTestAlert  ... ) == 0x0
 02957  1808   NtWaitForSingleObject  ... ) == 0x0
 03362   752   NtSetEventBoostPriority  ... ) == 0x0
 03365  1336   NtTestAlert  (...
 03366  1268   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03364  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 03367  1808   NtSetEventBoostPriority  (128, ...
 03368   380   NtContinue  (99679536, 1, ...
 03363   896   NtAllocateVirtualMemory  ... 112254976, 8192, ) == 0x0
 03365  1336   NtTestAlert  ... ) == 0x0
 03366  1268   NtDuplicateObject  ... 896, ) == 0x0
 02959  1664   NtWaitForSingleObject  ... ) == 0x0
 03367  1808   NtSetEventBoostPriority  ... ) == 0x0
 03369  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03370   380   NtRegisterThreadTerminatePort  (24, ...
 03371   896   NtProtectVirtualMemory  (-1, (0x6b0e000), 4096, 260, ...
 03372  1336   NtContinue  (100728112, 1, ...
 03373  1664   NtSetEventBoostPriority  (128, ...
 03374  1268   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03375   752   NtTestAlert  (...
 03376  1808   NtTestAlert  (...
 03370   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 03371   896   NtProtectVirtualMemory  ... (0x6b0e000), 4096, 4, ) == 0x0
 02973  1380   NtWaitForSingleObject  ... ) == 0x0
 03373  1664   NtSetEventBoostPriority  ... ) == 0x0
 03377  1336   NtRegisterThreadTerminatePort  (24, ...
 03374  1268   NtWaitForSingleObject  ... ) == 0x102
 03375   752   NtTestAlert  ... ) == 0x0
 03376  1808   NtTestAlert  ... ) == 0x0
 03378   380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03379  1380   NtSetEventBoostPriority  (128, ...
 03380   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03369  1736   NtDuplicateObject  ... 900, ) == 0x0
 03377  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 03381  1664   NtWaitForSingleObject  (128, 0, 0x0, ...
 03382   752   NtContinue  (101776688, 1, ...
 03383  1808   NtContinue  (102825264, 1, ...
 03384  1268   NtWaitForSingleObject  (172, 0, 0x0, ...
 03045  1248   NtWaitForSingleObject  ... ) == 0x0
 03379  1380   NtSetEventBoostPriority  ... ) == 0x0
 03380   896   NtCreateThread  ... 904, {1252, 2144}, ) == 0x0
 03385  1736   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03386  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03387   752   NtRegisterThreadTerminatePort  (24, ...
 03388  1808   NtRegisterThreadTerminatePort  (24, ...
 03389  1248   NtSetEventBoostPriority  (128, ...
 03378   380   NtDuplicateObject  ... 908, ) == 0x0
 03390   896   NtQueryInformationThread  (904, Basic, 28, ...
 03385  1736   NtWaitForSingleObject  ... ) == 0x102
 03391  1380   NtTestAlert  (...
 03387   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 03084  2064   NtWaitForSingleObject  ... ) == 0x0
 03389  1248   NtSetEventBoostPriority  ... ) == 0x0
 03388  1808   NtRegisterThreadTerminatePort  ... ) == 0x0
 03392   380   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03386  1336   NtDuplicateObject  ... 912, ) == 0x0
 03393  1736   NtWaitForSingleObject  (172, 0, 0x0, ...
 03391  1380   NtTestAlert  ... ) == 0x0
 03394  2064   NtSetEventBoostPriority  (128, ...
 03395   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03390   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff52000,Pid=1252,Tid=2144,}, 0x0, ) == 0x0
 03396  1808   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03392   380   NtWaitForSingleObject  ... ) == 0x102
 03397  1336   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ...
 03141  2076   NtWaitForSingleObject  ... ) == 0x0
 03394  2064   NtSetEventBoostPriority  ... ) == 0x0
 03398  1380   NtContinue  (103873840, 1, ...
 03399  1248   NtTestAlert  (...
 03400   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\3\0\0\344\4\0\0`\10\0\0" ...  ...
