Summary:
NtGdiCreateBitmap(>) | 1 | NtQueryDefaultUILanguage(>) | 2 | NtQueryInformationFile(>) | 7 | NtQueryAttributesFile(>) | 40 |
NtGdiInit(>) | 1 | NtQueryPerformanceCounter(>) | 2 | NtQueryInformationToken(>) | 7 | NtFlushInstructionCache(>) | 56 |
NtGdiQueryFontAssocInfo(>) | 1 | NtQuerySystemTime(>) | 2 | NtConnectPort(>) | 8 | NtContinue(>) | 90 |
NtGdiSelectBitmap(>) | 1 | NtReadFile(>) | 2 | NtQueryInformationProcess(>) | 9 | NtQuerySystemInformation(>) | 129 |
NtOpenKeyedEvent(>) | 1 | NtSetInformationObject(>) | 2 | NtQueryVirtualMemory(>) | 9 | NtOpenKey(>) | 134 |
NtOpenSymbolicLinkObject(>) | 1 | NtUserGetObjectInformation(>) | 2 | NtSetInformationFile(>) | 9 | NtResumeThread(>) | 137 |
NtQueryInstallUILanguage(>) | 1 | NtFreeVirtualMemory(>) | 3 | NtSetInformationThread(>) | 9 | NtQueryInformationThread(>) | 139 |
NtQueryObject(>) | 1 | NtGdiCreateCompatibleDC(>) | 3 | NtUnmapViewOfSection(>) | 9 | NtCreateThread(>) | 150 |
NtQuerySymbolicLinkObject(>) | 1 | NtOpenProcessTokenEx(>) | 3 | NtUserFindExistingCursorIcon(>) | 9 | NtTestAlert(>) | 171 |
NtRaiseException(>) | 1 | NtOpenThreadTokenEx(>) | 3 | NtOpenThreadToken(>) | 10 | NtRegisterThreadTerminatePort(>) | 174 |
NtSetInformationProcess(>) | 1 | NtQueryDefaultLocale(>) | 3 | NtUserRegisterClassExWOW(>) | 14 | NtDuplicateObject(>) | 176 |
NtUserCallNoParam(>) | 1 | NtSecureConnectPort(>) | 3 | NtQuerySection(>) | 15 | NtRequestWaitReplyPort(>) | 176 |
NtUserGetProcessWindowStation(>) | 1 | NtCreateIoCompletion(>) | 4 | NtSetValueKey(>) | 16 | NtCreateEvent(>) | 187 |
NtUserGetThreadDesktop(>) | 1 | NtQueryVolumeInformationFile(>) | 4 | NtCreateKey(>) | 21 | NtClose(>) | 223 |
NtCallbackReturn(>) | 2 | NtWriteFile(>) | 4 | NtOpenSection(>) | 21 | NtProtectVirtualMemory(>) | 245 |
NtGdiCreateSolidBrush(>) | 2 | NtCreateMutant(>) | 5 | NtCreateSection(>) | 23 | NtQueryValueKey(>) | 257 |
NtNotifyChangeKey(>) | 2 | NtGdiGetStockObject(>) | 5 | NtOpenFile(>) | 25 | NtAllocateVirtualMemory(>) | 366 |
NtOpenDirectoryObject(>) | 2 | NtCreateFile(>) | 7 | NtDeviceIoControlFile(>) | 36 | NtSetEventBoostPriority(>) | 773 |
NtOpenProcessToken(>) | 2 | NtFsControlFile(>) | 7 | NtMapViewOfSection(>) | 37 | NtWaitForSingleObject(>) | 993 |
\203\260\231\332\12R?\206*R\333\22&Jo\370\372\370\321oT\17\200S\376\10\271\353\224X\10\3\330\272\271c\367;\342T\201\326L;\320\273\342e\221]\22[\331\355-\34\246\352\2175B\225\324r[\324\3501\212S\373\370d\331\202\242rI\14\303?\316t\277\304\366JG>\26\211\320\251\206G6\265l\244\223q\35\345\377\360\4\32\204\255l\261\225m\263n\32\340\34\31\334\231\255.\347\240%j\260\337\363\377\371\3Y*{340\277\265#\266\311[R~r\25\247\236M\32\370\17\204\221xZ<\344v\217J\177Y\350n\272o\217\333\225\307\242\270\241\200\224y\242ge\341\32 \4fMdq\346\323\260\325\344\300KB!\212\234\376-z{\331\357\307\210K[\360\330h", ) == 0x0 01444 216 NtTestAlert (... 01442 1600 NtRegisterThreadTerminatePort ... ) == 0x0 01445 1372 NtRegisterThreadTerminatePort (24, ... 01446 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x1207b, (336, 108, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0 \376\255\201", 16, 16, ... , 16, 16, ... 01447 2040 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01448 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 01444 216 NtTestAlert ... ) == 0x0 01449 1600 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01445 1372 NtRegisterThreadTerminatePort ... ) == 0x0 01446 1356 NtDeviceIoControlFile ... {status=0x0, info=16}, ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0 \376\255\201", ) , ) == 0x0 01447 2040 NtDuplicateObject ... 392, ) == 0x0 01448 896 NtCreateEvent ... 396, ) == 0x0 01450 216 NtContinue (45874480, 1, ... 01441 1736 NtAllocateVirtualMemory ... 45875200, 1048576, ) == 0x0 01451 1372 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01452 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x12047, (336, 108, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ... 01453 2040 NtWaitForSingleObject (64, 0, {0, 0}, ... 01454 896 NtConnectPort ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15461892, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15461892, 188, ... 01455 216 NtRegisterThreadTerminatePort (24, ... 01456 1736 NtAllocateVirtualMemory (-1, 46915584, 0, 8192, 4096, 4, ... 01449 1600 NtDuplicateObject ... 400, ) == 0x0 01451 1372 NtDuplicateObject ... 404, ) == 0x0 01452 1356 NtDeviceIoControlFile ... {status=0x0, info=0}, "", ) == 0x0 01455 216 NtRegisterThreadTerminatePort ... ) == 0x0 01456 1736 NtAllocateVirtualMemory ... 46915584, 8192, ) == 0x0 01454 896 NtConnectPort ... 408, 0x0, 0x0, 0x0, 188, ) == 0x0 01457 1600 NtWaitForSingleObject (64, 0, {0, 0}, ... 01458 1372 NtWaitForSingleObject (64, 0, {0, 0}, ... 01459 1356 NtWaitForSingleObject (56, 0, {0, 0}, ... 01453 2040 NtWaitForSingleObject ... ) == 0x102 01460 1736 NtProtectVirtualMemory (-1, (0x2cbe000), 4096, 260, ... 01461 216 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01457 1600 NtWaitForSingleObject ... ) == 0x102 01458 1372 NtWaitForSingleObject ... ) == 0x102 01459 1356 NtWaitForSingleObject ... ) == 0x102 01462 2040 NtWaitForSingleObject (128, 0, 0x0, ... 01460 1736 NtProtectVirtualMemory ... (0x2cbe000), 4096, 4, ) == 0x0 01461 216 NtDuplicateObject ... 412, ) == 0x0 01463 1600 NtWaitForSingleObject (128, 0, 0x0, ... 01464 1372 NtWaitForSingleObject (128, 0, 0x0, ... 01465 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x12003, (336, 108, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ... 01466 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01467 216 NtWaitForSingleObject (64, 0, {0, 0}, ... 01465 1356 NtDeviceIoControlFile ... {status=0x0, info=416}, ... {status=0x0, info=416}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0 01468 896 NtRequestWaitReplyPort (408, {200, 224, new_msg, 0, 1382384, 12, 2, 1310721} (408, {200, 224, new_msg, 0, 1382384, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\30\24\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\244"\36\361G\377\310\327\240\27\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x\27\25\0K\240|\333x\1\24\0\230\27\25\0h\1\24\0\0\0\0\0\0\0\0\0\230\27\25\0P\0\0\0\240\27\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\353\0\372\31\221|\30\364\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... \36\361G\377\310\327\240\27\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x\27\25\0K\240|\333x\1\24\0\230\27\25\0h\1\24\0\0\0\0\0\0\0\0\0\230\27\25\0P\0\0\0\240\27\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\353\0\372\31\221|\30\364\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... 01467 216 NtWaitForSingleObject ... ) == 0x102 01469 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x12047, (336, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ... 01470 216 NtWaitForSingleObject (128, 0, 0x0, ... 01469 1356 NtDeviceIoControlFile ... {status=0x0, info=0}, 0x0, ) == 0x0 01468 896 NtRequestWaitReplyPort ... {200, 224, reply, 0, 1636, 896, 75525, 0} ... {200, 224, reply, 0, 1636, 896, 75525, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\244"\36\361G\377\310\327\240\27\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x\27\25\0K\240|\333x\1\24\0\230\27\25\0h\1\24\0\0\0\0\0\0\0\0\0\230\27\25\0P\0\0\0\240\27\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\353\0\372\31\221|\30\364\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \36\361G\377\310\327\240\27\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x\27\25\0K\240|\333x\1\24\0\230\27\25\0h\1\24\0\0\0\0\0\0\0\0\0\230\27\25\0P\0\0\0\240\27\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\353\0\372\31\221|\30\364\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) == 0x0 01466 1736 NtCreateThread ... 420, {1636, 152}, ) == 0x0 01471 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x12037, (336, 108, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ... 01472 896 NtRequestWaitReplyPort (408, {64, 88, new_msg, 0, 0, 0, 0, 0} (408, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... ... 01473 1736 NtQueryInformationThread (420, Basic, 28, ... 01471 1356 NtDeviceIoControlFile ... {status=0x0, info=8}, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0 01473 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1636,Tid=152,}, 0x0, ) == 0x0 01474 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x1200b, (336, 108, 0x0, 0x0, 0x1200b, "\0\376\247\0\5\0\0\0\0\256\24\0", 12, 0, ... , 12, 0, ... 01475 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75523, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75523, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0d\6\0\0\230\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0d\6\0\0\230\0\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75527, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75523, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0d\6\0\0\230\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0d\6\0\0\230\0\0\0" ) ) == 0x0 01476 1736 NtResumeThread (420, ... 1, ) == 0x0 01477 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 46923776, 1048576, ) == 0x0 01478 1736 NtAllocateVirtualMemory (-1, 47964160, 0, 8192, 4096, 4, ... 47964160, 8192, ) == 0x0 01474 1356 NtDeviceIoControlFile ... {status=0x0, info=0}, 0x0, ) == 0x0 01479 152 NtTestAlert (... 01480 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x12047, (336, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\247\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ... 01479 152 NtTestAlert ... ) == 0x0 01480 1356 NtDeviceIoControlFile ... {status=0x0, info=0}, 0x0, ) == 0x0 01481 152 NtContinue (46923056, 1, ... 01482 1736 NtProtectVirtualMemory (-1, (0x2dbe000), 4096, 260, ... 01483 152 NtRegisterThreadTerminatePort (24, ... 01482 1736 NtProtectVirtualMemory ... (0x2dbe000), 4096, 4, ) == 0x0 01483 152 NtRegisterThreadTerminatePort ... ) == 0x0 01484 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01485 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ... 01472 896 NtRequestWaitReplyPort ... {52, 76, reply, 0, 1636, 896, 75526, 0} ... {52, 76, reply, 0, 1636, 896, 75526, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\270+\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" ) ) == 0x0 01484 1736 NtCreateThread ... 424, {1636, 2036}, ) == 0x0 01485 1356 NtDeviceIoControlFile ... {status=0x0, info=26}, ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0 01486 152 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01487 1736 NtQueryInformationThread (424, Basic, 28, ... 01488 1356 NtAllocateVirtualMemory (-1, 1384448, 0, 4096, 4096, 4, ... 01486 152 NtDuplicateObject ... 428, ) == 0x0 01487 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1636,Tid=2036,}, 0x0, ) == 0x0 01488 1356 NtAllocateVirtualMemory ... 1384448, 4096, ) == 0x0 01489 152 NtWaitForSingleObject (284, 0, 0x0, ... 01490 896 NtWaitForSingleObject (284, 0, 0x0, ... 01491 1356 NtSetEventBoostPriority (284, ... 01489 152 NtWaitForSingleObject ... ) == 0x0 01492 152 NtSetEventBoostPriority (284, ... 01490 896 NtWaitForSingleObject ... ) == 0x0 01493 896 NtClose (396, ... ) == 0x0 01494 896 NtClose (408, ... 01492 152 NtSetEventBoostPriority ... ) == 0x0 01491 1356 NtSetEventBoostPriority ... ) == 0x0 01495 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75527, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75527, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0d\6\0\0\364\7\0\0" ... ... 01494 896 NtClose ... ) == 0x0 01496 152 NtWaitForSingleObject (64, 0, {0, 0}, ... 01495 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75529, 0} ... {28, 56, reply, 0, 1636, 1736, 75529, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0d\6\0\0\364\7\0\0" ) ) == 0x0 01497 896 NtCreateKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ... 01496 152 NtWaitForSingleObject ... ) == 0x102 01498 1736 NtResumeThread (424, ... 01497 896 NtCreateKey ... 408, 2, ) == 0x0 01499 152 NtWaitForSingleObject (128, 0, 0x0, ... 01498 1736 NtResumeThread ... 1, ) == 0x0 01500 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ... 01501 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01500 896 NtOpenKey ... 396, ) == 0x0 01502 1356 NtAllocateVirtualMemory (-1, 1388544, 0, 4096, 4096, 4, ... 01503 2036 NtTestAlert (... 01504 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ... 01502 1356 NtAllocateVirtualMemory ... 1388544, 4096, ) == 0x0 01503 2036 NtTestAlert ... ) == 0x0 01501 1736 NtAllocateVirtualMemory ... 47972352, 1048576, ) == 0x0 01505 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3<\21g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01506 2036 NtContinue (47971632, 1, ... 01507 1736 NtAllocateVirtualMemory (-1, 49012736, 0, 8192, 4096, 4, ... 01508 1356 NtQuerySystemInformation (TimeOfDay, 48, ... 01509 2036 NtRegisterThreadTerminatePort (24, ... 01507 1736 NtAllocateVirtualMemory ... 49012736, 8192, ) == 0x0 01508 1356 NtQuerySystemInformation ... {system info, class 3, size 48}, 48, ) == 0x0 01509 2036 NtRegisterThreadTerminatePort ... ) == 0x0 01510 1736 NtProtectVirtualMemory (-1, (0x2ebe000), 4096, 260, ... 01511 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... 01504 896 NtOpenKey ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01510 1736 NtProtectVirtualMemory ... (0x2ebe000), 4096, 4, ) == 0x0 01512 2036 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01513 896 NtQueryValueKey (408, (408, "Hostname", Partial, 144, ... , Partial, 144, ... 01514 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01512 2036 NtDuplicateObject ... 432, ) == 0x0 01513 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0 01511 1356 NtQuerySystemInformation ... {system info, class 8, size 48}, 48, ) == 0x0 01515 2036 NtWaitForSingleObject (64, 0, {0, 0}, ... 01516 896 NtQueryValueKey (408, (408, "Hostname", Partial, 144, ... , Partial, 144, ... 01517 1356 NtQuerySystemInformation (Performance, 312, ... 01515 2036 NtWaitForSingleObject ... ) == 0x102 01516 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0 01517 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01518 2036 NtWaitForSingleObject (128, 0, 0x0, ... 01519 896 NtClose (408, ... 01520 1356 NtQuerySystemInformation (Exception, 16, ... 01514 1736 NtCreateThread ... 436, {1636, 1708}, ) == 0x0 01520 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01521 1736 NtQueryInformationThread (436, Basic, 28, ... 01522 1356 NtQuerySystemInformation (Lookaside, 32, ... 01521 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1636,Tid=1708,}, 0x0, ) == 0x0 01519 896 NtClose ... ) == 0x0 01523 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75529, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75529, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0d\6\0\0\254\6\0\0" ... ... 01524 896 NtClose (396, ... 01523 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75530, 0} ... {28, 56, reply, 0, 1636, 1736, 75530, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0d\6\0\0\254\6\0\0" ) ) == 0x0 01524 896 NtClose ... ) == 0x0 01522 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01525 896 NtCreateEvent (0x100003, 0x0, 1, 0, ... 01526 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01525 896 NtCreateEvent ... 396, ) == 0x0 01526 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01527 896 NtWaitForSingleObject (396, 0, 0x0, ... 01528 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... 01529 1736 NtResumeThread (436, ... 01528 1356 NtQuerySystemInformation ... ) == STATUS_INFO_LENGTH_MISMATCH 01529 1736 NtResumeThread ... 1, ) == 0x0 01530 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ... 01531 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01532 1708 NtTestAlert (... 01531 1736 NtAllocateVirtualMemory ... 49020928, 1048576, ) == 0x0 01532 1708 NtTestAlert ... ) == 0x0 01533 1736 NtAllocateVirtualMemory (-1, 50061312, 0, 8192, 4096, 4, ... 01534 1708 NtContinue (49020208, 1, ... 01533 1736 NtAllocateVirtualMemory ... 50061312, 8192, ) == 0x0 01535 1708 NtRegisterThreadTerminatePort (24, ... 01530 1356 NtCreateKey ... -2147482564, 2, ) == 0x0 01535 1708 NtRegisterThreadTerminatePort ... ) == 0x0 01536 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "\377)\232\363\361#\25\324\304\301\337;\235}\3335\202\321&8\334;\243l\363\376\36\313J\345\303\244\16F%\15\213h3\275\355P-7\300\243\216\231ybu\224C\206\221\366\346\330Rz\330d\261\242\353U\257^\364\261\17\37\363}|B\251\334\21Z", 80, ... , 0, 3, (-2147482564, "Seed", 0, 3, "\377)\232\363\361#\25\324\304\301\337;\235}\3335\202\321&8\334;\243l\363\376\36\313J\345\303\244\16F%\15\213h3\275\355P-7\300\243\216\231ybu\224C\206\221\366\346\330Rz\330d\261\242\353U\257^\364\261\17\37\363}|B\251\334\21Z", 80, ... , 80, ... 01537 1736 NtProtectVirtualMemory (-1, (0x2fbe000), 4096, 260, ... 01536 1356 NtSetValueKey ... ) == 0x0 01537 1736 NtProtectVirtualMemory ... (0x2fbe000), 4096, 4, ) == 0x0 01538 1356 NtClose (-2147482564, ... 01539 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01538 1356 NtClose ... ) == 0x0 01539 1736 NtCreateThread ... 408, {1636, 1776}, ) == 0x0 01505 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\33Q\17\277\222\277\332\32\345\325)[\20~\371\275\232;o\355\277\324\35\327 \232\331e\24<\357\310-\247\206\1B\352-\267!\30\2\275\226\200CG?\252O\364\3223d\260|y\314\337\325f:\35)TW\315=\16\226\320q\220\220\3574\207\316\201;\351O\370&\200L\263\301G\327&\356gqG1\206\221\346\5\262\253\371\16\262\327@gDf\375\207\241\13\370L}Y;<\37\232\6\1\21\311\352\315\330\321\317\15&\25\213\213\276\204$\363\366\207S)pr\360<\2\255\342\376\267\337\34\317\207:\11\254\245\375K\270.,\361\347\265\224p~\370\330\37C\356\356\7\307\322q\205\317r\226\205SfdUD\355\2004\234\272`w\223\246\371\325\223\206\374\216\205L\270\253\225tT\10\314\373\224\3714Cf\357j\235Q(\2579\313\2\5H\3550\36N:Q\6\272\264^\270\2270t\315\37\327\322#", ) , ) == 0x0 01540 1736 NtQueryInformationThread (408, Basic, 28, ... 01541 1708 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01540 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1636,Tid=1776,}, 0x0, ) == 0x0 01541 1708 NtDuplicateObject ... 440, ) == 0x0 01542 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3v\275\333?\200\201\236\372'g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01543 1708 NtWaitForSingleObject (64, 0, {0, 0}, ... 01544 1356 NtQuerySystemInformation (TimeOfDay, 48, ... 01543 1708 NtWaitForSingleObject ... ) == 0x102 01544 1356 NtQuerySystemInformation ... {system info, class 3, size 48}, 48, ) == 0x0 01545 1708 NtWaitForSingleObject (128, 0, 0x0, ... 01546 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... 01547 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75530, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75530, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0d\6\0\0\360\6\0\0" ... ... 01546 1356 NtQuerySystemInformation ... {system info, class 8, size 48}, 48, ) == 0x0 01547 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75531, 0} ... {28, 56, reply, 0, 1636, 1736, 75531, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0d\6\0\0\360\6\0\0" ) ) == 0x0 01548 1356 NtQuerySystemInformation (Performance, 312, ... 01549 1736 NtResumeThread (408, ... 1, ) == 0x0 01550 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 50069504, 1048576, ) == 0x0 01551 1736 NtAllocateVirtualMemory (-1, 51109888, 0, 8192, 4096, 4, ... 51109888, 8192, ) == 0x0 01552 1736 NtProtectVirtualMemory (-1, (0x30be000), 4096, 260, ... (0x30be000), 4096, 4, ) == 0x0 01553 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01548 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01554 1776 NtTestAlert (... 01555 1356 NtQuerySystemInformation (Exception, 16, ... 01554 1776 NtTestAlert ... ) == 0x0 01555 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01556 1776 NtContinue (50068784, 1, ... 01557 1356 NtQuerySystemInformation (Lookaside, 32, ... 01558 1776 NtRegisterThreadTerminatePort (24, ... 01557 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01558 1776 NtRegisterThreadTerminatePort ... ) == 0x0 01559 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01553 1736 NtCreateThread ... 444, {1636, 1324}, ) == 0x0 01560 1776 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01561 1736 NtQueryInformationThread (444, Basic, 28, ... 01560 1776 NtDuplicateObject ... 448, ) == 0x0 01561 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1636,Tid=1324,}, 0x0, ) == 0x0 01562 1776 NtWaitForSingleObject (64, 0, {0, 0}, ... 01563 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75531, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75531, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0d\6\0\0,\5\0\0" ... ... 01562 1776 NtWaitForSingleObject ... ) == 0x102 01563 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75532, 0} ... {28, 56, reply, 0, 1636, 1736, 75532, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0d\6\0\0,\5\0\0" ) ) == 0x0 01564 1776 NtWaitForSingleObject (128, 0, 0x0, ... 01559 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01565 1736 NtResumeThread (444, ... 01566 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... 01565 1736 NtResumeThread ... 1, ) == 0x0 01566 1356 NtQuerySystemInformation ... ) == STATUS_INFO_LENGTH_MISMATCH 01567 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01568 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ... 01567 1736 NtAllocateVirtualMemory ... 51118080, 1048576, ) == 0x0 01568 1356 NtCreateKey ... -2147482564, 2, ) == 0x0 01569 1736 NtAllocateVirtualMemory (-1, 52158464, 0, 8192, 4096, 4, ... 01570 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "]p\37\245\326n}3i\330N\225\312\336{^\1\274\353E\15\261\227\317t\333\237\373\16\330\245\6\260\2\25\320\330D\205\204\320\257\343\320)\312\252d\247C\244"\324<\317\340\222\227\340h\265Z\214\331\377x\272\225-h\241\234\0\350\363b\316\321\306", 80, ... , 0, 3, (-2147482564, "Seed", 0, 3, "]p\37\245\326n}3i\330N\225\312\336{^\1\274\353E\15\261\227\317t\333\237\373\16\330\245\6\260\2\25\320\330D\205\204\320\257\343\320)\312\252d\247C\244"\324<\317\340\222\227\340h\265Z\214\331\377x\272\225-h\241\234\0\350\363b\316\321\306", 80, ... \324<\317\340\222\227\340h\265Z\214\331\377x\272\225-h\241\234\0\350\363b\316\321\306", 80, ... 01569 1736 NtAllocateVirtualMemory ... 52158464, 8192, ) == 0x0 01571 1324 NtTestAlert (... 01570 1356 NtSetValueKey ... ) == 0x0 01571 1324 NtTestAlert ... ) == 0x0 01572 1356 NtClose (-2147482564, ... 01573 1324 NtContinue (51117360, 1, ... 01572 1356 NtClose ... ) == 0x0 01574 1324 NtRegisterThreadTerminatePort (24, ... 01542 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\333\301\255[7x;\326z*\7\201\344\223\376f)\266\37%\31T\a\25\5f\227$\212l|\256\257ZuW`yh\250Z\372\347\214\265\265.B_\23507$\322\314QJ\376\2U\3014Us\243\274\347Q\242\13\360=\312H\26\213\222\202\262d\303\336\11f\342s<\307Z\270@\315\24|\316c\260\267\323\221jO\2406\345\256l\254\20|\356 \257\27[\365\201\13\346\373\271\351\227\227\277>\273\335.\364iK\15\16\303\205\213\312P\353\206\351f\246l\361U\221Z&\34w+\2H"\333\306\376,\5Mk\337\3\0\355S\202\335\221\277s\24qC"\277\260\271\2755\30\5Jw\245P\210\341\243\355As\322#\254\243B\302v\221x\337_\365\31\374\1\20\345\204\316\364U&\231\225;\26\277;\263\346\317\207\313l\327\362S8[\352\330)d\311\335:\302\241f\3\242wi\205\212\267\215\246&\331\36", ) \333\306\376,\5Mk\337\3\0\355S\202\335\221\277s\24qC ... {status=0x0, info=256}, "\333\301\255[7x;\326z*\7\201\344\223\376f)\266\37%\31T\a\25\5f\227$\212l|\256\257ZuW`yh\250Z\372\347\214\265\265.B_\23507$\322\314QJ\376\2U\3014Us\243\274\347Q\242\13\360=\312H\26\213\222\202\262d\303\336\11f\342s<\307Z\270@\315\24|\316c\260\267\323\221jO\2406\345\256l\254\20|\356 \257\27[\365\201\13\346\373\271\351\227\227\277>\273\335.\364iK\15\16\303\205\213\312P\353\206\351f\246l\361U\221Z&\34w+\2H"\333\306\376,\5Mk\337\3\0\355S\202\335\221\277s\24qC"\277\260\271\2755\30\5Jw\245P\210\341\243\355As\322#\254\243B\302v\221x\337_\365\31\374\1\20\345\204\316\364U&\231\225;\26\277;\263\346\317\207\313l\327\362S8[\352\330)d\311\335:\302\241f\3\242wi\205\212\267\215\246&\331\36", ) , ) == 0x0 01574 1324 NtRegisterThreadTerminatePort ... ) == 0x0 01575 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3v\275\333?\200\201\236\260\213\333?\200\201\236\372'g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01576 1736 NtProtectVirtualMemory (-1, (0x31be000), 4096, 260, ... 01577 1356 NtQuerySystemInformation (TimeOfDay, 48, ... 01576 1736 NtProtectVirtualMemory ... (0x31be000), 4096, 4, ) == 0x0 01578 1324 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01579 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01578 1324 NtDuplicateObject ... 452, ) == 0x0 01579 1736 NtCreateThread ... 456, {1636, 1884}, ) == 0x0 01580 1324 NtWaitForSingleObject (64, 0, {0, 0}, ... 01581 1736 NtQueryInformationThread (456, Basic, 28, ... 01580 1324 NtWaitForSingleObject ... ) == 0x102 01581 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1636,Tid=1884,}, 0x0, ) == 0x0 01582 1324 NtWaitForSingleObject (128, 0, 0x0, ... 01577 1356 NtQuerySystemInformation ... {system info, class 3, size 48}, 48, ) == 0x0 01583 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75532, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75532, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0d\6\0\0\\7\0\0" ... ... 01584 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... 01583 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75533, 0} ... {28, 56, reply, 0, 1636, 1736, 75533, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0d\6\0\0\\7\0\0" ) ) == 0x0 01584 1356 NtQuerySystemInformation ... {system info, class 8, size 48}, 48, ) == 0x0 01585 1736 NtResumeThread (456, ... 01586 1356 NtQuerySystemInformation (Performance, 312, ... 01585 1736 NtResumeThread ... 1, ) == 0x0 01586 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01587 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01588 1356 NtQuerySystemInformation (Exception, 16, ... 01589 1884 NtTestAlert (... 01587 1736 NtAllocateVirtualMemory ... 52166656, 1048576, ) == 0x0 01589 1884 NtTestAlert ... ) == 0x0 01590 1736 NtAllocateVirtualMemory (-1, 53207040, 0, 8192, 4096, 4, ... 01591 1884 NtContinue (52165936, 1, ... 01590 1736 NtAllocateVirtualMemory ... 53207040, 8192, ) == 0x0 01592 1884 NtRegisterThreadTerminatePort (24, ... 01593 1736 NtProtectVirtualMemory (-1, (0x32be000), 4096, 260, ... 01592 1884 NtRegisterThreadTerminatePort ... ) == 0x0 01593 1736 NtProtectVirtualMemory ... (0x32be000), 4096, 4, ) == 0x0 01588 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01594 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01595 1356 NtQuerySystemInformation (Lookaside, 32, ... 01596 1884 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01595 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01596 1884 NtDuplicateObject ... 460, ) == 0x0 01597 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01598 1884 NtWaitForSingleObject (64, 0, {0, 0}, ... 01597 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01598 1884 NtWaitForSingleObject ... ) == 0x102 01599 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... 01600 1884 NtWaitForSingleObject (128, 0, 0x0, ... 01594 1736 NtCreateThread ... 464, {1636, 248}, ) == 0x0 01599 1356 NtQuerySystemInformation ... ) == STATUS_INFO_LENGTH_MISMATCH 01601 1736 NtQueryInformationThread (464, Basic, 28, ... 01602 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ... 01601 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1636,Tid=248,}, 0x0, ) == 0x0 01602 1356 NtCreateKey ... -2147482564, 2, ) == 0x0 01603 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75533, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75533, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0d\6\0\0\370\0\0\0" ... ... 01604 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "/\270\203\363\362\306/\320\205\31\376C\331\227\246\16\254\3\360\275y\2436(YB*\205\26454\230\207E(\205\340\341\17\10y\264\234QX~;!=fa\333\263\<\32\26/z\274\333\376\221]Q\252Q\3620\234\266J\217\304\330n\236\200\343", 80, ... , 0, 3, (-2147482564, "Seed", 0, 3, "/\270\203\363\362\306/\320\205\31\376C\331\227\246\16\254\3\360\275y\2436(YB*\205\26454\230\207E(\205\340\341\17\10y\264\234QX~;!=fa\333\263\<\32\26/z\274\333\376\221]Q\252Q\3620\234\266J\217\304\330n\236\200\343", 80, ... , 80, ... 01603 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75534, 0} ... {28, 56, reply, 0, 1636, 1736, 75534, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0d\6\0\0\370\0\0\0" ) ) == 0x0 01604 1356 NtSetValueKey ... ) == 0x0 01605 1356 NtClose (-2147482564, ... ) == 0x0 01575 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "=\247\226UWQ\25\243lI\334\261^N\264\203\2136({yVDqAK\244\336\33\13\340_\220Ld\1gESXjc\340q\354\273\363\212\304\3464\363\2720^\377&~,w\245H3<\240\373(S\3114\374\302\253\31B\241s\340:E\250!$GS\226\247;4\365\341UG\321\264W\247-\25\270`\225I\341\261{\21k0<\2\240\220\10\373\374\310\323\14;\256S\370\245\211\351O\261\201\251\3\35Z\\372\215\242\37m\343\316\254#<\226\2\312:\212\357)W\367\316\357f\350B2\33\361\240\244+Kk\205"\222\334\25\2\2609\315\20\225*k\373z\343\24\305\211\245\365\331*\212lf\364'\370\365\253~\243"\200\207\303i\267\220\354;\230$\247\351\201\2252\\3778D[\\254\37L:\207\213U\216\36\207_\202\274O0\321\3316\273\350N5\34W\206\1\2C@\222\326}\32\226", ) \222\334\25\2\2609\315\20\225*k\373z\343\24\305\211\245\365\331*\212lf\364'\370\365\253~\243 ... {status=0x0, info=256}, "=\247\226UWQ\25\243lI\334\261^N\264\203\2136({yVDqAK\244\336\33\13\340_\220Ld\1gESXjc\340q\354\273\363\212\304\3464\363\2720^\377&~,w\245H3<\240\373(S\3114\374\302\253\31B\241s\340:E\250!$GS\226\247;4\365\341UG\321\264W\247-\25\270`\225I\341\261{\21k0<\2\240\220\10\373\374\310\323\14;\256S\370\245\211\351O\261\201\251\3\35Z\\372\215\242\37m\343\316\254#<\226\2\312:\212\357)W\367\316\357f\350B2\33\361\240\244+Kk\205"\222\334\25\2\2609\315\20\225*k\373z\343\24\305\211\245\365\331*\212lf\364'\370\365\253~\243"\200\207\303i\267\220\354;\230$\247\351\201\2252\\3778D[\\254\37L:\207\213U\216\36\207_\202\274O0\321\3316\273\350N5\34W\206\1\2C@\222\326}\32\226", ) , ) == 0x0 01606 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3v\275\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\372'g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01607 1356 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01608 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... 01609 1736 NtResumeThread (464, ... 1, ) == 0x0 01610 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 53215232, 1048576, ) == 0x0 01611 1736 NtAllocateVirtualMemory (-1, 54255616, 0, 8192, 4096, 4, ... 54255616, 8192, ) == 0x0 01612 1736 NtProtectVirtualMemory (-1, (0x33be000), 4096, 260, ... (0x33be000), 4096, 4, ) == 0x0 01613 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 468, {1636, 1652}, ) == 0x0 01614 1736 NtQueryInformationThread (468, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1636,Tid=1652,}, 0x0, ) == 0x0 01608 1356 NtQuerySystemInformation ... {system info, class 8, size 48}, 48, ) == 0x0 01615 248 NtTestAlert (... 01616 1356 NtQuerySystemInformation (Performance, 312, ... 01615 248 NtTestAlert ... ) == 0x0 01616 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01617 248 NtContinue (53214512, 1, ... 01618 1356 NtQuerySystemInformation (Exception, 16, ... 01619 248 NtRegisterThreadTerminatePort (24, ... 01618 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01619 248 NtRegisterThreadTerminatePort ... ) == 0x0 01620 1356 NtQuerySystemInformation (Lookaside, 32, ... 01621 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75534, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75534, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0d\6\0\0t\6\0\0" ... ... 01622 248 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01621 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75535, 0} ... {28, 56, reply, 0, 1636, 1736, 75535, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0d\6\0\0t\6\0\0" ) ) == 0x0 01622 248 NtDuplicateObject ... 472, ) == 0x0 01623 1736 NtResumeThread (468, ... 01624 248 NtWaitForSingleObject (64, 0, {0, 0}, ... 01623 1736 NtResumeThread ... 1, ) == 0x0 01624 248 NtWaitForSingleObject ... ) == 0x102 01625 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01626 248 NtWaitForSingleObject (128, 0, 0x0, ... 01620 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01627 1652 NtTestAlert (... 01625 1736 NtAllocateVirtualMemory ... 54263808, 1048576, ) == 0x0 01628 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01627 1652 NtTestAlert ... ) == 0x0 01629 1736 NtAllocateVirtualMemory (-1, 55304192, 0, 8192, 4096, 4, ... 01628 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01630 1652 NtContinue (54263088, 1, ... 01629 1736 NtAllocateVirtualMemory ... 55304192, 8192, ) == 0x0 01631 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... 01632 1652 NtRegisterThreadTerminatePort (24, ... 01633 1736 NtProtectVirtualMemory (-1, (0x34be000), 4096, 260, ... 01631 1356 NtQuerySystemInformation ... ) == STATUS_INFO_LENGTH_MISMATCH 01632 1652 NtRegisterThreadTerminatePort ... ) == 0x0 01633 1736 NtProtectVirtualMemory ... (0x34be000), 4096, 4, ) == 0x0 01634 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ... 01635 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01636 1652 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01634 1356 NtCreateKey ... -2147482564, 2, ) == 0x0 01636 1652 NtDuplicateObject ... 476, ) == 0x0 01637 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "a\360\214\26^\36\225\1U\337\267\257>\256Ia\375\364!\335o\302\231$\320\344\7\367$\332RS\267r\342>\262\30\3133\332Km\265\5\225G\216\327&*G\1\255\345g\302\33\270\177\342y\35\324\351\11, 80, ... , 0, 3, (-2147482564, "Seed", 0, 3, "a\360\214\26^\36\225\1U\337\267\257>\256Ia\375\364!\335o\302\231$\320\344\7\367$\332RS\267r\342>\262\30\3133\332Km\265\5\225G\216\327&*G\1\255\345g\302\33\270\177\342y\35\324\351\11, 80, ... , 80, ... 01638 1652 NtAllocateVirtualMemory (-1, 1392640, 0, 4096, 4096, 4, ... 01637 1356 NtSetValueKey ... ) == 0x0 01638 1652 NtAllocateVirtualMemory ... 1392640, 4096, ) == 0x0 01639 1356 NtClose (-2147482564, ... 01640 1652 NtWaitForSingleObject (64, 0, {0, 0}, ... 01639 1356 NtClose ... ) == 0x0 01606 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\342\205]\201O\341\217\233\344\334\236\351|\326\327\1\320v\241\362FoFRB\275h\14;\237F\214\244\360\373$\303\321v\247P\215\371\205\250\267\272\14\303\265\263U\265\277\222\255n\305\231\370\367\312U\303\314\233\214\250\332\216+\215t\342\335\370\277\200\226\2&\326\357y,1\26U\3113\311\236\11\200\255\361a:R\31\23l\261b\347\15}_\201[v\376\217\274\221\313.\312\250J\223\177\341\321b\231\373[\332\315\224Q\271V\12\357\3054\312V"\35YgBN\26@\2371\32\340\373O\305c\21t\254\350\211}\345`\37\0\2312\2209u\325\376\2614\213\22VM\255\34\0\21\323\225B_C\11\231\334\357\376\22%7\355\320\337\33\6\311N\2029\204\244 \326<\22\10z\315R\26x\337\317\177(\266\256\327\256\201\1\332\247\344v\302o9y\1\241"\357\0\256\204\2715n\364\356*2S/\310\237\11#", ) \35YgBN\26@\2371\32\340\373O\305c\21t\254\350\211}\345`\37\0\2312\2209u\325\376\2614\213\22VM\255\34\0\21\323\225B_C\11\231\334\357\376\22%7\355\320\337\33\6\311N\2029\204\244 \326<\22\10z\315R\26x\337\317\177(\266\256\327\256\201\1\332\247\344v\302o9y\1\241 ... {status=0x0, info=256}, "\342\205]\201O\341\217\233\344\334\236\351|\326\327\1\320v\241\362FoFRB\275h\14;\237F\214\244\360\373$\303\321v\247P\215\371\205\250\267\272\14\303\265\263U\265\277\222\255n\305\231\370\367\312U\303\314\233\214\250\332\216+\215t\342\335\370\277\200\226\2&\326\357y,1\26U\3113\311\236\11\200\255\361a:R\31\23l\261b\347\15}_\201[v\376\217\274\221\313.\312\250J\223\177\341\321b\231\373[\332\315\224Q\271V\12\357\3054\312V"\35YgBN\26@\2371\32\340\373O\305c\21t\254\350\211}\345`\37\0\2312\2209u\325\376\2614\213\22VM\255\34\0\21\323\225B_C\11\231\334\357\376\22%7\355\320\337\33\6\311N\2029\204\244 \326<\22\10z\315R\26x\337\317\177(\266\256\327\256\201\1\332\247\344v\302o9y\1\241"\357\0\256\204\2715n\364\356*2S/\310\237\11#", ) , ) == 0x0 01641 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3v\275\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\372'g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01642 1356 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01643 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01644 1356 NtQuerySystemInformation (Performance, 312, ... 01635 1736 NtCreateThread ... 480, {1636, 588}, ) == 0x0 01640 1652 NtWaitForSingleObject ... ) == 0x102 01645 1736 NtQueryInformationThread (480, Basic, 28, ... 01646 1652 NtWaitForSingleObject (128, 0, 0x0, ... 01645 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1636,Tid=588,}, 0x0, ) == 0x0 01647 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75535, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75535, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0d\6\0\0L\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75536, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0d\6\0\0L\2\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75536, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75535, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0d\6\0\0L\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75536, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0d\6\0\0L\2\0\0" ) ) == 0x0 01648 1736 NtResumeThread (480, ... 1, ) == 0x0 01649 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 55312384, 1048576, ) == 0x0 01650 1736 NtAllocateVirtualMemory (-1, 56352768, 0, 8192, 4096, 4, ... 56352768, 8192, ) == 0x0 01644 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01651 588 NtTestAlert (... 01652 1356 NtQuerySystemInformation (Exception, 16, ... 01651 588 NtTestAlert ... ) == 0x0 01652 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01653 588 NtContinue (55311664, 1, ... 01654 1356 NtQuerySystemInformation (Lookaside, 32, ... 01655 588 NtRegisterThreadTerminatePort (24, ... 01654 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01655 588 NtRegisterThreadTerminatePort ... ) == 0x0 01656 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01657 1736 NtProtectVirtualMemory (-1, (0x35be000), 4096, 260, ... 01658 588 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01657 1736 NtProtectVirtualMemory ... (0x35be000), 4096, 4, ) == 0x0 01658 588 NtDuplicateObject ... 484, ) == 0x0 01659 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01660 588 NtWaitForSingleObject (64, 0, {0, 0}, ... 01659 1736 NtCreateThread ... 488, {1636, 440}, ) == 0x0 01660 588 NtWaitForSingleObject ... ) == 0x102 01661 1736 NtQueryInformationThread (488, Basic, 28, ... 01662 588 NtWaitForSingleObject (128, 0, 0x0, ... 01661 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1636,Tid=440,}, 0x0, ) == 0x0 01656 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01663 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01664 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482564, 2, ) }, 0, 0x0, 0, ... -2147482564, 2, ) == 0x0 01665 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "\272\221%\265\337b\326\14\207\304\15\226\261\333\301i\366a\346P\221\350~\260\14`u.;\2\215\243\211g\342\276\33a\207\310}\31\202\3447\6\244\246\200\32\237\365D\266\362\226\271\303\21\35\112E@uy\372\3348\335\10\262.~{\254\315\333\267\305", 80, ... ) , 0, 3, (-2147482564, "Seed", 0, 3, "\272\221%\265\337b\326\14\207\304\15\226\261\333\301i\366a\346P\221\350~\260\14`u.;\2\215\243\211g\342\276\33a\207\310}\31\202\3447\6\244\246\200\32\237\365D\266\362\226\271\303\21\35\112E@uy\372\3348\335\10\262.~{\254\315\333\267\305", 80, ... ) , 80, ... ) == 0x0 01666 1356 NtClose (-2147482564, ... ) == 0x0 01641 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\223lY\344y\210\344,xv\351/CX\327\24Wk\342)\247\326.\303G}\5\304\360C5\\216\177\2O\231!z\363\5\243 \37\305\362\211~\262@\202H\6\377\1\\332$\234;\371e$\276\232\17\2647\303}\2\273\370\221\225jz\364\35\226\203\377t\265>F:d\324z^\205zn\315\345\315\375\6ay\2\375\334\352\347dd[\20\271\353\335\367\225\34\226\316\21a?4\225\210X\374\252}\377^B\374\336uO\203\352\256\3629e\355\354\304q\301!\23bS\360\360\300q\3072\370q\370\2.\4:o\233*-\211\200\242\10\257t\274`\264\200\233\277\22697)\232\17v\360\2014\233\306%\264\7|;Q\5@\236\235\332^U<\270\223\15d~&\267\232>\343B\210\330\327\367\322\371Z\232u\365\370X9\272\&\16\119\3\2157Q\200\207\212\11\25\36\364]\334\205\5f\331\336\216\221\17", ) , ) == 0x0 01667 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3v\275\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\372'g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01668 1356 NtQuerySystemInformation (TimeOfDay, 48, ... 01669 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75536, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75536, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0d\6\0\0\270\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75537, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0d\6\0\0\270\1\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75537, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75536, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0d\6\0\0\270\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75537, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0d\6\0\0\270\1\0\0" ) ) == 0x0 01670 1736 NtResumeThread (488, ... 1, ) == 0x0 01671 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 56360960, 1048576, ) == 0x0 01672 1736 NtAllocateVirtualMemory (-1, 57401344, 0, 8192, 4096, 4, ... 