 03395   752   NtDuplicateObject  ... 916, ) == 0x0
 03401   380   NtWaitForSingleObject  (172, 0, 0x0, ...
 03402  2076   NtWaitForSingleObject  (340, 0, 0x0, ...
 03397  1336   NtAllocateVirtualMemory  ... 1421312, 4096, ) == 0x0
 03396  1808   NtDuplicateObject  ... 920, ) == 0x0
 03403  1380   NtRegisterThreadTerminatePort  (24, ...
 03399  1248   NtTestAlert  ... ) == 0x0
 03400   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82002, 0}  ... {28, 56, reply, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\3\0\0\344\4\0\0`\10\0\0" )  ) == 0x0
 03404   752   NtWaitForSingleObject  (340, 0, 0x0, ...
 03405  1336   NtSetEventBoostPriority  (340, ...
 03406  1808   NtWaitForSingleObject  (340, 0, 0x0, ...
 03403  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 03407  1248   NtContinue  (104922416, 1, ...
 03408   896   NtResumeThread  (904, ...
 03402  2076   NtWaitForSingleObject  ... ) == 0x0
 03405  1336   NtSetEventBoostPriority  ... ) == 0x0
 03409  1380   NtWaitForSingleObject  (340, 0, 0x0, ...
 03410  1248   NtRegisterThreadTerminatePort  (24, ...
 03411  2076   NtSetEventBoostPriority  (340, ...
 03408   896   NtResumeThread  ... 1, ) == 0x0
 03412  1336   NtWaitForSingleObject  (340, 0, 0x0, ...
 03413  2064   NtTestAlert  (...
 03414  2144   NtWaitForSingleObject  (128, 0, 0x0, ...
 03404   752   NtWaitForSingleObject  ... ) == 0x0
 03411  2076   NtSetEventBoostPriority  ... ) == 0x0
 03410  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 03415   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03413  2064   NtTestAlert  ... ) == 0x0
 03416   752   NtSetEventBoostPriority  (340, ...
 03417  1248   NtWaitForSingleObject  (340, 0, 0x0, ...
 03415   896   NtAllocateVirtualMemory  ... 112263168, 1048576, ) == 0x0
 03406  1808   NtWaitForSingleObject  ... ) == 0x0
 03416   752   NtSetEventBoostPriority  ... ) == 0x0
 03418  2064   NtContinue  (105970992, 1, ...
 03419  2076   NtSetEventBoostPriority  (128, ...
 03420  1808   NtSetEventBoostPriority  (340, ...
 03421   896   NtAllocateVirtualMemory  (-1, 113303552, 0, 8192, 4096, 4, ...
 03422  2064   NtRegisterThreadTerminatePort  (24, ...
 03409  1380   NtWaitForSingleObject  ... ) == 0x0
 03420  1808   NtSetEventBoostPriority  ... ) == 0x0
 03207  2096   NtWaitForSingleObject  ... ) == 0x0
 03419  2076   NtSetEventBoostPriority  ... ) == 0x0
 03421   896   NtAllocateVirtualMemory  ... 113303552, 8192, ) == 0x0
 03423  1380   NtSetEventBoostPriority  (340, ...
 03422  2064   NtRegisterThreadTerminatePort  ... ) == 0x0
 03424   752   NtWaitForSingleObject  (340, 0, 0x0, ...
 03425  2096   NtWaitForSingleObject  (340, 0, 0x0, ...
 03426  2076   NtTestAlert  (...
 03412  1336   NtWaitForSingleObject  ... ) == 0x0
 03427   896   NtProtectVirtualMemory  (-1, (0x6c0e000), 4096, 260, ...
 03428  2064   NtWaitForSingleObject  (340, 0, 0x0, ...
 03426  2076   NtTestAlert  ... ) == 0x0
 03429  1336   NtSetEventBoostPriority  (340, ...