57401344, 8192, ) == 0x0 01673 1736 NtProtectVirtualMemory (-1, (0x36be000), 4096, 260, ... (0x36be000), 4096, 4, ) == 0x0 01674 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01668 1356 NtQuerySystemInformation ... {system info, class 3, size 48}, 48, ) == 0x0 01675 440 NtTestAlert (... 01676 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... 01675 440 NtTestAlert ... ) == 0x0 01676 1356 NtQuerySystemInformation ... {system info, class 8, size 48}, 48, ) == 0x0 01677 440 NtContinue (56360240, 1, ... 01678 1356 NtQuerySystemInformation (Performance, 312, ... 01679 440 NtRegisterThreadTerminatePort (24, ... 01678 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01679 440 NtRegisterThreadTerminatePort ... ) == 0x0 01680 1356 NtQuerySystemInformation (Exception, 16, ... 01674 1736 NtCreateThread ... 492, {1636, 1296}, ) == 0x0 01681 440 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01682 1736 NtQueryInformationThread (492, Basic, 28, ... 01681 440 NtDuplicateObject ... 496, ) == 0x0 01682 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1636,Tid=1296,}, 0x0, ) == 0x0 01683 440 NtWaitForSingleObject (64, 0, {0, 0}, ... 01684 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75537, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75537, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0d\6\0\0\20\5\0\0" ... ... 01683 440 NtWaitForSingleObject ... ) == 0x102 01684 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75538, 0} ... {28, 56, reply, 0, 1636, 1736, 75538, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0d\6\0\0\20\5\0\0" ) ) == 0x0 01685 440 NtWaitForSingleObject (128, 0, 0x0, ... 01680 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01686 1736 NtResumeThread (492, ... 01687 1356 NtQuerySystemInformation (Lookaside, 32, ... 01686 1736 NtResumeThread ... 1, ) == 0x0 01687 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01688 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01689 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01688 1736 NtAllocateVirtualMemory ... 57409536, 1048576, ) == 0x0 01689 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01690 1736 NtAllocateVirtualMemory (-1, 58449920, 0, 8192, 4096, 4, ... 01691 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... 01690 1736 NtAllocateVirtualMemory ... 58449920, 8192, ) == 0x0 01692 1296 NtTestAlert (... 01691 1356 NtQuerySystemInformation ... ) == STATUS_INFO_LENGTH_MISMATCH 01692 1296 NtTestAlert ... ) == 0x0 01693 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ... 01694 1296 NtContinue (57408816, 1, ... 01693 1356 NtCreateKey ... -2147482564, 2, ) == 0x0 01695 1296 NtRegisterThreadTerminatePort (24, ... 01696 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "\2573=Y\353*h\25\325\223\307f\0\350\325\321w\237:\206\261Vpo]y\4\236*|\22\320\370\261\370\34p)\32\274=&\30\25{\13\250\257\237~\323\366KDKG\1\257D2\330R\3279<\343P\177uu\205\366\227x\272\27O\2458c", 80, ... , 0, 3, (-2147482564, "Seed", 0, 3, "\2573=Y\353*h\25\325\223\307f\0\350\325\321w\237:\206\261Vpo]y\4\236*|\22\320\370\261\370\34p)\32\274=&\30\25{\13\250\257\237~\323\366KDKG\1\257D2\330R\3279<\343P\177uu\205\366\227x\272\27O\2458c", 80, ... , 80, ... 01695 1296 NtRegisterThreadTerminatePort ... ) == 0x0 01696 1356 NtSetValueKey ... ) == 0x0 01697 1736 NtProtectVirtualMemory (-1, (0x37be000), 4096, 260, ... 01698 1356 NtClose (-2147482564, ... 01697 1736 NtProtectVirtualMemory ... (0x37be000), 4096, 4, ) == 0x0 01699 1296 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01700 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01699 1296 NtDuplicateObject ... 500, ) == 0x0 01700 1736 NtCreateThread ... 504, {1636, 1620}, ) == 0x0 01701 1296 NtWaitForSingleObject (64, 0, {0, 0}, ... 01702 1736 NtQueryInformationThread (504, Basic, 28, ... 01701 1296 NtWaitForSingleObject ... ) == 0x102 01702 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1636,Tid=1620,}, 0x0, ) == 0x0 01703 1296 NtWaitForSingleObject (128, 0, 0x0, ... 01698 1356 NtClose ... ) == 0x0 01704 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75538, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75538, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0d\6\0\0T\6\0\0" ... ... 01667 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\344]zB\10\345\13{\20\17\0l$^u\17k\360=}\374\332\322Kf\206yC\250\241\353\227N8{\24\345\322An\356\17\2436\261:\225\242s3M\21r\334\234\252\317\366L\376\211\214\331]\206\331~Du\202e\36\1''\374\376+\376'\206ah\4\360F\373d\273\260A\373\332\217\314\306y\323B\225\243UP`A\316\311\365:\216\205&J\275L\376\251ZO\250x\301S\257l\352\241\12\366\210NV\222\252\31Y\310vd4\374!\346\200\256N3\3067 urz\207\376\331\240\343\360\363&@:[0gz\255\337n\3114\277Z,\2\16\310o\270%E\217\343p\21\17K\257\215}\275\257\201\277\351\253\36r|99\371d@\301\26\373\200\242\305\20Ve\25\346\331\375\271\340\267\34\34\352\204\271z\376.\250/\253\325\346\302\373\364\244\201\233S\343\374\303F\1`\336a\325\330\25\242ZD", ) , ) == 0x0 01704 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75539, 0} ... {28, 56, reply, 0, 1636, 1736, 75539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0d\6\0\0T\6\0\0" ) ) == 0x0 01705 1356 NtDeviceIoControlFile (380, 0, 0x0, 0x0, 0x390008, (380, 0, 0x0, 0x0, 0x390008, "K\343pZD\353\315\337\354\22B\361L\3v\275\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\260\213\333?\200\201\236\372'g\205\2171\4\24h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01706 1736 NtResumeThread (504, ... 01707 1356 NtQuerySystemInformation (TimeOfDay, 48, ... 01706 1736 NtResumeThread ... 1, ) == 0x0 01707 1356 NtQuerySystemInformation ... {system info, class 3, size 48}, 48, ) == 0x0 01708 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01709 1356 NtQuerySystemInformation (ProcessorTimes, 48, ... 01710 1620 NtTestAlert (... 01708 1736 NtAllocateVirtualMemory ... 58458112, 1048576, ) == 0x0 01710 1620 NtTestAlert ... ) == 0x0 01711 1736 NtAllocateVirtualMemory (-1, 59498496, 0, 8192, 4096, 4, ... 01712 1620 NtContinue (58457392, 1, ... 01711 1736 NtAllocateVirtualMemory ... 59498496, 8192, ) == 0x0 01713 1620 NtRegisterThreadTerminatePort (24, ... 01714 1736 NtProtectVirtualMemory (-1, (0x38be000), 4096, 260, ... 01713 1620 NtRegisterThreadTerminatePort ... ) == 0x0 01714 1736 NtProtectVirtualMemory ... (0x38be000), 4096, 4, ) == 0x0 01709 1356 NtQuerySystemInformation ... {system info, class 8, size 48}, 48, ) == 0x0 01715 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01716 1356 NtQuerySystemInformation (Performance, 312, ... 01717 1620 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01716 1356 NtQuerySystemInformation ... {system info, class 2, size 312}, 312, ) == 0x0 01717 1620 NtDuplicateObject ... 508, ) == 0x0 01718 1356 NtQuerySystemInformation (Exception, 16, ... 01719 1620 NtWaitForSingleObject (64, 0, {0, 0}, ... 01718 1356 NtQuerySystemInformation ... {system info, class 33, size 16}, 16, ) == 0x0 01719 1620 NtWaitForSingleObject ... ) == 0x102 01720 1356 NtQuerySystemInformation (Lookaside, 32, ... 01721 1620 NtWaitForSingleObject (128, 0, 0x0, ... 01715 1736 NtCreateThread ... 512, {1636, 1588}, ) == 0x0 01720 1356 NtQuerySystemInformation ... {system info, class 45, size 32}, 32, ) == 0x0 01722 1736 NtQueryInformationThread (512, Basic, 28, ... 01723 1356 NtQuerySystemInformation (ProcessorStatistics, 3016, ... 01722 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1636,Tid=1588,}, 0x0, ) == 0x0 01723 1356 NtQuerySystemInformation ... {system info, class 23, size 0}, 0, ) == 0x0 01724 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75539, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0d\6\0\04\6\0\0" ... ... 01725 1356 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... 01724 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75540, 0} ... {28, 56, reply, 0, 1636, 1736, 75540, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0d\6\0\04\6\0\0" ) ) == 0x0 01725 1356 NtQuerySystemInformation ... ) == STATUS_INFO_LENGTH_MISMATCH 01726 1356 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482564, 2, ) }, 0, 0x0, 0, ... -2147482564, 2, ) == 0x0 01727 1356 NtSetValueKey (-2147482564, (-2147482564, "Seed", 0, 3, "\22\32\376\361\351\277\325\362)\1\17kd\360P3\334\221{\226\277u\31WU\320\235M\267\27\335\271\203l\267\203\31\3X\323\303\242\3349OZ\0~S\307\37\32\253\257\11\251e\301r\21\233\257\34!2\0)\336\377V\244\221l\332[\354\223\351\305A", 80, ... ) , 0, 3, (-2147482564, "Seed", 0, 3, "\22\32\376\361\351\277\325\362)\1\17kd\360P3\334\221{\226\277u\31WU\320\235M\267\27\335\271\203l\267\203\31\3X\323\303\242\3349OZ\0~S\307\37\32\253\257\11\251e\301r\21\233\257\34!2\0)\336\377V\244\221l\332[\354\223\351\305A", 80, ... ) , 80, ... ) == 0x0 01728 1356 NtClose (-2147482564, ... ) == 0x0 01705 1356 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\231\36#\327\371y\301\261vB\223cg#\345\7p\354\3477\236\10\342\276\30\306`y\237\252\214\17\230\251;)\210!\270\12T\36\376]}\355|x\36j\23\322`L+\223A\304\262T\225\266\364'\377\341\300\233\304\274]\320\27l\10\255"\3610\223\300\255\15f\17;H_\345j\351\350L\247\326\216~E\256M\252m!\371\316\240\250\31\333\\250e\375\317s\10\221\350\22\11\312\371\200\376\230\261\373\6\374\313\254\336\244V\255\311|\300\220\273\32\334\267\265-D\371C\244\322\200[\15kN\330\371\327\232\243\375\11R\374Yv\373F\314Jp\33W\350\372\351\242`\304\230/\30\331\267D\371\1Y\26\224\3127n\371\245\317\20\313DZ\226\23{\321\!\324\325\365@\2\327\243y\16\242\304\312\214\262\211\3\323\24}\3\377N\315\223\341x\234\233\22\371\361\25\23\331LoA\36\36=\12\350\347\373G\1\2704s", ) \3610\223\300\255\15f\17;H_\345j\351\350L\247\326\216~E\256M\252m!\371\316\240\250\31\333\\250e\375\317s\10\221\350\22\11\312\371\200\376\230\261\373\6\374\313\254\336\244V\255\311|\300\220\273\32\334\267\265-D\371C\244\322\200[\15kN\330\371\327\232\243\375\11R\374Yv\373F\314Jp\33W\350\372\351\242`\304\230/\30\331\267D\371\1Y\26\224\3127n\371\245\317\20\313DZ\226\23{\321\!\324\325\365@\2\327\243y\16\242\304\312\214\262\211\3\323\24}\3\377N\315\223\341x\234\233\22\371\361\25\23\331LoA\36\36=\12\350\347\373G\1\2704s", ) == 0x0 01729 1736 NtResumeThread (512, ... 1, ) == 0x0 01730 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 59506688, 1048576, ) == 0x0 01731 1736 NtAllocateVirtualMemory (-1, 60547072, 0, 8192, 4096, 4, ... 60547072, 8192, ) == 0x0 01732 1736 NtProtectVirtualMemory (-1, (0x39be000), 4096, 260, ... (0x39be000), 4096, 4, ) == 0x0 01733 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 516, {1636, 2044}, ) == 0x0 01734 1736 NtQueryInformationThread (516, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1636,Tid=2044,}, 0x0, ) == 0x0 01735 1356 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 01736 1588 NtTestAlert (... 01735 1356 NtCreateEvent ... 520, ) == 0x0 01736 1588 NtTestAlert ... ) == 0x0 01737 1356 NtSetEventBoostPriority (396, ... 01738 1588 NtContinue (59505968, 1, ... 01527 896 NtWaitForSingleObject ... ) == 0x0 01737 1356 NtSetEventBoostPriority ... ) == 0x0 01739 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 01740 1588 NtRegisterThreadTerminatePort (24, ... 01739 896 NtCreateEvent ... 524, ) == 0x0 01741 1356 NtConnectPort ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11006584, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11006584, 188, ... 01742 896 NtConnectPort ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15461740, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15461740, 188, ... 01740 1588 NtRegisterThreadTerminatePort ... ) == 0x0 01743 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75540, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75540, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0d\6\0\0\374\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0d\6\0\0\374\7\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75543, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75540, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0d\6\0\0\374\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0d\6\0\0\374\7\0\0" ) ) == 0x0 01744 1736 NtResumeThread (516, ... 1, ) == 0x0 01745 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 60555264, 1048576, ) == 0x0 01746 1736 NtAllocateVirtualMemory (-1, 61595648, 0, 8192, 4096, 4, ... 61595648, 8192, ) == 0x0 01747 1736 NtProtectVirtualMemory (-1, (0x3abe000), 4096, 260, ... (0x3abe000), 4096, 4, ) == 0x0 01748 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01749 1588 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01750 2044 NtTestAlert (... 01749 1588 NtDuplicateObject ... 528, ) == 0x0 01750 2044 NtTestAlert ... ) == 0x0 01751 1588 NtWaitForSingleObject (64, 0, {0, 0}, ... 01752 2044 NtContinue (60554544, 1, ... 01751 1588 NtWaitForSingleObject ... ) == 0x102 01753 2044 NtRegisterThreadTerminatePort (24, ... 01754 1588 NtWaitForSingleObject (128, 0, 0x0, ... 01753 2044 NtRegisterThreadTerminatePort ... ) == 0x0 01748 1736 NtCreateThread ... 532, {1636, 1308}, ) == 0x0 01742 896 NtConnectPort ... 536, 0x0, 0x0, 0x0, 188, ) == 0x0 01741 1356 NtConnectPort ... 540, 0x0, 0x0, 0x0, 188, ) == 0x0 01755 1736 NtQueryInformationThread (532, Basic, 28, ... 01756 896 NtRequestWaitReplyPort (536, {200, 224, new_msg, 0, 1382384, 12, 2, 1310721} (536, {200, 224, new_msg, 0, 1382384, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\30I\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0s\256\254\231F\356\304\312\350J\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\300J\25\0\23\261%\0x\1\24\0\340J\25\0h\1\24\0\0\0\0\0\0\0\0\0\340J\25\0P\0\0\0\350J\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\353\0\372\31\221|\200\363\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... ... 01757 1356 NtRequestWaitReplyPort (540, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2} (540, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\3\0\4\0\0\0\240<\24\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0d\341\302$\241\233\352\301pJ\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\230G\25\0OH1\220x\1\24\0hJ\25\0h\1\24\0\0\0\0\0\0\0\0\0hJ\25\0P\0\0\0pJ\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\247\0\372\31\221|\214\370\247\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... ... 01755 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1636,Tid=1308,}, 0x0, ) == 0x0 01758 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75543, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0d\6\0\0\34\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75546, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0d\6\0\0\34\5\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75546, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0d\6\0\0\34\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75546, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0d\6\0\0\34\5\0\0" ) ) == 0x0 01756 896 NtRequestWaitReplyPort ... {200, 224, reply, 0, 1636, 896, 75544, 0} ... {200, 224, reply, 0, 1636, 896, 75544, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0s\256\254\231F\356\304\312\350J\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\300J\25\0\23\261%\0x\1\24\0\340J\25\0h\1\24\0\0\0\0\0\0\0\0\0\340J\25\0P\0\0\0\350J\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\353\0\372\31\221|\200\363\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ) == 0x0 01757 1356 NtRequestWaitReplyPort ... {200, 224, reply, 0, 1636, 1356, 75545, 0} ... {200, 224, reply, 0, 1636, 1356, 75545, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\240<\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0d\341\302$\241\233\352\301pJ\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\230G\25\0OH1\220x\1\24\0hJ\25\0h\1\24\0\0\0\0\0\0\0\0\0hJ\25\0P\0\0\0pJ\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\247\0\372\31\221|\214\370\247\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ) == 0x0 01759 2044 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01760 896 NtRequestWaitReplyPort (536, {44, 68, new_msg, 0, 1636, 896, 75526, 0} (536, {44, 68, new_msg, 0, 1636, 896, 75526, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ... ... 01761 1356 NtRequestWaitReplyPort (540, {44, 68, new_msg, 56, 0, 0, 0, 0} (540, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0PN\25\0\322\0\0\0" ... ... 01759 2044 NtDuplicateObject ... 544, ) == 0x0 01762 2044 NtAllocateVirtualMemory (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0 01763 2044 NtWaitForSingleObject (64, 0, {0, 0}, ... 01764 1736 NtResumeThread (532, ... 1, ) == 0x0 01765 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 61603840, 1048576, ) == 0x0 01766 1736 NtAllocateVirtualMemory (-1, 62644224, 0, 8192, 4096, 4, ... 62644224, 8192, ) == 0x0 01760 896 NtRequestWaitReplyPort ... {40, 64, reply, 0, 1636, 896, 75547, 0} ... {40, 64, reply, 0, 1636, 896, 75547, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\320\1\0\0X-\12\0" ) ) == 0x0 01763 2044 NtWaitForSingleObject ... ) == 0x102 01761 1356 NtRequestWaitReplyPort ... {40, 64, reply, 0, 1636, 1356, 75548, 0} ... {40, 64, reply, 0, 1636, 1356, 75548, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\323\1\0\0\350\370\14\0" ) ) == 0x0 01767 1308 NtTestAlert (... 01768 896 NtRequestWaitReplyPort (536, {64, 88, new_msg, 56, 1390064, 15462252, 15462352, 0} (536, {64, 88, new_msg, 56, 1390064, 15462252, 15462352, 0} "\10\357\353\0@\0\25\0\346\277\347w\320\357\353\0l\357\353\0\20\0\0\0\250.\362vd6\25\0\1\0\0\0\220P\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\300\332\24\0" ... ... 01769 2044 NtWaitForSingleObject (128, 0, 0x0, ... 01770 1356 NtRequestWaitReplyPort (540, {64, 88, new_msg, 56, 1310720, 11006452, 1396296, 0} (540, {64, 88, new_msg, 56, 1310720, 11006452, 1396296, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0hR\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ... ... 01767 1308 NtTestAlert ... ) == 0x0 01768 896 NtRequestWaitReplyPort ... {64, 88, reply, 56, 1636, 896, 75549, 0} ... {64, 88, reply, 56, 1636, 896, 75549, 0} "\10\357\353\0@\0\25\0\346\277\347w\320\357\353\0l\357\353\0\20\0\0\0\250.\362vd6\25\0\1\0\0\0\220P\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\300\332\24\0" ) ) == 0x0 01771 1308 NtContinue (61603120, 1, ... 01772 896 NtClose (524, ... 01770 1356 NtRequestWaitReplyPort ... {64, 88, reply, 56, 1636, 1356, 75550, 0} ... {64, 88, reply, 56, 1636, 1356, 75550, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0hR\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01773 1308 NtRegisterThreadTerminatePort (24, ... 01772 896 NtClose ... ) == 0x0 01774 1356 NtRequestWaitReplyPort (540, {44, 68, new_msg, 56, 1636, 1356, 75548, 0} (540, {44, 68, new_msg, 56, 1636, 1356, 75548, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0PN\25\0\322\0\0\0" ... ... 01773 1308 NtRegisterThreadTerminatePort ... ) == 0x0 01775 1736 NtProtectVirtualMemory (-1, (0x3bbe000), 4096, 260, ... 01776 896 NtClose (536, ... 01775 1736 NtProtectVirtualMemory ... (0x3bbe000), 4096, 4, ) == 0x0 01776 896 NtClose ... ) == 0x0 01777 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01778 896 NtCreateKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ... 01777 1736 NtCreateThread ... 536, {1636, 1676}, ) == 0x0 01778 896 NtCreateKey ... 524, 2, ) == 0x0 01779 1736 NtQueryInformationThread (536, Basic, 28, ... 01780 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ... 01779 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1636,Tid=1676,}, 0x0, ) == 0x0 01780 896 NtOpenKey ... 548, ) == 0x0 01781 1308 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01774 1356 NtRequestWaitReplyPort ... {40, 64, reply, 0, 1636, 1356, 75551, 0} ... {40, 64, reply, 0, 1636, 1356, 75551, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\351\1\0\0\350\232\14\0" ) ) == 0x0 01782 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75546, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75546, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0d\6\0\0\214\6\0\0" ... ... 01781 1308 NtDuplicateObject ... 552, ) == 0x0 01783 1356 NtRequestWaitReplyPort (540, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0} (540, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0pY\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ... ... 01782 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75553, 0} ... {28, 56, reply, 0, 1636, 1736, 75553, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0d\6\0\0\214\6\0\0" ) ) == 0x0 01784 1308 NtWaitForSingleObject (64, 0, {0, 0}, ... 01785 1736 NtResumeThread (536, ... 01784 1308 NtWaitForSingleObject ... ) == 0x102 01783 1356 NtRequestWaitReplyPort ... {64, 88, reply, 56, 1636, 1356, 75554, 0} ... {64, 88, reply, 56, 1636, 1356, 75554, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0pY\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01785 1736 NtResumeThread ... 1, ) == 0x0 01786 1308 NtWaitForSingleObject (128, 0, 0x0, ... 