 03427   896   NtProtectVirtualMemory  ... (0x6c0e000), 4096, 4, ) == 0x0
 03423  1380   NtSetEventBoostPriority  ... ) == 0x0
 03430  1808   NtWaitForSingleObject  (340, 0, 0x0, ...
 03431  2076   NtContinue  (107019568, 1, ...
 03417  1248   NtWaitForSingleObject  ... ) == 0x0
 03429  1336   NtSetEventBoostPriority  ... ) == 0x0
 03432  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03433  2076   NtRegisterThreadTerminatePort  (24, ...
 03434  1248   NtSetEventBoostPriority  (340, ...
 03435  1336   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03432  1380   NtDuplicateObject  ... 924, ) == 0x0
 03436   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03425  2096   NtWaitForSingleObject  ... ) == 0x0
 03435  1336   NtWaitForSingleObject  ... ) == 0x102
 03434  1248   NtSetEventBoostPriority  ... ) == 0x0
 03433  2076   NtRegisterThreadTerminatePort  ... ) == 0x0
 03437  2096   NtSetEventBoostPriority  (340, ...
 03436   896   NtCreateThread  ... 928, {1252, 2160}, ) == 0x0
 03438  1336   NtWaitForSingleObject  (340, 0, 0x0, ...
 03439  1248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03424   752   NtWaitForSingleObject  ... ) == 0x0
 03437  2096   NtSetEventBoostPriority  ... ) == 0x0
 03440  2076   NtWaitForSingleObject  (340, 0, 0x0, ...
 03441   896   NtQueryInformationThread  (928, Basic, 28, ...
 03442   752   NtSetEventBoostPriority  (340, ...
 03439  1248   NtDuplicateObject  ... 932, ) == 0x0
 03443  1380   NtWaitForSingleObject  (340, 0, 0x0, ...
 03428  2064   NtWaitForSingleObject  ... ) == 0x0
 03442   752   NtSetEventBoostPriority  ... ) == 0x0
 03441   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff51000,Pid=1252,Tid=2160,}, 0x0, ) == 0x0
 03444  2096   NtSetEventBoostPriority  (128, ...
 03445  2064   NtSetEventBoostPriority  (340, ...
 03446   752   NtWaitForSingleObject  (340, 0, 0x0, ...
 03447   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0p\10\0\0" ...  ...
 03430  1808   NtWaitForSingleObject  ... ) == 0x0
 03250  2120   NtWaitForSingleObject  ... ) == 0x0
 03444  2096   NtSetEventBoostPriority  ... ) == 0x0
 03445  2064   NtSetEventBoostPriority  ... ) == 0x0
 03448  1248   NtWaitForSingleObject  (340, 0, 0x0, ...
 03449  2120   NtWaitForSingleObject  (340, 0, 0x0, ...
 03450  1808   NtSetEventBoostPriority  (340, ...
 03451  2096   NtTestAlert  (...
 03452  2064   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03438  1336   NtWaitForSingleObject  ... ) == 0x0
 03450  1808   NtSetEventBoostPriority  ... ) == 0x0
 03451  2096   NtTestAlert  ... ) == 0x0
 03453  1336   NtSetEventBoostPriority  (340, ...
 03452  2064   NtDuplicateObject  ... 936, ) == 0x0
 03454  1808   NtWaitForSingleObject  (340, 0, 0x0, ...
 03440  2076   NtWaitForSingleObject  ... ) == 0x0
 03453  1336   NtSetEventBoostPriority  ... ) == 0x0
 03455  2096   NtContinue  (108068144, 1, ...
 03447   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82003, 0}  ... {28, 56, reply, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0p\10\0\0" )  ) == 0x0
 03456  2064   NtWaitForSingleObject  (340, 0, 0x0, ...
 03457  2076   NtSetEventBoostPriority  (340, ...
 03458  2096   NtRegisterThreadTerminatePort  (24, ...
 03459   896   NtResumeThread  (928, ...
 03443  1380   NtWaitForSingleObject  ... ) == 0x0
 03457  2076   NtSetEventBoostPriority  ... ) == 0x0
 03460  1336   NtWaitForSingleObject  (172, 0, 0x0, ...