01787 1356 NtRequestWaitReplyPort (540, {44, 68, new_msg, 56, 1636, 1356, 75551, 0} (540, {44, 68, new_msg, 56, 1636, 1356, 75551, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0PN\25\0\322\0\0\0" ... ... 01788 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01789 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ... 01790 1676 NtTestAlert (... 01789 896 NtOpenKey ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01790 1676 NtTestAlert ... ) == 0x0 01791 896 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ... 01792 1676 NtContinue (62651696, 1, ... 01791 896 NtOpenKey ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01793 1676 NtRegisterThreadTerminatePort (24, ... 01794 896 NtQueryValueKey (524, (524, "Domain", Partial, 144, ... , Partial, 144, ... 01793 1676 NtRegisterThreadTerminatePort ... ) == 0x0 01794 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 01788 1736 NtAllocateVirtualMemory ... 62652416, 1048576, ) == 0x0 01787 1356 NtRequestWaitReplyPort ... {40, 64, reply, 0, 1636, 1356, 75555, 0} ... {40, 64, reply, 0, 1636, 1356, 75555, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" ) ) == 0x0 01795 1676 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01796 1736 NtAllocateVirtualMemory (-1, 63692800, 0, 8192, 4096, 4, ... 01797 1356 NtRequestWaitReplyPort (540, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0} (540, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0\360\\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ... ... 01795 1676 NtDuplicateObject ... 556, ) == 0x0 01796 1736 NtAllocateVirtualMemory ... 63692800, 8192, ) == 0x0 01798 1676 NtWaitForSingleObject (64, 0, {0, 0}, ... 01799 1736 NtProtectVirtualMemory (-1, (0x3cbe000), 4096, 260, ... 01797 1356 NtRequestWaitReplyPort ... {64, 88, reply, 56, 1636, 1356, 75556, 0} ... {64, 88, reply, 56, 1636, 1356, 75556, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0\360\\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01798 1676 NtWaitForSingleObject ... ) == 0x102 01799 1736 NtProtectVirtualMemory ... (0x3cbe000), 4096, 4, ) == 0x0 01800 1356 NtClose (520, ... 01801 1676 NtWaitForSingleObject (128, 0, 0x0, ... 01802 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01800 1356 NtClose ... ) == 0x0 01803 896 NtQueryValueKey (524, (524, "Domain", Partial, 144, ... , Partial, 144, ... 01802 1736 NtCreateThread ... 520, {1636, 1376}, ) == 0x0 01803 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 01804 1736 NtQueryInformationThread (520, Basic, 28, ... 01805 896 NtClose (524, ... 01804 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1636,Tid=1376,}, 0x0, ) == 0x0 01805 896 NtClose ... ) == 0x0 01806 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75553, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75553, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0d\6\0\0`\5\0\0" ... ... 01807 896 NtClose (548, ... 01806 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75557, 0} ... {28, 56, reply, 0, 1636, 1736, 75557, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0d\6\0\0`\5\0\0" ) ) == 0x0 01807 896 NtClose ... ) == 0x0 01808 1356 NtClose (540, ... 01809 1736 NtResumeThread (520, ... 01808 1356 NtClose ... ) == 0x0 01809 1736 NtResumeThread ... 1, ) == 0x0 01810 1356 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 01811 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01810 1356 NtCreateEvent ... 540, ) == 0x0 01811 1736 NtAllocateVirtualMemory ... 63700992, 1048576, ) == 0x0 01812 1356 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ... 01813 1736 NtAllocateVirtualMemory (-1, 64741376, 0, 8192, 4096, 4, ... 01812 1356 NtOpenKey ... 548, ) == 0x0 01813 1736 NtAllocateVirtualMemory ... 64741376, 8192, ) == 0x0 01814 896 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ... 01815 1376 NtTestAlert (... 01816 1356 NtOpenKey (0x20019, {24, 548, 0x40, 0, 0, (0x20019, {24, 548, 0x40, 0, 0, "ActiveComputerName"}, ... }, ... 01814 896 NtOpenKey ... 524, ) == 0x0 01815 1376 NtTestAlert ... ) == 0x0 01816 1356 NtOpenKey ... 560, ) == 0x0 01817 896 NtQueryValueKey (524, (524, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ... 01818 1376 NtContinue (63700272, 1, ... 01819 1356 NtQueryValueKey (560, (560, "ComputerName", Full, 108, ... , Full, 108, ... 01817 896 NtQueryValueKey ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01820 1376 NtRegisterThreadTerminatePort (24, ... 01819 1356 NtQueryValueKey ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 01821 896 NtClose (524, ... 01820 1376 NtRegisterThreadTerminatePort ... ) == 0x0 01822 1356 NtClose (560, ... 01821 896 NtClose ... ) == 0x0 01823 1736 NtProtectVirtualMemory (-1, (0x3dbe000), 4096, 260, ... 01822 1356 NtClose ... ) == 0x0 01824 1376 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01823 1736 NtProtectVirtualMemory ... (0x3dbe000), 4096, 4, ) == 0x0 01825 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15461328, ... }, 15461328, ... 01824 1376 NtDuplicateObject ... 560, ) == 0x0 01826 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01825 896 NtQueryAttributesFile ... ) == 0x0 01827 1376 NtWaitForSingleObject (64, 0, {0, 0}, ... 01826 1736 NtCreateThread ... 524, {1636, 1436}, ) == 0x0 01828 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ... 01827 1376 NtWaitForSingleObject ... ) == 0x102 01829 1736 NtQueryInformationThread (524, Basic, 28, ... 01828 896 NtOpenFile ... 564, {status=0x0, info=1}, ) == 0x0 01830 1376 NtWaitForSingleObject (128, 0, 0x0, ... 01829 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1636,Tid=1436,}, 0x0, ) == 0x0 01831 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 564, ... 01832 1356 NtClose (548, ... 01831 896 NtCreateSection ... 568, ) == 0x0 01832 1356 NtClose ... ) == 0x0 01833 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75557, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75557, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0d\6\0\0\234\5\0\0" ... ... 01834 1356 NtCreateIoCompletion (0x1f0003, 0x0, 0, ... 01833 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75559, 0} ... {28, 56, reply, 0, 1636, 1736, 75559, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0d\6\0\0\234\5\0\0" ) ) == 0x0 01834 1356 NtCreateIoCompletion ... 548, ) == 0x0 01835 1736 NtResumeThread (524, ... 01836 1356 NtCreateIoCompletion (0x1f0003, 0x0, -1, ... 01835 1736 NtResumeThread ... 1, ) == 0x0 01836 1356 NtCreateIoCompletion ... 572, ) == 0x0 01837 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01838 896 NtClose (564, ... 01839 1436 NtWaitForSingleObject (92, 0, 0x0, ... 01840 1356 NtDuplicateObject (-1, 548, -1, 0x0, 0, 2, ... 01838 896 NtClose ... ) == 0x0 01840 1356 NtDuplicateObject ... 564, ) == 0x0 01841 896 NtMapViewOfSection (568, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... 01842 1356 NtOpenThreadToken (-2, 0xc, 1, ... 01841 896 NtMapViewOfSection ... (0x850000), 0x0, 20480, ) == 0x0 01842 1356 NtOpenThreadToken ... ) == STATUS_NO_TOKEN 01843 896 NtClose (568, ... 01844 1356 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 01843 896 NtClose ... ) == 0x0 01844 1356 NtCreateEvent ... 568, ) == 0x0 01837 1736 NtAllocateVirtualMemory ... 64749568, 1048576, ) == 0x0 01845 1736 NtAllocateVirtualMemory (-1, 65789952, 0, 8192, 4096, 4, ... 65789952, 8192, ) == 0x0 01846 1736 NtProtectVirtualMemory (-1, (0x3ebe000), 4096, 260, ... (0x3ebe000), 4096, 4, ) == 0x0 01847 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 576, {1636, 724}, ) == 0x0 01848 1736 NtQueryInformationThread (576, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1636,Tid=724,}, 0x0, ) == 0x0 01849 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75559, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75559, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0d\6\0\0\324\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75560, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0d\6\0\0\324\2\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75560, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75559, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0d\6\0\0\324\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75560, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0d\6\0\0\324\2\0\0" ) ) == 0x0 01850 1356 NtOpenThreadToken (-2, 0xc, 1, ... 01851 896 NtUnmapViewOfSection (-1, 0x850000, ... 01850 1356 NtOpenThreadToken ... ) == STATUS_NO_TOKEN 01851 896 NtUnmapViewOfSection ... ) == 0x0 01852 1356 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... 01853 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15461636, ... }, 15461636, ... 01852 1356 NtSetInformationThread ... ) == 0x0 01853 896 NtQueryAttributesFile ... ) == 0x0 01854 1356 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 11006144, (0xc0100080, {24, 0, 0x40, 0, 11006144, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ... 01855 1736 NtResumeThread (576, ... 01854 1356 NtCreateFile ... 580, {status=0x0, info=1}, ) == 0x0 01855 1736 NtResumeThread ... 1, ) == 0x0 01856 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 65798144, 1048576, ) == 0x0 01857 1736 NtAllocateVirtualMemory (-1, 66838528, 0, 8192, 4096, 4, ... 66838528, 8192, ) == 0x0 01858 1736 NtProtectVirtualMemory (-1, (0x3fbe000), 4096, 260, ... (0x3fbe000), 4096, 4, ) == 0x0 01859 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 584, {1636, 1276}, ) == 0x0 01860 1736 NtQueryInformationThread (584, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1636,Tid=1276,}, 0x0, ) == 0x0 01861 1356 NtSetInformationFile (580, 11006200, 8, Pipe, ... 01862 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ... 01863 724 NtWaitForSingleObject (92, 0, 0x0, ... 01861 1356 NtSetInformationFile ... {status=0x0, info=0}, ) == 0x0 01862 896 NtOpenFile ... 588, {status=0x0, info=1}, ) == 0x0 01864 1356 NtSetInformationFile (580, 11006188, 8, Completion, ... 01865 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 588, ... 01864 1356 NtSetInformationFile ... {status=0x0, info=0}, ) == 0x0 01865 896 NtCreateSection ... 592, ) == 0x0 01866 1356 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... 01867 896 NtQuerySection (592, Image, 48, ... 01866 1356 NtSetInformationThread ... ) == 0x0 01867 896 NtQuerySection ... {section info, class 1, size 48}, 0x0, ) == 0x0 01868 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75560, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75560, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0d\6\0\0\374\4\0\0" ... ... 01869 1356 NtWriteFile (580, 217, 0, 0, (580, 217, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ... 01868 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75561, 0} ... {28, 56, reply, 0, 1636, 1736, 75561, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0d\6\0\0\374\4\0\0" ) ) == 0x0 01869 1356 NtWriteFile ... {status=0x0, info=72}, ) == 0x0 01870 1736 NtResumeThread (584, ... 01871 1356 NtAllocateVirtualMemory (-1, 1400832, 0, 4096, 4096, 4, ... 01870 1736 NtResumeThread ... 1, ) == 0x0 01871 1356 NtAllocateVirtualMemory ... 1400832, 4096, ) == 0x0 01872 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01873 1356 NtReadFile (580, 217, 0, 0, 1024, {0, 0}, 0, ... 01874 896 NtClose (588, ... 01875 1276 NtWaitForSingleObject (92, 0, 0x0, ... 01873 1356 NtReadFile ... {status=0x0, info=68}, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 01874 896 NtClose ... ) == 0x0 01872 1736 NtAllocateVirtualMemory ... 66846720, 1048576, ) == 0x0 01876 896 NtMapViewOfSection (592, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... 01877 1736 NtAllocateVirtualMemory (-1, 67887104, 0, 8192, 4096, 4, ... 01876 896 NtMapViewOfSection ... (0x76fb0000), 0x0, 32768, ) == 0x0 01877 1736 NtAllocateVirtualMemory ... 67887104, 8192, ) == 0x0 01878 896 NtClose (592, ... 01879 1736 NtProtectVirtualMemory (-1, (0x40be000), 4096, 260, ... 01878 896 NtClose ... ) == 0x0 01879 1736 NtProtectVirtualMemory ... (0x40be000), 4096, 4, ) == 0x0 01880 1356 NtFsControlFile (580, 217, 0x0, 0x0, 0x11c017, (580, 217, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\247\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ... 01881 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01880 1356 NtFsControlFile ... {status=0x103, info=68}, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 01882 896 NtProtectVirtualMemory (-1, (0x76fb1000), 232, 4, ... 01883 1356 NtFsControlFile (580, 217, 0x0, 0x0, 0x11c017, (580, 217, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\1\0\0\0\1\0\0\0&\0(\00_\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ... 01882 896 NtProtectVirtualMemory ... (0x76fb1000), 4096, 32, ) == 0x0 01883 1356 NtFsControlFile ... {status=0x103, info=48}, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) , ) == 0x103 01884 896 NtProtectVirtualMemory (-1, (0x76fb1000), 4096, 32, ... 01885 1356 NtFsControlFile (580, 217, 0x0, 0x0, 0x11c017, (580, 217, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340", 44, 1024, ... , 44, 1024, ... 01884 896 NtProtectVirtualMemory ... (0x76fb1000), 4096, 4, ) == 0x0 01885 1356 NtFsControlFile ... {status=0x103, info=156}, ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\080\25\0\1\0\0\0D0\25\0 \0\0\0\1\0\0\0\30\0\32\0P0\25\0l0\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\2400\25\0\1\0\0\0\5\0\15\0\2600\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 01881 1736 NtCreateThread ... 592, {1636, 1368}, ) == 0x0 01886 896 NtFlushInstructionCache (-1, 1996165120, 232, ... 01887 1736 NtQueryInformationThread (592, Basic, 28, ... 01886 896 NtFlushInstructionCache ... ) == 0x0 01887 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1636,Tid=1368,}, 0x0, ) == 0x0 01888 896 NtProtectVirtualMemory (-1, (0x76fb1000), 232, 4, ... 01889 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75561, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75561, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0d\6\0\0X\5\0\0" ... ... 01888 896 NtProtectVirtualMemory ... (0x76fb1000), 4096, 32, ) == 0x0 01889 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75562, 0} ... {28, 56, reply, 0, 1636, 1736, 75562, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0d\6\0\0X\5\0\0" ) ) == 0x0 01890 896 NtProtectVirtualMemory (-1, (0x76fb1000), 4096, 32, ... 01891 1356 NtClose (568, ... 01890 896 NtProtectVirtualMemory ... (0x76fb1000), 4096, 4, ) == 0x0 01891 1356 NtClose ... ) == 0x0 01892 1736 NtResumeThread (592, ... 01893 1356 NtClose (580, ... 01892 1736 NtResumeThread ... 1, ) == 0x0 01893 1356 NtClose ... ) == 0x0 01894 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01895 1356 NtSecureConnectPort ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1382384, 0x0, 11008068, 188, ... , {12, 2, 1, 1}, 0x0, 1382384, 0x0, 11008068, 188, ... 01894 1736 NtAllocateVirtualMemory ... 67895296, 1048576, ) == 0x0 01896 1736 NtAllocateVirtualMemory (-1, 68935680, 0, 8192, 4096, 4, ... 68935680, 8192, ) == 0x0 01897 896 NtFlushInstructionCache (-1, 1996165120, 232, ... 01898 1368 NtWaitForSingleObject (92, 0, 0x0, ... 01897 896 NtFlushInstructionCache ... ) == 0x0 01899 896 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 580, ) }, ... 580, ) == 0x0 01900 896 NtMapViewOfSection (580, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0 01901 896 NtClose (580, ... ) == 0x0 01902 896 NtProtectVirtualMemory (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0 01903 896 NtProtectVirtualMemory (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0 01904 1736 NtProtectVirtualMemory (-1, (0x41be000), 4096, 260, ... 01895 1356 NtSecureConnectPort ... 580, 0x0, 0x0, 0x0, 188, ) == 0x0 01904 1736 NtProtectVirtualMemory ... (0x41be000), 4096, 4, ) == 0x0 01905 1356 NtOpenThreadToken (-2, 0xc, 1, ... 01906 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01905 1356 NtOpenThreadToken ... ) == STATUS_NO_TOKEN 01906 1736 NtCreateThread ... 568, {1636, 704}, ) == 0x0 01907 1356 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... 01908 1736 NtQueryInformationThread (568, Basic, 28, ... 01907 1356 NtSetInformationThread ... ) == 0x0 01908 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1636,Tid=704,}, 0x0, ) == 0x0 01909 1356 NtRequestWaitReplyPort (580, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977} (580, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\264\211\362\213\252\300\275\355\3\2\300\274\234+#\314\12\0\0\0\340\263i\245\277\3579\2\0\0\0\0\220\364\24\0\325\316\362\376\246r\341J(\0\0\0\2163\00\0\0\24\0\240\366\247\0\244 \255&\0\0\0\0pJ\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\247\0\372\31\221|X\376\247\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... ... 01910 896 NtFlushInstructionCache (-1, 1995837440, 228, ... 01911 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75562, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75562, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0d\6\0\0\300\2\0\0" ... ... 01910 896 NtFlushInstructionCache ... ) == 0x0 01911 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75564, 0} ... {28, 56, reply, 0, 1636, 1736, 75564, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0d\6\0\0\300\2\0\0" ) ) == 0x0 01912 896 NtProtectVirtualMemory (-1, (0x76f61000), 228, 4, ... 01913 1736 NtResumeThread (568, ... 01912 896 NtProtectVirtualMemory ... (0x76f61000), 4096, 32, ) == 0x0 01913 1736 NtResumeThread ... 1, ) == 0x0 01914 896 NtProtectVirtualMemory (-1, (0x76f61000), 4096, 32, ... 01915 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01914 896 NtProtectVirtualMemory ... (0x76f61000), 4096, 4, ) == 0x0 01909 1356 NtRequestWaitReplyPort ... {200, 224, reply, 0, 1636, 1356, 75565, 0} ... {200, 224, reply, 0, 1636, 1356, 75565, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\264\211\362\213\252\300\275\355\3\2\300\274\234+#\314\12\0\0\0\340\263i\245\277\3579\2\0\0\0\0\220\364\24\0\325\316\362\376\246r\341J(\0\0\0\2163\00\0\0\24\0\240\366\247\0\244 \255&\0\0\0\0pJ\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\247\0\372\31\221|X\376\247\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ) == 0x0 01916 704 NtWaitForSingleObject (92, 0, 0x0, ... 01915 1736 NtAllocateVirtualMemory ... 68943872, 1048576, ) == 0x0 01917 1356 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... 01918 1736 NtAllocateVirtualMemory (-1, 69984256, 0, 8192, 4096, 4, ... 01917 1356 NtSetInformationThread ... ) == 0x0 01918 1736 NtAllocateVirtualMemory ... 69984256, 8192, ) == 0x0 01919 1356 NtRequestWaitReplyPort (580, {56, 80, new_msg, 0, 44, 3, 20, 0} (580, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0b\363\222I\243j\304#\242z\321\340\1\0\0\0\0\0\0\0&\0(\0P\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ... ... 01920 1736 NtProtectVirtualMemory (-1, (0x42be000), 4096, 260, ... (0x42be000), 4096, 4, ) == 0x0 01921 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01922 896 NtFlushInstructionCache (-1, 1995837440, 228, ... ) == 0x0 01923 896 NtProtectVirtualMemory (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0 01924 896 NtProtectVirtualMemory (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0 01925 896 NtFlushInstructionCache (-1, 1996165120, 232, ... ) == 0x0 01926 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01927 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 588, ) == 0x0 01921 1736 NtCreateThread ... 596, {1636, 1568}, ) == 0x0 01928 1736 NtQueryInformationThread (596, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1636,Tid=1568,}, 0x0, ) == 0x0 01929 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75564, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75564, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0 \6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75567, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0 \6\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75567, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75564, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0 \6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75567, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0 \6\0\0" ) ) == 0x0 01930 1736 NtResumeThread (596, ... 1, ) == 0x0 01931 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 69992448, 1048576, ) == 0x0 01932 1736 NtAllocateVirtualMemory (-1, 71032832, 0, 8192, 4096, 4, ... 71032832, 8192, ) == 0x0 01933 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... }, ... 01934 1568 NtWaitForSingleObject (92, 0, 0x0, ... 01933 896 NtOpenKey ... 600, ) == 0x0 01935 896 NtQueryValueKey (600, (600, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (600, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01936 896 NtClose (600, ... ) == 0x0 01937 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01938 896 NtAllocateVirtualMemory (-1, 8806400, 0, 4096, 4096, 4, ... 8806400, 4096, ) == 0x0 01939 1736 NtProtectVirtualMemory (-1, (0x43be000), 4096, 260, ... 01919 1356 NtRequestWaitReplyPort ... {44, 68, reply, 0, 1636, 1356, 75566, 0} ... {44, 68, reply, 0, 1636, 1356, 75566, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 01939 1736 NtProtectVirtualMemory ... (0x43be000), 4096, 4, ) == 0x0 01940 1356 NtRaiseException (11008528, 11007788, 1, ... 01941 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01942 1356 NtQueryVirtualMemory (-1, 0x77ea0470, BasicVlm, 16, ... 01941 1736 NtCreateThread ... 600, {1636, 1104}, ) == 0x0 01942 1356 NtQueryVirtualMemory ... {memory info, class 3, size 16}, 0x0, ) == 0x0 01943 1736 NtQueryInformationThread (600, Basic, 28, ... 01944 1356 NtQueryVirtualMemory (-1, 0x77e7a298, Basic, 28, ... 01943 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1636,Tid=1104,}, 0x0, ) == 0x0 01944 1356 NtQueryVirtualMemory ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01945 896 NtQueryPerformanceCounter (... 01946 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75567, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75567, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0d\6\0\0P\4\0\0" ... ... 01945 896 NtQueryPerformanceCounter ... {1107265725, 16}, {3579545, 0}, ) == 0x0 01946 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75568, 0} ... {28, 56, reply, 0, 1636, 1736, 75568, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0d\6\0\0P\4\0\0" ) ) == 0x0 01947 896 NtSetEventBoostPriority (92, ... 01948 1736 NtResumeThread (600, ... 01839 1436 NtWaitForSingleObject ... ) == 0x0 01947 896 NtSetEventBoostPriority ... ) == 0x0 01949 1436 NtSetEventBoostPriority (92, ... 01948 1736 NtResumeThread ... 1, ) == 0x0 01863 724 NtWaitForSingleObject ... ) == 0x0 01949 1436 NtSetEventBoostPriority ... ) == 0x0 01950 896 NtWaitForSingleObject (92, 0, 0x0, ... 01951 724 NtSetEventBoostPriority (92, ... 01952 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 01953 1356 NtContinue (11006756, 0, ... 01954 1104 NtWaitForSingleObject (92, 0, 0x0, ... 01875 1276 NtWaitForSingleObject ... ) == 0x0 01951 724 NtSetEventBoostPriority ... ) == 0x0 01955 1436 NtTestAlert (... 01956 1276 NtSetEventBoostPriority (92, ... 01952 1736 NtAllocateVirtualMemory ... 71041024, 1048576, ) == 0x0 01898 1368 NtWaitForSingleObject ... ) == 0x0 01956 1276 NtSetEventBoostPriority ... ) == 0x0 01955 1436 NtTestAlert ... ) == 0x0 01957 1368 NtSetEventBoostPriority (92, ... 01958 1736 NtAllocateVirtualMemory (-1, 72081408, 0, 8192, 4096, 4, ... 01959 724 NtTestAlert (... 01916 704 NtWaitForSingleObject ... ) == 0x0 01957 1368 NtSetEventBoostPriority ... ) == 0x0 01960 1436 NtContinue (64748848, 1, ... 01958 1736 NtAllocateVirtualMemory ... 72081408, 8192, ) == 0x0 01961 704 NtSetEventBoostPriority (92, ... 01959 724 NtTestAlert ... ) == 0x0 01962 1356 NtDeviceIoControlFile (336, 108, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ... 01963 1276 NtTestAlert (... 01964 1436 NtRegisterThreadTerminatePort (24, ... 01934 1568 NtWaitForSingleObject ... ) == 0x0 01961 704 NtSetEventBoostPriority ... ) == 0x0 01965 1736 NtProtectVirtualMemory (-1, (0x44be000), 4096, 260, ... 01966 724 NtContinue (65797424, 1, ... 01967 1368 NtTestAlert (... 01963 1276 NtTestAlert ... ) == 0x0 01968 1568 NtSetEventBoostPriority (92, ... 01964 1436 NtRegisterThreadTerminatePort ... ) == 0x0 01962 1356 NtDeviceIoControlFile ... {status=0x0, info=0}, "", ) == 0x103 01965 1736 NtProtectVirtualMemory ... (0x44be000), 4096, 4, ) == 0x0 01969 724 NtRegisterThreadTerminatePort (24, ... 01967 1368 NtTestAlert ... ) == 0x0 01950 896 NtWaitForSingleObject ... ) == 0x0 01968 1568 NtSetEventBoostPriority ... ) == 0x0 01970 1276 NtContinue (66846000, 1, ... 01971 1436 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01972 1356 NtWaitForSingleObject (108, 1, {-5000000, -1}, ... 01973 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 01969 724 NtRegisterThreadTerminatePort ... ) == 0x0 01974 896 NtSetEventBoostPriority (92, ... 01975 1368 NtContinue (67894576, 1, ... 01976 704 NtTestAlert (... 01977 1276 NtRegisterThreadTerminatePort (24, ... 01978 1568 NtTestAlert (... 01971 1436 NtDuplicateObject ... 604, ) == 0x0 01954 1104 NtWaitForSingleObject ... ) == 0x0 01974 896 NtSetEventBoostPriority ... ) == 0x0 01979 724 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01980 1368 NtRegisterThreadTerminatePort (24, ... 01976 704 NtTestAlert ... ) == 0x0 01977 1276 NtRegisterThreadTerminatePort ... ) == 0x0 01978 1568 NtTestAlert ... ) == 0x0 01981 1104 NtTestAlert (... 01982 1436 NtWaitForSingleObject (64, 0, {0, 0}, ... 01973 1736 NtCreateThread ... 608, {1636, 784}, ) == 0x0 01983 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15461328, ... }, 15461328, ... 01980 1368 NtRegisterThreadTerminatePort ... ) == 0x0 01984 704 NtContinue (68943152, 1, ... 01985 1276 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01981 1104 NtTestAlert ... ) == 0x0 01986 1568 NtContinue (69991728, 1, ... 01982 1436 NtWaitForSingleObject ... ) == 0x102 01987 1736 NtQueryInformationThread (608, Basic, 28, ... 01983 896 NtQueryAttributesFile ... ) == 0x0 01988 1368 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01989 704 NtRegisterThreadTerminatePort (24, ... 01979 724 NtDuplicateObject ... 612, ) == 0x0 01985 1276 NtDuplicateObject ... 616, ) == 0x0 01990 1568 NtRegisterThreadTerminatePort (24, ... 01991 1436 NtWaitForSingleObject (128, 0, 0x0, ... 01987 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1636,Tid=784,}, 0x0, ) == 0x0 01992 896 NtQuerySystemInformation (Basic, 44, ... 01993 1104 NtContinue (71040304, 1, ... 01989 704 NtRegisterThreadTerminatePort ... ) == 0x0 01994 724 NtWaitForSingleObject (64, 0, {0, 0}, ... 01995 1276 NtWaitForSingleObject (64, 0, {0, 0}, ... 01990 1568 NtRegisterThreadTerminatePort ... ) == 0x0 01996 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75568, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75568, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0d\6\0\0\20\3\0\0" ... ... 01992 896 NtQuerySystemInformation ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 01997 1104 NtRegisterThreadTerminatePort (24, ... 01998 704 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01994 724 NtWaitForSingleObject ... ) == 0x102 01995 1276 NtWaitForSingleObject ... ) == 0x102 01999 1568 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 01996 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75569, 0} ... {28, 56, reply, 0, 1636, 1736, 75569, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0d\6\0\0\20\3\0\0" ) ) == 0x0 02000 896 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 01997 1104 NtRegisterThreadTerminatePort ... ) == 0x0 01988 1368 NtDuplicateObject ... 620, ) == 0x0 02001 724 NtWaitForSingleObject (128, 0, 0x0, ... 02002 1276 NtWaitForSingleObject (128, 0, 0x0, ... 01998 704 NtDuplicateObject ... 624, ) == 0x0 01999 1568 NtDuplicateObject ... 628, ) == 0x0 02000 896 NtAllocateVirtualMemory ... 8716288, 65536, ) == 0x0 02003 1104 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02004 1368 NtWaitForSingleObject (64, 0, {0, 0}, ... 02005 704 NtWaitForSingleObject (64, 0, {0, 0}, ... 02006 1568 NtWaitForSingleObject (64, 0, {0, 0}, ... 02007 1736 NtResumeThread (608, ... 02003 1104 NtDuplicateObject ... 632, ) == 0x0 02004 1368 NtWaitForSingleObject ... ) == 0x102 02005 704 NtWaitForSingleObject ... ) == 0x102 02006 1568 NtWaitForSingleObject ... ) == 0x102 02007 1736 NtResumeThread ... 1, ) == 0x0 02008 1104 NtWaitForSingleObject (64, 0, {0, 0}, ... 02009 1368 NtWaitForSingleObject (128, 0, 0x0, ... 02010 704 NtWaitForSingleObject (128, 0, 0x0, ... 02011 1568 NtWaitForSingleObject (128, 0, 0x0, ... 02012 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02013 896 NtAllocateVirtualMemory (-1, 8716288, 0, 4096, 4096, 4, ... 02014 784 NtTestAlert (... 02012 1736 NtAllocateVirtualMemory ... 72089600, 1048576, ) == 0x0 02013 896 NtAllocateVirtualMemory ... 8716288, 4096, ) == 0x0 02014 784 NtTestAlert ... ) == 0x0 02015 1736 NtAllocateVirtualMemory (-1, 73129984, 0, 8192, 4096, 4, ... 02016 896 NtAllocateVirtualMemory (-1, 8720384, 0, 8192, 4096, 4, ... 02017 784 NtContinue (72088880, 1, ... 02015 1736 NtAllocateVirtualMemory ... 73129984, 8192, ) == 0x0 02016 896 NtAllocateVirtualMemory ... 8720384, 8192, ) == 0x0 02018 784 NtRegisterThreadTerminatePort (24, ... 02008 1104 NtWaitForSingleObject ... ) == 0x102 02019 896 NtAllocateVirtualMemory (-1, 1404928, 0, 4096, 4096, 4, ... 02018 784 NtRegisterThreadTerminatePort ... ) == 0x0 02020 1104 NtWaitForSingleObject (284, 0, 0x0, ... 02019 896 NtAllocateVirtualMemory ... 1404928, 4096, ) == 0x0 02021 1736 NtProtectVirtualMemory (-1, (0x45be000), 4096, 260, ... 02022 784 NtWaitForSingleObject (284, 0, 0x0, ... 02021 1736 NtProtectVirtualMemory ... (0x45be000), 4096, 4, ) == 0x0 02023 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1636, 1792}, ) == 0x0 02024 1736 NtQueryInformationThread (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1636,Tid=1792,}, 0x0, ) == 0x0 02025 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75569, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75569, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\0\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75570, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\0\7\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75570, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75569, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\0\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75570, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\0\7\0\0" ) ) == 0x0 02026 1736 NtResumeThread (636, ... 1, ) == 0x0 02027 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02028 896 NtSetEventBoostPriority (284, ... 02029 1792 NtWaitForSingleObject (284, 0, 0x0, ... 02020 1104 NtWaitForSingleObject ... ) == 0x0 02028 896 NtSetEventBoostPriority ... ) == 0x0 02030 1104 NtSetEventBoostPriority (284, ... 02022 784 NtWaitForSingleObject ... ) == 0x0 02031 784 NtSetEventBoostPriority (284, ... 02029 1792 NtWaitForSingleObject ... ) == 0x0 02032 1792 NtTestAlert (... ) == 0x0 02031 784 NtSetEventBoostPriority ... ) == 0x0 02030 1104 NtSetEventBoostPriority ... ) == 0x0 02033 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15461328, ... }, 15461328, ... 02027 1736 NtAllocateVirtualMemory ... 73138176, 1048576, ) == 0x0 02034 784 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02035 1792 NtContinue (73137456, 1, ... 02033 896 NtQueryAttributesFile ... ) == 0x0 02036 1736 NtAllocateVirtualMemory (-1, 74178560, 0, 8192, 4096, 4, ... 02037 1104 NtWaitForSingleObject (128, 0, 0x0, ... 02038 1792 NtRegisterThreadTerminatePort (24, ... 02039 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... }, 5, 96, ... 02036 1736 NtAllocateVirtualMemory ... 74178560, 8192, ) == 0x0 02038 1792 NtRegisterThreadTerminatePort ... ) == 0x0 02039 896 NtOpenFile ... 640, {status=0x0, info=1}, ) == 0x0 02040 1736 NtProtectVirtualMemory (-1, (0x46be000), 4096, 260, ... 02041 1792 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02034 784 NtDuplicateObject ... 644, ) == 0x0 02040 1736 NtProtectVirtualMemory ... (0x46be000), 4096, 4, ) == 0x0 02041 1792 NtDuplicateObject ... 648, ) == 0x0 02042 784 NtWaitForSingleObject (64, 0, {0, 0}, ... 02043 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02044 1792 NtWaitForSingleObject (64, 0, {0, 0}, ... 02042 784 NtWaitForSingleObject ... ) == 0x102 02045 896 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 640, ... 02043 1736 NtCreateThread ... 652, {1636, 192}, ) == 0x0 02046 784 NtWaitForSingleObject (128, 0, 0x0, ... 02045 896 NtCreateSection ... 656, ) == 0x0 02047 1736 NtQueryInformationThread (652, Basic, 28, ... 02048 896 NtClose (640, ... 02047 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1636,Tid=192,}, 0x0, ) == 0x0 02048 896 NtClose ... ) == 0x0 02049 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75570, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75570, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0d\6\0\0\300\0\0\0" ... ... 02050 896 NtMapViewOfSection (656, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... 02049 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75571, 0} ... {28, 56, reply, 0, 1636, 1736, 75571, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0d\6\0\0\300\0\0\0" ) ) == 0x0 02050 896 NtMapViewOfSection ... (0xb80000), 0x0, 110592, ) == 0x0 02044 1792 NtWaitForSingleObject ... ) == 0x102 02051 1736 NtResumeThread (652, ... 02052 1792 NtWaitForSingleObject (128, 0, 0x0, ... 02051 1736 NtResumeThread ... 1, ) == 0x0 02053 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 74186752, 1048576, ) == 0x0 02054 1736 NtAllocateVirtualMemory (-1, 75227136, 0, 8192, 4096, 4, ... 75227136, 8192, ) == 0x0 02055 1736 NtProtectVirtualMemory (-1, (0x47be000), 4096, 260, ... (0x47be000), 4096, 4, ) == 0x0 02056 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1636, 1484}, ) == 0x0 02057 1736 NtQueryInformationThread (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1636,Tid=1484,}, 0x0, ) == 0x0 02058 896 NtClose (656, ... 02059 192 NtWaitForSingleObject (92, 0, 0x0, ... 02058 896 NtClose ... ) == 0x0 02060 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75571, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75571, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0d\6\0\0\314\5\0\0" ... ... 02061 896 NtUnmapViewOfSection (-1, 0xb80000, ... ) == 0x0 02062 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15461636, ... ) }, 15461636, ... ) == 0x0 02063 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 656, {status=0x0, info=1}, ) }, 5, 96, ... 656, {status=0x0, info=1}, ) == 0x0 02064 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 656, ... 660, ) == 0x0 02060 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75572, 0} ... {28, 56, reply, 0, 1636, 1736, 75572, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0d\6\0\0\314\5\0\0" ) ) == 0x0 02065 1736 NtResumeThread (640, ... 1, ) == 0x0 02066 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 75235328, 1048576, ) == 0x0 02067 1736 NtAllocateVirtualMemory (-1, 76275712, 0, 8192, 4096, 4, ... 76275712, 8192, ) == 0x0 02068 1736 NtProtectVirtualMemory (-1, (0x48be000), 4096, 260, ... (0x48be000), 4096, 4, ) == 0x0 02069 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02070 896 NtQuerySection (660, Image, 48, ... 02071 1484 NtWaitForSingleObject (92, 0, 0x0, ... 02070 896 NtQuerySection ... {section info, class 1, size 48}, 0x0, ) == 0x0 02072 896 NtClose (656, ... ) == 0x0 02073 896 NtMapViewOfSection (660, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x751d0000), 0x0, 122880, ) == 0x0 02074 896 NtClose (660, ... ) == 0x0 02075 896 NtProtectVirtualMemory (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0 02069 1736 NtCreateThread ... 660, {1636, 1120}, ) == 0x0 02076 1736 NtQueryInformationThread (660, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1636,Tid=1120,}, 0x0, ) == 0x0 02077 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75572, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75572, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0d\6\0\0`\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75573, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0d\6\0\0`\4\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75573, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75572, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0d\6\0\0`\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75573, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0d\6\0\0`\4\0\0" ) ) == 0x0 02078 896 NtProtectVirtualMemory (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0 02079 896 NtFlushInstructionCache (-1, 1964838912, 224, ... ) == 0x0 02080 896 NtProtectVirtualMemory (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0 02081 896 NtProtectVirtualMemory (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0 02082 896 NtFlushInstructionCache (-1, 1964838912, 224, ... ) == 0x0 02083 896 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02084 1736 NtResumeThread (660, ... 1, ) == 0x0 02085 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 76283904, 1048576, ) == 0x0 02086 1736 NtAllocateVirtualMemory (-1, 77324288, 0, 8192, 4096, 4, ... 77324288, 8192, ) == 0x0 02087 1736 NtProtectVirtualMemory (-1, (0x49be000), 4096, 260, ... (0x49be000), 4096, 4, ) == 0x0 02088 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1636, 520}, ) == 0x0 02089 1736 NtQueryInformationThread (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1636,Tid=520,}, 0x0, ) == 0x0 02090 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 15460812, ... }, 15460812, ... 02091 1120 NtWaitForSingleObject (92, 0, 0x0, ... 02092 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75573, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75573, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0d\6\0\0\10\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0d\6\0\0\10\2\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75574, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75573, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0d\6\0\0\10\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0d\6\0\0\10\2\0\0" ) ) == 0x0 02093 1736 NtResumeThread (656, ... 1, ) == 0x0 02094 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02095 520 NtWaitForSingleObject (92, 0, 0x0, ... 02094 1736 NtAllocateVirtualMemory ... 77332480, 1048576, ) == 0x0 02096 1736 NtAllocateVirtualMemory (-1, 78372864, 0, 8192, 4096, 4, ... 78372864, 8192, ) == 0x0 02097 1736 NtProtectVirtualMemory (-1, (0x4abe000), 4096, 260, ... (0x4abe000), 4096, 4, ) == 0x0 02098 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1636, 1612}, ) == 0x0 02099 1736 NtQueryInformationThread (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1636,Tid=1612,}, 0x0, ) == 0x0 02100 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75574, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0d\6\0\0L\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0d\6\0\0L\6\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75575, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0d\6\0\0L\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0d\6\0\0L\6\0\0" ) ) == 0x0 02101 1736 NtResumeThread (664, ... 1, ) == 0x0 02102 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 78381056, 1048576, ) == 0x0 02103 1736 NtAllocateVirtualMemory (-1, 79421440, 0, 8192, 4096, 4, ... 79421440, 8192, ) == 0x0 02090 896 NtQueryAttributesFile ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02104 1612 NtWaitForSingleObject (92, 0, 0x0, ... 02105 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 15460812, ... }, 15460812, ... 02106 1736 NtProtectVirtualMemory (-1, (0x4bbe000), 4096, 260, ... (0x4bbe000), 4096, 4, ) == 0x0 02107 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1636, 876}, ) == 0x0 02108 1736 NtQueryInformationThread (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1636,Tid=876,}, 0x0, ) == 0x0 02109 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75575, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0d\6\0\0l\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75576, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0d\6\0\0l\3\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75576, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0d\6\0\0l\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75576, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0d\6\0\0l\3\0\0" ) ) == 0x0 02110 1736 NtResumeThread (668, ... 1, ) == 0x0 02111 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02105 896 NtQueryAttributesFile ... ) == 0x0 02112 876 NtWaitForSingleObject (92, 0, 0x0, ... 02113 896 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 672, {status=0x0, info=1}, ) }, 5, 96, ... 672, {status=0x0, info=1}, ) == 0x0 02114 896 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 672, ... 676, ) == 0x0 02115 896 NtQuerySection (676, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02116 896 NtClose (672, ... ) == 0x0 02117 896 NtMapViewOfSection (676, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0 02118 896 NtClose (676, ... 02111 1736 NtAllocateVirtualMemory ... 79429632, 1048576, ) == 0x0 02119 1736 NtAllocateVirtualMemory (-1, 80470016, 0, 8192, 4096, 4, ... 