 03461  1380   NtSetEventBoostPriority  (340, ...
 03459   896   NtResumeThread  ... 1, ) == 0x0
 03458  2096   NtRegisterThreadTerminatePort  ... ) == 0x0
 03449  2120   NtWaitForSingleObject  ... ) == 0x0
 03461  1380   NtSetEventBoostPriority  ... ) == 0x0
 03462   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03463  2120   NtSetEventBoostPriority  (340, ...
 03464  2096   NtWaitForSingleObject  (340, 0, 0x0, ...
 03465  1380   NtWaitForSingleObject  (340, 0, 0x0, ...
 03448  1248   NtWaitForSingleObject  ... ) == 0x0
 03463  2120   NtSetEventBoostPriority  ... ) == 0x0
 03462   896   NtAllocateVirtualMemory  ... 113311744, 1048576, ) == 0x0
 03466  2076   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03467  2160   NtWaitForSingleObject  (128, 0, 0x0, ...
 03468  1248   NtSetEventBoostPriority  (340, ...
 03469   896   NtAllocateVirtualMemory  (-1, 114352128, 0, 8192, 4096, 4, ...
 03466  2076   NtDuplicateObject  ... 940, ) == 0x0
 03446   752   NtWaitForSingleObject  ... ) == 0x0
 03468  1248   NtSetEventBoostPriority  ... ) == 0x0
 03470  2120   NtSetEventBoostPriority  (128, ...
 03471   752   NtSetEventBoostPriority  (340, ...
 03472  2076   NtWaitForSingleObject  (340, 0, 0x0, ...
 03473  1248   NtWaitForSingleObject  (340, 0, 0x0, ...
 03301  2124   NtWaitForSingleObject  ... ) == 0x0
 03470  2120   NtSetEventBoostPriority  ... ) == 0x0
 03454  1808   NtWaitForSingleObject  ... ) == 0x0
 03471   752   NtSetEventBoostPriority  ... ) == 0x0
 03469   896   NtAllocateVirtualMemory  ... 114352128, 8192, ) == 0x0
 03474  2124   NtWaitForSingleObject  (340, 0, 0x0, ...
 03475  2120   NtTestAlert  (...
 03476  1808   NtSetEventBoostPriority  (340, ...
 03477   752   NtWaitForSingleObject  (340, 0, 0x0, ...
 03478   896   NtProtectVirtualMemory  (-1, (0x6d0e000), 4096, 260, ...
 03475  2120   NtTestAlert  ... ) == 0x0
 03456  2064   NtWaitForSingleObject  ... ) == 0x0
 03478   896   NtProtectVirtualMemory  ... (0x6d0e000), 4096, 4, ) == 0x0
 03479  2120   NtContinue  (109116720, 1, ...
 03480  2064   NtSetEventBoostPriority  (340, ...
 03481   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03482  2120   NtRegisterThreadTerminatePort  (24, ...
 03464  2096   NtWaitForSingleObject  ... ) == 0x0
 03480  2064   NtSetEventBoostPriority  ... ) == 0x0
 03481   896   NtCreateThread  ... 944, {1252, 2176}, ) == 0x0
 03476  1808   NtSetEventBoostPriority  ... ) == 0x0
 03483  2096   NtSetEventBoostPriority  (340, ...
 03484  2064   NtWaitForSingleObject  (340, 0, 0x0, ...
 03485   896   NtQueryInformationThread  (944, Basic, 28, ...
 03465  1380   NtWaitForSingleObject  ... ) == 0x0
 03483  2096   NtSetEventBoostPriority  ... ) == 0x0
 03486  1808   NtWaitForSingleObject  (380, 0, 0x0, ...
 03482  2120   NtRegisterThreadTerminatePort  ... ) == 0x0
 03487  1380   NtSetEventBoostPriority  (340, ...
 03485   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff50000,Pid=1252,Tid=2176,}, 0x0, ) == 0x0
 03472  2076   NtWaitForSingleObject  ... ) == 0x0
 03488  2120   NtWaitForSingleObject  (340, 0, 0x0, ...