80470016, 8192, ) == 0x0 02120 1736 NtProtectVirtualMemory (-1, (0x4cbe000), 4096, 260, ... (0x4cbe000), 4096, 4, ) == 0x0 02121 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 672, {1636, 1628}, ) == 0x0 02122 1736 NtQueryInformationThread (672, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1636,Tid=1628,}, 0x0, ) == 0x0 02123 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75576, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75576, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0d\6\0\0\\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75577, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0d\6\0\0\\6\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75577, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75576, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0d\6\0\0\\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75577, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0d\6\0\0\\6\0\0" ) ) == 0x0 02118 896 NtClose ... ) == 0x0 02124 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 02125 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 02126 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 02127 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 02128 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 02129 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... 02130 1736 NtResumeThread (672, ... 1, ) == 0x0 02131 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 80478208, 1048576, ) == 0x0 02132 1736 NtAllocateVirtualMemory (-1, 81518592, 0, 8192, 4096, 4, ... 81518592, 8192, ) == 0x0 02133 1736 NtProtectVirtualMemory (-1, (0x4dbe000), 4096, 260, ... (0x4dbe000), 4096, 4, ) == 0x0 02134 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1636, 940}, ) == 0x0 02135 1736 NtQueryInformationThread (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1636,Tid=940,}, 0x0, ) == 0x0 02129 896 NtFlushInstructionCache ... ) == 0x0 02136 1628 NtWaitForSingleObject (92, 0, 0x0, ... 02137 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 02138 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 02139 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 02140 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 02141 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 02142 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... 02143 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75577, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75577, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\254\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75578, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\254\3\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75578, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75577, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\254\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75578, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\254\3\0\0" ) ) == 0x0 02144 1736 NtResumeThread (676, ... 1, ) == 0x0 02145 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 81526784, 1048576, ) == 0x0 02146 1736 NtAllocateVirtualMemory (-1, 82567168, 0, 8192, 4096, 4, ... 82567168, 8192, ) == 0x0 02147 1736 NtProtectVirtualMemory (-1, (0x4ebe000), 4096, 260, ... (0x4ebe000), 4096, 4, ) == 0x0 02148 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02142 896 NtFlushInstructionCache ... ) == 0x0 02149 940 NtWaitForSingleObject (92, 0, 0x0, ... 02150 896 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 02151 896 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 02152 896 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 02153 896 NtProtectVirtualMemory (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0 02154 896 NtProtectVirtualMemory (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0 02155 896 NtFlushInstructionCache (-1, 1964838912, 224, ... 02148 1736 NtCreateThread ... 680, {1636, 1316}, ) == 0x0 02156 1736 NtQueryInformationThread (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1636,Tid=1316,}, 0x0, ) == 0x0 02157 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75578, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75578, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0$\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75579, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0$\5\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75579, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75578, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0$\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75579, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0$\5\0\0" ) ) == 0x0 02158 1736 NtResumeThread (680, ... 1, ) == 0x0 02159 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 82575360, 1048576, ) == 0x0 02160 1736 NtAllocateVirtualMemory (-1, 83615744, 0, 8192, 4096, 4, ... 83615744, 8192, ) == 0x0 02155 896 NtFlushInstructionCache ... ) == 0x0 02161 1316 NtWaitForSingleObject (92, 0, 0x0, ... 02162 1736 NtProtectVirtualMemory (-1, (0x4fbe000), 4096, 260, ... (0x4fbe000), 4096, 4, ) == 0x0 02163 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02164 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02165 896 NtQueryDefaultUILanguage (2090319928, ... 02166 896 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02167 896 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482564, ) == 0x0 02168 896 NtQueryInformationToken (-2147482564, User, 80, ... 02163 1736 NtCreateThread ... 684, {1636, 1924}, ) == 0x0 02169 1736 NtQueryInformationThread (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1636,Tid=1924,}, 0x0, ) == 0x0 02170 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75579, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75579, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\204\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75580, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\204\7\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75580, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75579, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\204\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75580, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\204\7\0\0" ) ) == 0x0 02171 1736 NtResumeThread (684, ... 1, ) == 0x0 02172 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02168 896 NtQueryInformationToken ... {token info, class 1, size 36}, 36, ) == 0x0 02173 1924 NtWaitForSingleObject (92, 0, 0x0, ... 02174 896 NtClose (-2147482564, ... ) == 0x0 02175 896 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482564, ) }, ... -2147482564, ) == 0x0 02176 896 NtOpenKey (0x80000000, {24, -2147482564, 0x240, 0, 0, (0x80000000, {24, -2147482564, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02177 896 NtOpenKey (0x80000000, {24, -2147482564, 0x640, 0, 0, (0x80000000, {24, -2147482564, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481440, ) }, ... -2147481440, ) == 0x0 02178 896 NtQueryValueKey (-2147481440, (-2147481440, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02179 896 NtClose (-2147481440, ... 02172 1736 NtAllocateVirtualMemory ... 83623936, 1048576, ) == 0x0 02180 1736 NtAllocateVirtualMemory (-1, 84664320, 0, 8192, 4096, 4, ... 84664320, 8192, ) == 0x0 02181 1736 NtProtectVirtualMemory (-1, (0x50be000), 4096, 260, ... (0x50be000), 4096, 4, ) == 0x0 02182 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1636, 644}, ) == 0x0 02183 1736 NtQueryInformationThread (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1636,Tid=644,}, 0x0, ) == 0x0 02184 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75580, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75580, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0d\6\0\0\204\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75581, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0d\6\0\0\204\2\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75581, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75580, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0d\6\0\0\204\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75581, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0d\6\0\0\204\2\0\0" ) ) == 0x0 02179 896 NtClose ... ) == 0x0 02185 896 NtClose (-2147482564, ... ) == 0x0 02165 896 NtQueryDefaultUILanguage ... ) == 0x0 02186 896 NtAllocateVirtualMemory (-1, 15450112, 0, 4096, 4096, 260, ... 15450112, 4096, ) == 0x0 02187 896 NtQueryInstallUILanguage (2090319930, ... ) == 0x0 02188 896 NtQueryDefaultLocale (1, 15461532, ... ) == 0x0 02189 896 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 02190 1736 NtResumeThread (688, ... 1, ) == 0x0 02191 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 84672512, 1048576, ) == 0x0 02192 1736 NtAllocateVirtualMemory (-1, 85712896, 0, 8192, 4096, 4, ... 85712896, 8192, ) == 0x0 02193 1736 NtProtectVirtualMemory (-1, (0x51be000), 4096, 260, ... (0x51be000), 4096, 4, ) == 0x0 02194 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1636, 1288}, ) == 0x0 02195 1736 NtQueryInformationThread (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1636,Tid=1288,}, 0x0, ) == 0x0 02196 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\Setup"}, ... }, ... 02197 644 NtWaitForSingleObject (92, 0, 0x0, ... 02196 896 NtOpenKey ... 696, ) == 0x0 02198 896 NtQueryValueKey (696, (696, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (696, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02199 896 NtClose (696, ... ) == 0x0 02200 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 696, ) == 0x0 02201 896 NtCallbackReturn (0, 0, 0, ... 02202 896 NtUserGetProcessWindowStation (... ) == 0x20 02203 896 NtUserGetObjectInformation (32, 1, 15461128, 12, 15461140, ... 02204 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75581, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75581, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0d\6\0\0\10\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0d\6\0\0\10\5\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75582, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75581, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0d\6\0\0\10\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0d\6\0\0\10\5\0\0" ) ) == 0x0 02205 1736 NtResumeThread (692, ... 1, ) == 0x0 02206 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 85721088, 1048576, ) == 0x0 02207 1736 NtAllocateVirtualMemory (-1, 86761472, 0, 8192, 4096, 4, ... 86761472, 8192, ) == 0x0 02208 1736 NtProtectVirtualMemory (-1, (0x52be000), 4096, 260, ... (0x52be000), 4096, 4, ) == 0x0 02209 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02203 896 NtUserGetObjectInformation ... ) == 0x1 02210 1288 NtWaitForSingleObject (92, 0, 0x0, ... 02211 896 NtOpenKey (0xf003f, {24, 28, 0x40, 0, 0, (0xf003f, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02212 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\WPA\PnP"}, ... 700, ) }, ... 700, ) == 0x0 02213 896 NtQueryValueKey (700, (700, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (700, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0 02214 896 NtClose (700, ... ) == 0x0 02215 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 700, ) }, ... 700, ) == 0x0 02216 896 NtQueryValueKey (700, (700, "OsLoaderPath", Partial, 144, ... , Partial, 144, ... 02209 1736 NtCreateThread ... 704, {1636, 752}, ) == 0x0 02217 1736 NtQueryInformationThread (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1636,Tid=752,}, 0x0, ) == 0x0 02218 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75582, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0d\6\0\0\360\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0d\6\0\0\360\2\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75583, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0d\6\0\0\360\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0d\6\0\0\360\2\0\0" ) ) == 0x0 02219 1736 NtResumeThread (704, ... 1, ) == 0x0 02220 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 86769664, 1048576, ) == 0x0 02221 1736 NtAllocateVirtualMemory (-1, 87810048, 0, 8192, 4096, 4, ... 87810048, 8192, ) == 0x0 02216 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 02222 752 NtWaitForSingleObject (92, 0, 0x0, ... 02223 896 NtQueryValueKey (700, (700, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 02224 896 NtClose (700, ... ) == 0x0 02225 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 700, ) }, ... 700, ) == 0x0 02226 896 NtQueryValueKey (700, (700, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 02227 896 NtQueryValueKey (700, (700, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 02228 896 NtClose (700, ... 02229 1736 NtProtectVirtualMemory (-1, (0x53be000), 4096, 260, ... (0x53be000), 4096, 4, ) == 0x0 02230 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 708, {1636, 624}, ) == 0x0 02231 1736 NtQueryInformationThread (708, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1636,Tid=624,}, 0x0, ) == 0x0 02232 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75583, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0d\6\0\0p\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75584, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0d\6\0\0p\2\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75584, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0d\6\0\0p\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75584, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0d\6\0\0p\2\0\0" ) ) == 0x0 02233 1736 NtResumeThread (708, ... 1, ) == 0x0 02234 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02228 896 NtClose ... ) == 0x0 02235 624 NtWaitForSingleObject (92, 0, 0x0, ... 02236 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 700, ) }, ... 700, ) == 0x0 02237 896 NtQueryValueKey (700, (700, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02238 896 NtQueryValueKey (700, (700, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02239 896 NtClose (700, ... ) == 0x0 02240 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 700, ) }, ... 700, ) == 0x0 02241 896 NtQueryValueKey (700, (700, "ServicePackSourcePath", Partial, 144, ... , Partial, 144, ... 02234 1736 NtAllocateVirtualMemory ... 87818240, 1048576, ) == 0x0 02242 1736 NtAllocateVirtualMemory (-1, 88858624, 0, 8192, 4096, 4, ... 88858624, 8192, ) == 0x0 02243 1736 NtProtectVirtualMemory (-1, (0x54be000), 4096, 260, ... (0x54be000), 4096, 4, ) == 0x0 02244 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 712, {1636, 380}, ) == 0x0 02245 1736 NtQueryInformationThread (712, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1636,Tid=380,}, 0x0, ) == 0x0 02246 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75584, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75584, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0d\6\0\0|\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75585, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0d\6\0\0|\1\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75585, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75584, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0d\6\0\0|\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75585, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0d\6\0\0|\1\0\0" ) ) == 0x0 02241 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02247 896 NtQueryValueKey (700, (700, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02248 896 NtClose (700, ... ) == 0x0 02249 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 700, ) }, ... 700, ) == 0x0 02250 896 NtQueryValueKey (700, (700, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0 02251 896 NtQueryValueKey (700, (700, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (700, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0 02252 896 NtClose (700, ... 02253 1736 NtResumeThread (712, ... 1, ) == 0x0 02254 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 88866816, 1048576, ) == 0x0 02255 1736 NtAllocateVirtualMemory (-1, 89907200, 0, 8192, 4096, 4, ... 89907200, 8192, ) == 0x0 02256 1736 NtProtectVirtualMemory (-1, (0x55be000), 4096, 260, ... (0x55be000), 4096, 4, ) == 0x0 02257 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 716, {1636, 776}, ) == 0x0 02258 1736 NtQueryInformationThread (716, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1636,Tid=776,}, 0x0, ) == 0x0 02252 896 NtClose ... ) == 0x0 02259 380 NtWaitForSingleObject (92, 0, 0x0, ... 02260 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 700, ) }, ... 700, ) == 0x0 02261 896 NtQueryValueKey (700, (700, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (700, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 02262 896 NtQueryValueKey (700, (700, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (700, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 02263 896 NtClose (700, ... ) == 0x0 02264 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 700, ) }, ... 700, ) == 0x0 02265 896 NtQueryValueKey (700, (700, "DevicePath", Partial, 144, ... , Partial, 144, ... 02266 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75585, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75585, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0d\6\0\0\10\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75586, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0d\6\0\0\10\3\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75586, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75585, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0d\6\0\0\10\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75586, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0d\6\0\0\10\3\0\0" ) ) == 0x0 02267 1736 NtResumeThread (716, ... 1, ) == 0x0 02268 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 89915392, 1048576, ) == 0x0 02269 1736 NtAllocateVirtualMemory (-1, 90955776, 0, 8192, 4096, 4, ... 90955776, 8192, ) == 0x0 02270 1736 NtProtectVirtualMemory (-1, (0x56be000), 4096, 260, ... (0x56be000), 4096, 4, ) == 0x0 02271 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02265 896 NtQueryValueKey ... ) == STATUS_BUFFER_OVERFLOW 02272 776 NtWaitForSingleObject (92, 0, 0x0, ... 02273 896 NtQueryValueKey (700, (700, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (700, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0 02274 896 NtAllocateVirtualMemory (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0 02275 896 NtClose (700, ... ) == 0x0 02276 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 700, ) == 0x0 02277 896 NtCreateMutant (0x1f0001, 0x0, 0, ... 720, ) == 0x0 02278 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02271 1736 NtCreateThread ... 724, {1636, 312}, ) == 0x0 02279 1736 NtQueryInformationThread (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1636,Tid=312,}, 0x0, ) == 0x0 02280 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75586, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75586, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0d\6\0\08\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75587, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0d\6\0\08\1\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75587, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75586, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0d\6\0\08\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75587, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0d\6\0\08\1\0\0" ) ) == 0x0 02281 1736 NtResumeThread (724, ... 1, ) == 0x0 02282 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 90963968, 1048576, ) == 0x0 02283 1736 NtAllocateVirtualMemory (-1, 92004352, 0, 8192, 4096, 4, ... 92004352, 8192, ) == 0x0 02278 896 NtCreateEvent ... 728, ) == 0x0 02284 312 NtWaitForSingleObject (92, 0, 0x0, ... 02285 896 NtCreateMutant (0x1f0001, 0x0, 0, ... 732, ) == 0x0 02286 896 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 736, ) == 0x0 02287 896 NtCreateMutant (0x1f0001, 0x0, 0, ... 740, ) == 0x0 02288 896 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 744, ) }, ... 744, ) == 0x0 02289 896 NtQueryValueKey (744, (744, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (744, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02290 896 NtQueryValueKey (744, (744, "LogLevel", Partial, 144, ... , Partial, 144, ... 02291 1736 NtProtectVirtualMemory (-1, (0x57be000), 4096, 260, ... (0x57be000), 4096, 4, ) == 0x0 02292 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 748, {1636, 1124}, ) == 0x0 02293 1736 NtQueryInformationThread (748, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1636,Tid=1124,}, 0x0, ) == 0x0 02294 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75587, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75587, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0d\6\0\0d\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75588, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0d\6\0\0d\4\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75588, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75587, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0d\6\0\0d\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75588, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0d\6\0\0d\4\0\0" ) ) == 0x0 02295 1736 NtResumeThread (748, ... 1, ) == 0x0 02296 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02290 896 NtQueryValueKey ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02297 1124 NtWaitForSingleObject (92, 0, 0x0, ... 02298 896 NtQueryValueKey (744, (744, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02299 896 NtOpenKey (0x1, {24, 744, 0x40, 0, 0, (0x1, {24, 744, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02300 896 NtClose (744, ... ) == 0x0 02301 896 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 15461044, ... ) }, 15461044, ... ) == 0x0 02302 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 744, ) }, ... 744, ) == 0x0 02303 896 NtQueryValueKey (744, (744, "ComputerName", Full, 128, ... , Full, 128, ... 02296 1736 NtAllocateVirtualMemory ... 92012544, 1048576, ) == 0x0 02304 1736 NtAllocateVirtualMemory (-1, 93052928, 0, 8192, 4096, 4, ... 93052928, 8192, ) == 0x0 02305 1736 NtProtectVirtualMemory (-1, (0x58be000), 4096, 260, ... (0x58be000), 4096, 4, ) == 0x0 02306 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 752, {1636, 1404}, ) == 0x0 02307 1736 NtQueryInformationThread (752, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1636,Tid=1404,}, 0x0, ) == 0x0 02308 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75588, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75588, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0d\6\0\0|\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75589, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0d\6\0\0|\5\0\0" ) ... {28, 56, reply, 0, 1636, 1736, 75589, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75588, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0d\6\0\0|\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75589, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0d\6\0\0|\5\0\0" ) ) == 0x0 02303 896 NtQueryValueKey ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 02309 896 NtClose (744, ... ) == 0x0 02310 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 744, ) }, ... 744, ) == 0x0 02311 896 NtQueryValueKey (744, (744, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (744, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (744, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0 02312 896 NtClose (744, ... ) == 0x0 02313 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02314 896 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ... 02315 1736 NtResumeThread (752, ... 1, ) == 0x0 02316 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 93061120, 1048576, ) == 0x0 02317 1736 NtAllocateVirtualMemory (-1, 94101504, 0, 8192, 4096, 4, ... 94101504, 8192, ) == 0x0 02318 1736 NtProtectVirtualMemory (-1, (0x59be000), 4096, 260, ... (0x59be000), 4096, 4, ) == 0x0 02319 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 744, {1636, 476}, ) == 0x0 02320 1736 NtQueryInformationThread (744, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1636,Tid=476,}, 0x0, ) == 0x0 02314 896 NtOpenKey ... 756, ) == 0x0 02321 1404 NtWaitForSingleObject (92, 0, 0x0, ... 02322 896 NtQueryValueKey (756, (756, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (756, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (756, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0 02323 896 NtClose (756, ... ) == 0x0 02324 896 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02325 896 NtSetEventBoostPriority (92, ... 02059 192 NtWaitForSingleObject ... ) == 0x0 02326 192 NtSetEventBoostPriority (92, ... 02071 1484 NtWaitForSingleObject ... ) == 0x0 02327 1484 NtSetEventBoostPriority (92, ... 02091 1120 NtWaitForSingleObject ... ) == 0x0 02328 1120 NtSetEventBoostPriority (92, ... 02095 520 NtWaitForSingleObject ... ) == 0x0 02329 520 NtSetEventBoostPriority (92, ... 02104 1612 NtWaitForSingleObject ... ) == 0x0 02330 1612 NtSetEventBoostPriority (92, ... 02112 876 NtWaitForSingleObject ... ) == 0x0 02331 876 NtSetEventBoostPriority (92, ... 02136 1628 NtWaitForSingleObject ... ) == 0x0 02332 1628 NtSetEventBoostPriority (92, ... 02149 940 NtWaitForSingleObject ... ) == 0x0 02333 940 NtSetEventBoostPriority (92, ... 02161 1316 NtWaitForSingleObject ... ) == 0x0 02334 1316 NtSetEventBoostPriority (92, ... 02173 1924 NtWaitForSingleObject ... ) == 0x0 02335 1924 NtSetEventBoostPriority (92, ... 02197 644 NtWaitForSingleObject ... ) == 0x0 02336 644 NtSetEventBoostPriority (92, ... 02210 1288 NtWaitForSingleObject ... ) == 0x0 02337 1288 NtSetEventBoostPriority (92, ... 02222 752 NtWaitForSingleObject ... ) == 0x0 02338 752 NtSetEventBoostPriority (92, ... 02235 624 NtWaitForSingleObject ... ) == 0x0 02339 624 NtSetEventBoostPriority (92, ... 02259 380 NtWaitForSingleObject ... ) == 0x0 02340 380 NtSetEventBoostPriority (92, ... 02272 776 NtWaitForSingleObject ... ) == 0x0 02341 776 NtSetEventBoostPriority (92, ... 02284 312 NtWaitForSingleObject ... ) == 0x0 02342 312 NtSetEventBoostPriority (92, ... 02297 1124 NtWaitForSingleObject ... ) == 0x0 02343 1124 NtSetEventBoostPriority (92, ... 02321 1404 NtWaitForSingleObject ... ) == 0x0 02344 1404 NtAllocateVirtualMemory (-1, 8810496, 0, 4096, 4096, 4, ... 8810496, 4096, ) == 0x0 02343 1124 NtSetEventBoostPriority ... ) == 0x0 02342 312 NtSetEventBoostPriority ... ) == 0x0 02341 776 NtSetEventBoostPriority ... ) == 0x0 02340 380 NtSetEventBoostPriority ... ) == 0x0 02339 624 NtSetEventBoostPriority ... ) == 0x0 02338 752 NtSetEventBoostPriority ... ) == 0x0 02337 1288 NtSetEventBoostPriority ... ) == 0x0 02336 644 NtSetEventBoostPriority ... ) == 0x0 02335 1924 NtSetEventBoostPriority ... ) == 0x0 02334 1316 NtSetEventBoostPriority ... ) == 0x0 02333 940 NtSetEventBoostPriority ... ) == 0x0 02332 1628 NtSetEventBoostPriority ... ) == 0x0 02331 876 NtSetEventBoostPriority ... ) == 0x0 02330 1612 NtSetEventBoostPriority ... ) == 0x0 02329 520 NtSetEventBoostPriority ... ) == 0x0 02328 1120 NtSetEventBoostPriority ... ) == 0x0 02327 1484 NtSetEventBoostPriority ... ) == 0x0 02326 192 NtSetEventBoostPriority ... ) == 0x0 02325 896 NtSetEventBoostPriority ... ) == 0x0 02345 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75589, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75589, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0d\6\0\0\334\1\0\0" ... ... 02346 1404 NtTestAlert (... 02347 1124 NtTestAlert (... 02348 312 NtTestAlert (... 02349 776 NtTestAlert (... 02350 380 NtTestAlert (... 02351 624 NtTestAlert (... 02352 752 NtTestAlert (... 02353 1288 NtTestAlert (... 02354 644 NtTestAlert (... 02355 1924 NtTestAlert (... 02356 1316 NtTestAlert (... 02357 940 NtTestAlert (... 02358 1628 NtTestAlert (... 02359 876 NtTestAlert (... 02360 1612 NtTestAlert (... 02361 520 NtTestAlert (... 02362 1120 NtTestAlert (... 02363 1484 NtTestAlert (... 02364 896 NtSetEventBoostPriority (128, ... 02345 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75590, 0} ... {28, 56, reply, 0, 1636, 1736, 75590, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0d\6\0\0\334\1\0\0" ) ) == 0x0 02346 1404 NtTestAlert ... ) == 0x0 02347 1124 NtTestAlert ... ) == 0x0 02348 312 NtTestAlert ... ) == 0x0 02349 776 NtTestAlert ... ) == 0x0 02350 380 NtTestAlert ... ) == 0x0 02351 624 NtTestAlert ... ) == 0x0 02352 752 NtTestAlert ... ) == 0x0 02353 1288 NtTestAlert ... ) == 0x0 02354 644 NtTestAlert ... ) == 0x0 02355 1924 NtTestAlert ... ) == 0x0 02356 1316 NtTestAlert ... ) == 0x0 02357 940 NtTestAlert ... ) == 0x0 02358 1628 NtTestAlert ... ) == 0x0 02359 876 NtTestAlert ... ) == 0x0 02360 1612 NtTestAlert ... ) == 0x0 02361 520 NtTestAlert ... ) == 0x0 02362 1120 NtTestAlert ... ) == 0x0 02363 1484 NtTestAlert ... ) == 0x0 00670 2020 NtWaitForSingleObject ... ) == 0x0 02364 896 NtSetEventBoostPriority ... ) == 0x0 02365 1736 NtResumeThread (744, ... 02366 1404 NtContinue (93060400, 1, ... 02367 1124 NtContinue (92011824, 1, ... 02368 312 NtContinue (90963248, 1, ... 02369 776 NtContinue (89914672, 1, ... 02370 380 NtContinue (88866096, 1, ... 02371 624 NtContinue (87817520, 1, ... 02372 752 NtContinue (86768944, 1, ... 02373 1288 NtContinue (85720368, 1, ... 02374 644 NtContinue (84671792, 1, ... 02375 1924 NtContinue (83623216, 1, ... 02376 1316 NtContinue (82574640, 1, ... 02377 940 NtContinue (81526064, 1, ... 02378 1628 NtContinue (80477488, 1, ... 02379 876 NtContinue (79428912, 1, ... 02380 1612 NtContinue (78380336, 1, ... 02381 520 NtContinue (77331760, 1, ... 02382 1120 NtContinue (76283184, 1, ... 02383 2020 NtSetEventBoostPriority (128, ... 02384 1484 NtContinue (75234608, 1, ... 02385 896 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 02365 1736 NtResumeThread ... 1, ) == 0x0 02386 1404 NtRegisterThreadTerminatePort (24, ... 02387 1124 NtRegisterThreadTerminatePort (24, ... 02388 312 NtRegisterThreadTerminatePort (24, ... 02389 776 NtRegisterThreadTerminatePort (24, ... 02390 380 NtRegisterThreadTerminatePort (24, ... 02391 624 NtRegisterThreadTerminatePort (24, ... 02392 752 NtRegisterThreadTerminatePort (24, ... 02393 1288 NtRegisterThreadTerminatePort (24, ... 02394 644 NtRegisterThreadTerminatePort (24, ... 02395 1924 NtRegisterThreadTerminatePort (24, ... 02396 1316 NtRegisterThreadTerminatePort (24, ... 02397 940 NtRegisterThreadTerminatePort (24, ... 02398 1628 NtRegisterThreadTerminatePort (24, ... 02399 876 NtRegisterThreadTerminatePort (24, ... 02400 1612 NtRegisterThreadTerminatePort (24, ... 02401 520 NtRegisterThreadTerminatePort (24, ... 00672 808 NtWaitForSingleObject ... ) == 0x0 02383 2020 NtSetEventBoostPriority ... ) == 0x0 02402 1120 NtRegisterThreadTerminatePort (24, ... 02403 1484 NtRegisterThreadTerminatePort (24, ... 02404 192 NtTestAlert (... 02405 476 NtTestAlert (... 02406 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02386 1404 NtRegisterThreadTerminatePort ... ) == 0x0 02387 1124 NtRegisterThreadTerminatePort ... ) == 0x0 02388 312 NtRegisterThreadTerminatePort ... ) == 0x0 02389 776 NtRegisterThreadTerminatePort ... ) == 0x0 02390 380 NtRegisterThreadTerminatePort ... ) == 0x0 02391 624 NtRegisterThreadTerminatePort ... ) == 0x0 02392 752 NtRegisterThreadTerminatePort ... ) == 0x0 02393 1288 NtRegisterThreadTerminatePort ... ) == 0x0 02394 644 NtRegisterThreadTerminatePort ... ) == 0x0 02395 1924 NtRegisterThreadTerminatePort ... ) == 0x0 02396 1316 NtRegisterThreadTerminatePort ... ) == 0x0 02397 940 NtRegisterThreadTerminatePort ... ) == 0x0 02398 1628 NtRegisterThreadTerminatePort ... ) == 0x0 02399 876 NtRegisterThreadTerminatePort ... ) == 0x0 02400 1612 NtRegisterThreadTerminatePort ... ) == 0x0 02407 808 NtSetEventBoostPriority (128, ... 02401 520 NtRegisterThreadTerminatePort ... ) == 0x0 02408 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02402 1120 NtRegisterThreadTerminatePort ... ) == 0x0 02403 1484 NtRegisterThreadTerminatePort ... ) == 0x0 02404 192 NtTestAlert ... ) == 0x0 02405 476 NtTestAlert ... ) == 0x0 02385 896 NtCreateEvent ... 756, ) == 0x0 02409 1404 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02410 1124 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02411 312 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02412 776 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02413 380 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02414 624 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02415 752 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02416 1288 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02417 644 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02418 1924 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02419 1316 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02420 940 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02421 1628 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02422 876 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 00673 868 NtWaitForSingleObject ... ) == 0x0 02407 808 NtSetEventBoostPriority ... ) == 0x0 02423 1612 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02424 520 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02406 1736 NtAllocateVirtualMemory ... 94109696, 1048576, ) == 0x0 02425 1120 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02426 1484 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02427 192 NtContinue (74186032, 1, ... 02428 476 NtContinue (94108976, 1, ... 02429 896 NtConnectPort ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15461556, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15461556, 188, ... 02408 2020 NtCreateEvent ... 760, ) == 0x0 02409 1404 NtDuplicateObject ... 764, ) == 0x0 02410 1124 NtDuplicateObject ... 768, ) == 0x0 02411 312 NtDuplicateObject ... 772, ) == 0x0 02412 776 NtDuplicateObject ... 776, ) == 0x0 02413 380 NtDuplicateObject ... 780, ) == 0x0 02414 624 NtDuplicateObject ... 784, ) == 0x0 02415 752 NtDuplicateObject ... 788, ) == 0x0 02416 1288 NtDuplicateObject ... 792, ) == 0x0 02417 644 NtDuplicateObject ... 796, ) == 0x0 02418 1924 NtDuplicateObject ... 800, ) == 0x0 02419 1316 NtDuplicateObject ... 804, ) == 0x0 02420 940 NtDuplicateObject ... 808, ) == 0x0 02421 1628 NtDuplicateObject ... 812, ) == 0x0 02430 868 NtSetEventBoostPriority (128, ... 02422 876 NtDuplicateObject ... 816, ) == 0x0 02431 808 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02423 1612 NtDuplicateObject ... 820, ) == 0x0 02432 1736 NtAllocateVirtualMemory (-1, 95150080, 0, 8192, 4096, 4, ... 02424 520 NtDuplicateObject ... 824, ) == 0x0 02425 1120 NtDuplicateObject ... 828, ) == 0x0 02433 192 NtRegisterThreadTerminatePort (24, ... 02434 476 NtRegisterThreadTerminatePort (24, ... 02435 2020 NtAllocateVirtualMemory (-1, 1413120, 0, 4096, 4096, 4, ... 02436 1404 NtWaitForSingleObject (284, 0, 0x0, ... 02429 896 NtConnectPort ... 832, 0x0, 0x0, 0x0, 188, ) == 0x0 02437 1124 NtWaitForSingleObject (284, 0, 0x0, ... 02438 312 NtWaitForSingleObject (284, 0, 0x0, ... 02439 776 NtWaitForSingleObject (284, 0, 0x0, ... 02440 380 NtWaitForSingleObject (284, 0, 0x0, ... 02441 624 NtWaitForSingleObject (284, 0, 0x0, ... 02442 752 NtWaitForSingleObject (284, 0, 0x0, ... 02443 1288 NtWaitForSingleObject (284, 0, 0x0, ... 02444 644 NtWaitForSingleObject (284, 0, 0x0, ... 02445 1924 NtWaitForSingleObject (284, 0, 0x0, ... 02446 1316 NtWaitForSingleObject (284, 0, 0x0, ... 02447 940 NtWaitForSingleObject (284, 0, 0x0, ... 00765 1252 NtWaitForSingleObject ... ) == 0x0 02430 868 NtSetEventBoostPriority ... ) == 0x0 02448 1628 NtWaitForSingleObject (284, 0, 0x0, ... 02449 876 NtWaitForSingleObject (284, 0, 0x0, ... 02431 808 NtCreateEvent ... 836, ) == 0x0 02450 1612 NtWaitForSingleObject (284, 0, 0x0, ... 02432 1736 NtAllocateVirtualMemory ... 95150080, 8192, ) == 0x0 02451 520 NtWaitForSingleObject (284, 0, 0x0, ... 02452 1120 NtWaitForSingleObject (284, 0, 0x0, ... 02433 192 NtRegisterThreadTerminatePort ... ) == 0x0 02434 476 NtRegisterThreadTerminatePort ... ) == 0x0 02435 2020 NtAllocateVirtualMemory ... 1413120, 4096, ) == 0x0 02453 896 NtRequestWaitReplyPort (832, {200, 224, new_msg, 0, 1377888, 12, 2, 1310721} (832, {200, 224, new_msg, 0, 1377888, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0@\342xl\275`H\2720\205\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\10\205\25\0 \37\357-x\1\24\0(\205\25\0h\1\24\0\0\0\0\0\0\0\0\0(\205\25\0P\0\0\00\205\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\353\0\372\31\221|\310\362\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... ... 02454 1252 NtWaitForSingleObject (284, 0, 0x0, ... 02426 1484 NtDuplicateObject ... 840, ) == 0x0 02455 808 NtWaitForSingleObject (284, 0, 0x0, ... 02456 1736 NtProtectVirtualMemory (-1, (0x5abe000), 4096, 260, ... 02457 192 NtWaitForSingleObject (284, 0, 0x0, ... 02458 868 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02459 2020 NtSetEventBoostPriority (284, ... 02460 1484 NtWaitForSingleObject (284, 0, 0x0, ... 02456 1736 NtProtectVirtualMemory ... (0x5abe000), 4096, 4, ) == 0x0 02461 476 NtWaitForSingleObject (284, 0, 0x0, ... 02453 896 NtRequestWaitReplyPort ... {200, 224, reply, 0, 1636, 896, 75592, 0} ... {200, 224, reply, 0, 1636, 896, 75592, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0@\342xl\275`H\2720\205\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\10\205\25\0 \37\357-x\1\24\0(\205\25\0h\1\24\0\0\0\0\0\0\0\0\0(\205\25\0P\0\0\00\205\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\353\0\372\31\221|\310\362\353\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) ) == 0x0 02458 868 NtCreateEvent ... 844, ) == 0x0 02436 1404 NtWaitForSingleObject ... ) == 0x0 02459 2020 NtSetEventBoostPriority ... ) == 0x0 02462 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02463 896 NtRequestWaitReplyPort (832, {64, 88, new_msg, 0, 1636, 896, 75547, 0} (832, {64, 88, new_msg, 0, 1636, 896, 75547, 0} "\1\356\0\0A\2\10\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... ... 02464 1404 NtSetEventBoostPriority (284, ... 02465 868 NtWaitForSingleObject (284, 0, 0x0, ... 02466 2020 NtWaitForSingleObject (284, 0, 0x0, ... 02437 1124 NtWaitForSingleObject ... ) == 0x0 02464 1404 NtSetEventBoostPriority ... ) == 0x0 02462 1736 NtCreateThread ... 848, {1636, 1964}, ) == 0x0 02463 896 NtRequestWaitReplyPort ... {52, 76, reply, 0, 1636, 896, 75593, 0} ... {52, 76, reply, 0, 1636, 896, 75593, 0} "\2\332\243\201\1\0\0\0\200Y\274\201Ni\257\341\264\311\275\201:\332R\200X\373`\371t\333\243\201\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" ) ) == 0x0 02467 1124 NtSetEventBoostPriority (284, ... 02468 1736 NtQueryInformationThread (848, Basic, 28, ... 02438 312 NtWaitForSingleObject ... ) == 0x0 02467 1124 NtSetEventBoostPriority ... ) == 0x0 02469 896 NtWaitForSingleObject (284, 0, 0x0, ... 02470 312 NtSetEventBoostPriority (284, ... 02468 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1636,Tid=1964,}, 0x0, ) == 0x0 02471 1404 NtWaitForSingleObject (284, 0, 0x0, ... 02439 776 NtWaitForSingleObject ... ) == 0x0 02470 312 NtSetEventBoostPriority ... ) == 0x0 02472 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75590, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75590, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0d\6\0\0\254\7\0\0" ... ... 02473 776 NtSetEventBoostPriority (284, ... 02474 1124 NtWaitForSingleObject (284, 0, 0x0, ... 02440 380 NtWaitForSingleObject ... ) == 0x0 02473 776 NtSetEventBoostPriority ... ) == 0x0 02472 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75594, 0} ... {28, 56, reply, 0, 1636, 1736, 75594, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0d\6\0\0\254\7\0\0" ) ) == 0x0 02475 380 NtSetEventBoostPriority (284, ... 02476 312 NtWaitForSingleObject (284, 0, 0x0, ... 02477 776 NtWaitForSingleObject (284, 0, 0x0, ... 02441 624 NtWaitForSingleObject ... ) == 0x0 02475 380 NtSetEventBoostPriority ... ) == 0x0 02478 624 NtSetEventBoostPriority (284, ... 02479 1736 NtResumeThread (848, ... 02442 752 NtWaitForSingleObject ... ) == 0x0 02478 624 NtSetEventBoostPriority ... ) == 0x0 02480 752 NtSetEventBoostPriority (284, ... 02479 1736 NtResumeThread ... 1, ) == 0x0 02481 380 NtWaitForSingleObject (284, 0, 0x0, ... 02443 1288 NtWaitForSingleObject ... ) == 0x0 02480 752 NtSetEventBoostPriority ... ) == 0x0 02482 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02483 1288 NtSetEventBoostPriority (284, ... 02484 624 NtWaitForSingleObject (284, 0, 0x0, ... 02485 1964 NtWaitForSingleObject (284, 0, 0x0, ... 02444 644 NtWaitForSingleObject ... ) == 0x0 02483 1288 NtSetEventBoostPriority ... ) == 0x0 02482 1736 NtAllocateVirtualMemory ... 95158272, 1048576, ) == 0x0 02486 644 NtSetEventBoostPriority (284, ... 02487 752 NtWaitForSingleObject (284, 0, 0x0, ... 02445 1924 NtWaitForSingleObject ... ) == 0x0 02486 644 NtSetEventBoostPriority ... ) == 0x0 02488 1736 NtAllocateVirtualMemory (-1, 96198656, 0, 8192, 4096, 4, ... 02489 1924 NtSetEventBoostPriority (284, ... 02490 1288 NtWaitForSingleObject (284, 0, 0x0, ... 02446 1316 NtWaitForSingleObject ... ) == 0x0 02489 1924 NtSetEventBoostPriority ... ) == 0x0 02488 1736 NtAllocateVirtualMemory ... 96198656, 8192, ) == 0x0 02491 1316 NtSetEventBoostPriority (284, ... 02492 644 NtWaitForSingleObject (284, 0, 0x0, ... 02493 1924 NtWaitForSingleObject (284, 0, 0x0, ... 02447 940 NtWaitForSingleObject ... ) == 0x0 02491 1316 NtSetEventBoostPriority ... ) == 0x0 02494 940 NtSetEventBoostPriority (284, ... 02495 1736 NtProtectVirtualMemory (-1, (0x5bbe000), 4096, 260, ... 02448 1628 NtWaitForSingleObject ... ) == 0x0 02494 940 NtSetEventBoostPriority ... ) == 0x0 02496 1628 NtSetEventBoostPriority (284, ... 02495 1736 NtProtectVirtualMemory ... (0x5bbe000), 4096, 4, ) == 0x0 02497 1316 NtWaitForSingleObject (284, 0, 0x0, ... 