 03489   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\3\0\0\344\4\0\0\200\10\0\0" ...  ...
 03490  2076   NtSetEventBoostPriority  (340, ...
 03489   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82004, 0}  ... {28, 56, reply, 0, 1252, 896, 82004, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\3\0\0\344\4\0\0\200\10\0\0" )  ) == 0x0
 03474  2124   NtWaitForSingleObject  ... ) == 0x0
 03490  2076   NtSetEventBoostPriority  ... ) == 0x0
 03491  2124   NtSetEventBoostPriority  (340, ...
 03492   896   NtResumeThread  (944, ...
 03487  1380   NtSetEventBoostPriority  ... ) == 0x0
 03493  2096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03477   752   NtWaitForSingleObject  ... ) == 0x0
 03491  2124   NtSetEventBoostPriority  ... ) == 0x0
 03492   896   NtResumeThread  ... 1, ) == 0x0
 03494  1380   NtWaitForSingleObject  (340, 0, 0x0, ...
 03495   752   NtSetEventBoostPriority  (340, ...
 03493  2096   NtDuplicateObject  ... 948, ) == 0x0
 03496  2076   NtWaitForSingleObject  (340, 0, 0x0, ...
 03497  2176   NtWaitForSingleObject  (128, 0, 0x0, ...
 03498  2124   NtSetEventBoostPriority  (128, ...
 03473  1248   NtWaitForSingleObject  ... ) == 0x0
 03495   752   NtSetEventBoostPriority  ... ) == 0x0
 03499  2096   NtWaitForSingleObject  (340, 0, 0x0, ...
 03500  1248   NtSetEventBoostPriority  (340, ...
 03358  2140   NtWaitForSingleObject  ... ) == 0x0
 03498  2124   NtSetEventBoostPriority  ... ) == 0x0
 03501   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03484  2064   NtWaitForSingleObject  ... ) == 0x0
 03502  2140   NtWaitForSingleObject  (340, 0, 0x0, ...
 03503  2124   NtTestAlert  (...
 03501   896   NtAllocateVirtualMemory  ... 114360320, 1048576, ) == 0x0
 03504  2064   NtSetEventBoostPriority  (340, ...
 03503  2124   NtTestAlert  ... ) == 0x0
 03505   896   NtAllocateVirtualMemory  (-1, 115400704, 0, 8192, 4096, 4, ...
 03488  2120   NtWaitForSingleObject  ... ) == 0x0
 03506  2124   NtContinue  (110165296, 1, ...
 03505   896   NtAllocateVirtualMemory  ... 115400704, 8192, ) == 0x0
 03507  2120   NtSetEventBoostPriority  (340, ...
 03508  2124   NtRegisterThreadTerminatePort  (24, ...
 03509   896   NtProtectVirtualMemory  (-1, (0x6e0e000), 4096, 260, ...
 03494  1380   NtWaitForSingleObject  ... ) == 0x0
 03507  2120   NtSetEventBoostPriority  ... ) == 0x0
 03504  2064   NtSetEventBoostPriority  ... ) == 0x0
 03500  1248   NtSetEventBoostPriority  ... ) == 0x0
 03510   752   NtSetEventBoostPriority  (380, ...
 03511  1380   NtSetEventBoostPriority  (340, ...
 03509   896   NtProtectVirtualMemory  ... (0x6e0e000), 4096, 4, ) == 0x0
 03508  2124   NtRegisterThreadTerminatePort  ... ) == 0x0
 03512  2064   NtWaitForSingleObject  (380, 0, 0x0, ...
 03513  1248   NtWaitForSingleObject  (380, 0, 0x0, ...
 03496  2076   NtWaitForSingleObject  ... ) == 0x0
 03511  1380   NtSetEventBoostPriority  ... ) == 0x0
 03486  1808   NtWaitForSingleObject  ... ) == 0x0
 03510   752   NtSetEventBoostPriority  ... ) == 0x0