02449 876 NtWaitForSingleObject ... ) == 0x0 02496 1628 NtSetEventBoostPriority ... ) == 0x0 02498 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02499 876 NtSetEventBoostPriority (284, ... 02500 940 NtWaitForSingleObject (284, 0, 0x0, ... 02450 1612 NtWaitForSingleObject ... ) == 0x0 02499 876 NtSetEventBoostPriority ... ) == 0x0 02498 1736 NtCreateThread ... 852, {1636, 740}, ) == 0x0 02501 1612 NtSetEventBoostPriority (284, ... 02502 1628 NtWaitForSingleObject (284, 0, 0x0, ... 02451 520 NtWaitForSingleObject ... ) == 0x0 02501 1612 NtSetEventBoostPriority ... ) == 0x0 02503 1736 NtQueryInformationThread (852, Basic, 28, ... 02504 520 NtSetEventBoostPriority (284, ... 02505 876 NtWaitForSingleObject (284, 0, 0x0, ... 02452 1120 NtWaitForSingleObject ... ) == 0x0 02504 520 NtSetEventBoostPriority ... ) == 0x0 02503 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1636,Tid=740,}, 0x0, ) == 0x0 02506 1120 NtSetEventBoostPriority (284, ... 02507 1612 NtWaitForSingleObject (284, 0, 0x0, ... 02508 520 NtWaitForSingleObject (284, 0, 0x0, ... 02454 1252 NtWaitForSingleObject ... ) == 0x0 02506 1120 NtSetEventBoostPriority ... ) == 0x0 02509 1252 NtSetEventBoostPriority (284, ... 02510 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75594, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75594, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0d\6\0\0\344\2\0\0" ... ... 02455 808 NtWaitForSingleObject ... ) == 0x0 02509 1252 NtSetEventBoostPriority ... ) == 0x0 02511 808 NtSetEventBoostPriority (284, ... 02510 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75595, 0} ... {28, 56, reply, 0, 1636, 1736, 75595, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0d\6\0\0\344\2\0\0" ) ) == 0x0 02512 1120 NtWaitForSingleObject (284, 0, 0x0, ... 02460 1484 NtWaitForSingleObject ... ) == 0x0 02511 808 NtSetEventBoostPriority ... ) == 0x0 02513 1736 NtResumeThread (852, ... 02514 1484 NtSetEventBoostPriority (284, ... 02515 1252 NtWaitForSingleObject (284, 0, 0x0, ... 02461 476 NtWaitForSingleObject ... ) == 0x0 02514 1484 NtSetEventBoostPriority ... ) == 0x0 02513 1736 NtResumeThread ... 1, ) == 0x0 02516 476 NtSetEventBoostPriority (284, ... 02517 808 NtWaitForSingleObject (284, 0, 0x0, ... 02518 740 NtWaitForSingleObject (92, 0, 0x0, ... 02457 192 NtWaitForSingleObject ... ) == 0x0 02516 476 NtSetEventBoostPriority ... ) == 0x0 02519 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02520 192 NtSetEventBoostPriority (284, ... 02521 476 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02522 1484 NtWaitForSingleObject (284, 0, 0x0, ... 02465 868 NtWaitForSingleObject ... ) == 0x0 02520 192 NtSetEventBoostPriority ... ) == 0x0 02519 1736 NtAllocateVirtualMemory ... 96206848, 1048576, ) == 0x0 02523 868 NtSetEventBoostPriority (284, ... 02524 192 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02525 1736 NtAllocateVirtualMemory (-1, 97247232, 0, 8192, 4096, 4, ... 02466 2020 NtWaitForSingleObject ... ) == 0x0 02523 868 NtSetEventBoostPriority ... ) == 0x0 02524 192 NtDuplicateObject ... 856, ) == 0x0 02526 2020 NtSetEventBoostPriority (284, ... 02525 1736 NtAllocateVirtualMemory ... 97247232, 8192, ) == 0x0 02521 476 NtDuplicateObject ... 860, ) == 0x0 02527 868 NtWaitForSingleObject (284, 0, 0x0, ... 02469 896 NtWaitForSingleObject ... ) == 0x0 02528 1736 NtProtectVirtualMemory (-1, (0x5cbe000), 4096, 260, ... 02529 476 NtWaitForSingleObject (284, 0, 0x0, ... 02530 896 NtSetEventBoostPriority (284, ... 02528 1736 NtProtectVirtualMemory ... (0x5cbe000), 4096, 4, ) == 0x0 02471 1404 NtWaitForSingleObject ... ) == 0x0 02530 896 NtSetEventBoostPriority ... ) == 0x0 02531 1404 NtSetEventBoostPriority (284, ... 02532 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02526 2020 NtSetEventBoostPriority ... ) == 0x0 02533 192 NtWaitForSingleObject (284, 0, 0x0, ... 02474 1124 NtWaitForSingleObject ... ) == 0x0 02531 1404 NtSetEventBoostPriority ... ) == 0x0 02534 896 NtClose (756, ... 02535 2020 NtWaitForSingleObject (284, 0, 0x0, ... 02536 1124 NtSetEventBoostPriority (284, ... 02537 1404 NtWaitForSingleObject (64, 0, {0, 0}, ... 02534 896 NtClose ... ) == 0x0 02476 312 NtWaitForSingleObject ... ) == 0x0 02536 1124 NtSetEventBoostPriority ... ) == 0x0 02532 1736 NtCreateThread ... 756, {1636, 1624}, ) == 0x0 02538 312 NtSetEventBoostPriority (284, ... 02539 896 NtClose (832, ... 02540 1124 NtWaitForSingleObject (284, 0, 0x0, ... 02477 776 NtWaitForSingleObject ... ) == 0x0 02538 312 NtSetEventBoostPriority ... ) == 0x0 02541 1736 NtQueryInformationThread (756, Basic, 28, ... 02539 896 NtClose ... ) == 0x0 02537 1404 NtWaitForSingleObject ... ) == 0x102 02542 776 NtSetEventBoostPriority (284, ... 02543 312 NtWaitForSingleObject (284, 0, 0x0, ... 02541 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1636,Tid=1624,}, 0x0, ) == 0x0 02544 896 NtCreateKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ... 02481 380 NtWaitForSingleObject ... ) == 0x0 02542 776 NtSetEventBoostPriority ... ) == 0x0 02545 1404 NtWaitForSingleObject (128, 0, 0x0, ... 02546 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75595, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75595, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0d\6\0\0X\6\0\0" ... ... 02547 380 NtSetEventBoostPriority (284, ... 02548 776 NtWaitForSingleObject (284, 0, 0x0, ... 02484 624 NtWaitForSingleObject ... ) == 0x0 02547 380 NtSetEventBoostPriority ... ) == 0x0 02546 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75597, 0} ... {28, 56, reply, 0, 1636, 1736, 75597, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0d\6\0\0X\6\0\0" ) ) == 0x0 02544 896 NtCreateKey ... 832, 2, ) == 0x0 02549 624 NtSetEventBoostPriority (284, ... 02550 380 NtWaitForSingleObject (284, 0, 0x0, ... 02485 1964 NtWaitForSingleObject ... ) == 0x0 02549 624 NtSetEventBoostPriority ... ) == 0x0 02551 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ... 02552 1736 NtResumeThread (756, ... 02553 1964 NtSetEventBoostPriority (284, ... 02554 624 NtWaitForSingleObject (284, 0, 0x0, ... 02551 896 NtOpenKey ... 864, ) == 0x0 02487 752 NtWaitForSingleObject ... ) == 0x0 02553 1964 NtSetEventBoostPriority ... ) == 0x0 02552 1736 NtResumeThread ... 1, ) == 0x0 02555 752 NtSetEventBoostPriority (284, ... 02556 896 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ... 02557 1624 NtWaitForSingleObject (92, 0, 0x0, ... 02490 1288 NtWaitForSingleObject ... ) == 0x0 02555 752 NtSetEventBoostPriority ... ) == 0x0 02558 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02556 896 NtOpenKey ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02559 1288 NtSetEventBoostPriority (284, ... 02560 752 NtWaitForSingleObject (284, 0, 0x0, ... 02558 1736 NtAllocateVirtualMemory ... 97255424, 1048576, ) == 0x0 02492 644 NtWaitForSingleObject ... ) == 0x0 02559 1288 NtSetEventBoostPriority ... ) == 0x0 02561 896 NtQueryValueKey (832, (832, "Hostname", Partial, 144, ... , Partial, 144, ... 02562 1964 NtSetEventBoostPriority (92, ... 02563 644 NtSetEventBoostPriority (284, ... 02564 1736 NtAllocateVirtualMemory (-1, 98295808, 0, 8192, 4096, 4, ... 02565 1288 NtWaitForSingleObject (284, 0, 0x0, ... 02493 1924 NtWaitForSingleObject ... ) == 0x0 02563 644 NtSetEventBoostPriority ... ) == 0x0 02518 740 NtWaitForSingleObject ... ) == 0x0 02562 1964 NtSetEventBoostPriority ... ) == 0x0 02564 1736 NtAllocateVirtualMemory ... 98295808, 8192, ) == 0x0 02561 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0 02566 1924 NtAllocateVirtualMemory (-1, 1417216, 0, 4096, 4096, 4, ... 02567 740 NtSetEventBoostPriority (92, ... 02568 644 NtWaitForSingleObject (284, 0, 0x0, ... 02569 1964 NtTestAlert (... 02566 1924 NtAllocateVirtualMemory ... 1417216, 4096, ) == 0x0 02557 1624 NtWaitForSingleObject ... ) == 0x0 02567 740 NtSetEventBoostPriority ... ) == 0x0 02570 896 NtQueryValueKey (832, (832, "Hostname", Partial, 144, ... , Partial, 144, ... 02571 1736 NtProtectVirtualMemory (-1, (0x5dbe000), 4096, 260, ... 02572 1924 NtSetEventBoostPriority (284, ... 02573 1624 NtTestAlert (... 02569 1964 NtTestAlert ... ) == 0x0 02570 896 NtQueryValueKey ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0 02571 1736 NtProtectVirtualMemory ... (0x5dbe000), 4096, 4, ) == 0x0 02574 740 NtTestAlert (... 02573 1624 NtTestAlert ... ) == 0x0 02575 1964 NtContinue (95157552, 1, ... 02576 896 NtClose (832, ... 02577 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02574 740 NtTestAlert ... ) == 0x0 02497 1316 NtWaitForSingleObject ... ) == 0x0 02572 1924 NtSetEventBoostPriority ... ) == 0x0 02578 1964 NtRegisterThreadTerminatePort (24, ... 02576 896 NtClose ... ) == 0x0 02577 1736 NtCreateThread ... 832, {1636, 1716}, ) == 0x0 02579 740 NtContinue (96206128, 1, ... 02580 1316 NtSetEventBoostPriority (284, ... 02581 1924 NtWaitForSingleObject (284, 0, 0x0, ... 02582 1624 NtContinue (97254704, 1, ... 02583 896 NtClose (864, ... 02584 1736 NtQueryInformationThread (832, Basic, 28, ... 02585 740 NtRegisterThreadTerminatePort (24, ... 02500 940 NtWaitForSingleObject ... ) == 0x0 02580 1316 NtSetEventBoostPriority ... ) == 0x0 02586 1624 NtRegisterThreadTerminatePort (24, ... 02578 1964 NtRegisterThreadTerminatePort ... ) == 0x0 02584 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1636,Tid=1716,}, 0x0, ) == 0x0 02587 940 NtSetEventBoostPriority (284, ... 02585 740 NtRegisterThreadTerminatePort ... ) == 0x0 02588 1316 NtWaitForSingleObject (284, 0, 0x0, ... 02586 1624 NtRegisterThreadTerminatePort ... ) == 0x0 02589 1964 NtWaitForSingleObject (284, 0, 0x0, ... 02583 896 NtClose ... ) == 0x0 02502 1628 NtWaitForSingleObject ... ) == 0x0 02587 940 NtSetEventBoostPriority ... ) == 0x0 02590 740 NtWaitForSingleObject (284, 0, 0x0, ... 02591 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75597, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75597, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0d\6\0\0\264\6\0\0" ... ... 02592 1624 NtWaitForSingleObject (284, 0, 0x0, ... 02593 1628 NtSetEventBoostPriority (284, ... 02594 896 NtWaitForSingleObject (284, 0, 0x0, ... 02595 940 NtWaitForSingleObject (284, 0, 0x0, ... 02591 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75598, 0} ... {28, 56, reply, 0, 1636, 1736, 75598, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0d\6\0\0\264\6\0\0" ) ) == 0x0 02505 876 NtWaitForSingleObject ... ) == 0x0 02593 1628 NtSetEventBoostPriority ... ) == 0x0 02596 876 NtSetEventBoostPriority (284, ... 02597 1736 NtResumeThread (832, ... 02507 1612 NtWaitForSingleObject ... ) == 0x0 02596 876 NtSetEventBoostPriority ... ) == 0x0 02598 1628 NtWaitForSingleObject (284, 0, 0x0, ... 02599 1612 NtSetEventBoostPriority (284, ... 02597 1736 NtResumeThread ... 1, ) == 0x0 02600 876 NtWaitForSingleObject (284, 0, 0x0, ... 02601 1716 NtTestAlert (... 02508 520 NtWaitForSingleObject ... ) == 0x0 02599 1612 NtSetEventBoostPriority ... ) == 0x0 02602 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02603 520 NtSetEventBoostPriority (284, ... 02601 1716 NtTestAlert ... ) == 0x0 02604 1612 NtWaitForSingleObject (284, 0, 0x0, ... 02512 1120 NtWaitForSingleObject ... ) == 0x0 02603 520 NtSetEventBoostPriority ... ) == 0x0 02605 1716 NtContinue (98303280, 1, ... 02602 1736 NtAllocateVirtualMemory ... 98304000, 1048576, ) == 0x0 02606 1120 NtSetEventBoostPriority (284, ... 02607 520 NtWaitForSingleObject (284, 0, 0x0, ... 02608 1716 NtRegisterThreadTerminatePort (24, ... 02515 1252 NtWaitForSingleObject ... ) == 0x0 02606 1120 NtSetEventBoostPriority ... ) == 0x0 02609 1736 NtAllocateVirtualMemory (-1, 99344384, 0, 8192, 4096, 4, ... 02610 1252 NtSetEventBoostPriority (284, ... 02608 1716 NtRegisterThreadTerminatePort ... ) == 0x0 02611 1120 NtWaitForSingleObject (284, 0, 0x0, ... 02517 808 NtWaitForSingleObject ... ) == 0x0 02610 1252 NtSetEventBoostPriority ... ) == 0x0 02609 1736 NtAllocateVirtualMemory ... 99344384, 8192, ) == 0x0 02612 1716 NtWaitForSingleObject (284, 0, 0x0, ... 02613 808 NtAllocateVirtualMemory (-1, 1421312, 0, 4096, 4096, 4, ... 02614 1252 NtSetEventBoostPriority (128, ... 02615 1736 NtProtectVirtualMemory (-1, (0x5ebe000), 4096, 260, ... 02613 808 NtAllocateVirtualMemory ... 1421312, 4096, ) == 0x0 02616 808 NtSetEventBoostPriority (284, ... 02615 1736 NtProtectVirtualMemory ... (0x5ebe000), 4096, 4, ) == 0x0 00779 2016 NtWaitForSingleObject ... ) == 0x0 02614 1252 NtSetEventBoostPriority ... ) == 0x0 02617 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02618 2016 NtWaitForSingleObject (284, 0, 0x0, ... 02619 1252 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02522 1484 NtWaitForSingleObject ... ) == 0x0 02616 808 NtSetEventBoostPriority ... ) == 0x0 02619 1252 NtCreateEvent ... 864, ) == 0x0 02620 1484 NtSetEventBoostPriority (284, ... 02621 808 NtWaitForSingleObject (284, 0, 0x0, ... 02622 1252 NtWaitForSingleObject (284, 0, 0x0, ... 02527 868 NtWaitForSingleObject ... ) == 0x0 02620 1484 NtSetEventBoostPriority ... ) == 0x0 02623 868 NtAllocateVirtualMemory (-1, 1425408, 0, 4096, 4096, 4, ... 1425408, 4096, ) == 0x0 02624 868 NtSetEventBoostPriority (284, ... 02625 1484 NtWaitForSingleObject (284, 0, 0x0, ... 02617 1736 NtCreateThread ... 868, {1636, 1440}, ) == 0x0 02529 476 NtWaitForSingleObject ... ) == 0x0 02624 868 NtSetEventBoostPriority ... ) == 0x0 02626 1736 NtQueryInformationThread (868, Basic, 28, ... 02627 476 NtSetEventBoostPriority (284, ... 02628 868 NtWaitForSingleObject (284, 0, 0x0, ... 02626 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1636,Tid=1440,}, 0x0, ) == 0x0 02533 192 NtWaitForSingleObject ... ) == 0x0 02627 476 NtSetEventBoostPriority ... ) == 0x0 02629 192 NtSetEventBoostPriority (284, ... 02630 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75598, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75598, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0d\6\0\0\240\5\0\0" ... ... 02535 2020 NtWaitForSingleObject ... ) == 0x0 02629 192 NtSetEventBoostPriority ... ) == 0x0 02631 2020 NtSetEventBoostPriority (284, ... 02630 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75599, 0} ... {28, 56, reply, 0, 1636, 1736, 75599, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0d\6\0\0\240\5\0\0" ) ) == 0x0 02540 1124 NtWaitForSingleObject ... ) == 0x0 02631 2020 NtSetEventBoostPriority ... ) == 0x0 02632 192 NtWaitForSingleObject (284, 0, 0x0, ... 02633 476 NtWaitForSingleObject (284, 0, 0x0, ... 02634 1124 NtSetEventBoostPriority (284, ... 02635 1736 NtResumeThread (868, ... 02636 2020 NtWaitForSingleObject (284, 0, 0x0, ... 02543 312 NtWaitForSingleObject ... ) == 0x0 02635 1736 NtResumeThread ... 1, ) == 0x0 02637 312 NtSetEventBoostPriority (284, ... 02638 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02548 776 NtWaitForSingleObject ... ) == 0x0 02638 1736 NtAllocateVirtualMemory ... 99352576, 1048576, ) == 0x0 02639 776 NtSetEventBoostPriority (284, ... 02640 1736 NtAllocateVirtualMemory (-1, 100392960, 0, 8192, 4096, 4, ... 02550 380 NtWaitForSingleObject ... ) == 0x0 02640 1736 NtAllocateVirtualMemory ... 100392960, 8192, ) == 0x0 02641 380 NtSetEventBoostPriority (284, ... 02639 776 NtSetEventBoostPriority ... ) == 0x0 02637 312 NtSetEventBoostPriority ... ) == 0x0 02634 1124 NtSetEventBoostPriority ... ) == 0x0 02642 1440 NtTestAlert (... 02554 624 NtWaitForSingleObject ... ) == 0x0 02643 776 NtWaitForSingleObject (284, 0, 0x0, ... 02644 312 NtWaitForSingleObject (340, 0, 0x0, ... 02645 1124 NtWaitForSingleObject (340, 0, 0x0, ... 02642 1440 NtTestAlert ... ) == 0x0 02646 624 NtSetEventBoostPriority (284, ... 02647 1440 NtContinue (99351856, 1, ... 02560 752 NtWaitForSingleObject ... ) == 0x0 02648 1440 NtRegisterThreadTerminatePort (24, ... 02649 752 NtSetEventBoostPriority (284, ... 02648 1440 NtRegisterThreadTerminatePort ... ) == 0x0 02565 1288 NtWaitForSingleObject ... ) == 0x0 02649 752 NtSetEventBoostPriority ... ) == 0x0 02646 624 NtSetEventBoostPriority ... ) == 0x0 02641 380 NtSetEventBoostPriority ... ) == 0x0 02650 1736 NtProtectVirtualMemory (-1, (0x5fbe000), 4096, 260, ... 02651 1288 NtSetEventBoostPriority (284, ... 02652 752 NtWaitForSingleObject (284, 0, 0x0, ... 02653 624 NtWaitForSingleObject (284, 0, 0x0, ... 02654 380 NtWaitForSingleObject (284, 0, 0x0, ... 02650 1736 NtProtectVirtualMemory ... (0x5fbe000), 4096, 4, ) == 0x0 02568 644 NtWaitForSingleObject ... ) == 0x0 02655 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02656 644 NtSetEventBoostPriority (284, ... 02655 1736 NtCreateThread ... 872, {1636, 1516}, ) == 0x0 02581 1924 NtWaitForSingleObject ... ) == 0x0 02657 1736 NtQueryInformationThread (872, Basic, 28, ... 02658 1924 NtSetEventBoostPriority (284, ... 02657 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1636,Tid=1516,}, 0x0, ) == 0x0 02589 1964 NtWaitForSingleObject ... ) == 0x0 02658 1924 NtSetEventBoostPriority ... ) == 0x0 02656 644 NtSetEventBoostPriority ... ) == 0x0 02651 1288 NtSetEventBoostPriority ... ) == 0x0 02659 1440 NtWaitForSingleObject (284, 0, 0x0, ... 02660 1964 NtSetEventBoostPriority (284, ... 02661 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75599, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75599, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0d\6\0\0\354\5\0\0" ... ... 02662 644 NtWaitForSingleObject (284, 0, 0x0, ... 02663 1288 NtWaitForSingleObject (284, 0, 0x0, ... 02588 1316 NtWaitForSingleObject ... ) == 0x0 02660 1964 NtSetEventBoostPriority ... ) == 0x0 02661 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75600, 0} ... {28, 56, reply, 0, 1636, 1736, 75600, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0d\6\0\0\354\5\0\0" ) ) == 0x0 02664 1316 NtSetEventBoostPriority (284, ... 02665 1924 NtWaitForSingleObject (284, 0, 0x0, ... 02592 1624 NtWaitForSingleObject ... ) == 0x0 02666 1736 NtResumeThread (872, ... 02667 1624 NtSetEventBoostPriority (284, ... 02666 1736 NtResumeThread ... 1, ) == 0x0 02594 896 NtWaitForSingleObject ... ) == 0x0 02667 1624 NtSetEventBoostPriority ... ) == 0x0 02668 896 NtSetEventBoostPriority (284, ... 02669 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02664 1316 NtSetEventBoostPriority ... ) == 0x0 02670 1964 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02671 1516 NtWaitForSingleObject (284, 0, 0x0, ... 02590 740 NtWaitForSingleObject ... ) == 0x0 02668 896 NtSetEventBoostPriority ... ) == 0x0 02672 1624 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02673 1316 NtWaitForSingleObject (284, 0, 0x0, ... 02670 1964 NtDuplicateObject ... 876, ) == 0x0 02674 740 NtSetEventBoostPriority (284, ... 02669 1736 NtAllocateVirtualMemory ... 100401152, 1048576, ) == 0x0 02672 1624 NtDuplicateObject ... 880, ) == 0x0 02595 940 NtWaitForSingleObject ... ) == 0x0 02675 1964 NtWaitForSingleObject (284, 0, 0x0, ... 02676 1736 NtAllocateVirtualMemory (-1, 101441536, 0, 8192, 4096, 4, ... 02677 1624 NtWaitForSingleObject (284, 0, 0x0, ... 02678 940 NtSetEventBoostPriority (284, ... 02676 1736 NtAllocateVirtualMemory ... 101441536, 8192, ) == 0x0 02598 1628 NtWaitForSingleObject ... ) == 0x0 02679 1736 NtProtectVirtualMemory (-1, (0x60be000), 4096, 260, ... 02680 1628 NtSetEventBoostPriority (284, ... 02679 1736 NtProtectVirtualMemory ... (0x60be000), 4096, 4, ) == 0x0 02600 876 NtWaitForSingleObject ... ) == 0x0 02681 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02682 876 NtSetEventBoostPriority (284, ... 02680 1628 NtSetEventBoostPriority ... ) == 0x0 02678 940 NtSetEventBoostPriority ... ) == 0x0 02674 740 NtSetEventBoostPriority ... ) == 0x0 02683 896 NtWaitForSingleObject (284, 0, 0x0, ... 02604 1612 NtWaitForSingleObject ... ) == 0x0 02684 1628 NtWaitForSingleObject (284, 0, 0x0, ... 02685 940 NtWaitForSingleObject (284, 0, 0x0, ... 02686 740 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02687 1612 NtSetEventBoostPriority (284, ... 02686 740 NtDuplicateObject ... 884, ) == 0x0 02607 520 NtWaitForSingleObject ... ) == 0x0 02687 1612 NtSetEventBoostPriority ... ) == 0x0 02682 876 NtSetEventBoostPriority ... ) == 0x0 02681 1736 NtCreateThread ... 888, {1636, 1664}, ) == 0x0 02688 520 NtSetEventBoostPriority (284, ... 02689 1612 NtWaitForSingleObject (284, 0, 0x0, ... 02690 876 NtWaitForSingleObject (284, 0, 0x0, ... 02691 1736 NtQueryInformationThread (888, Basic, 28, ... 02612 1716 NtWaitForSingleObject ... ) == 0x0 02691 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1636,Tid=1664,}, 0x0, ) == 0x0 02692 1716 NtSetEventBoostPriority (284, ... 02693 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75600, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75600, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0d\6\0\0\200\6\0\0" ... ... 02611 1120 NtWaitForSingleObject ... ) == 0x0 02692 1716 NtSetEventBoostPriority ... ) == 0x0 02694 1120 NtSetEventBoostPriority (284, ... 02693 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75601, 0} ... {28, 56, reply, 0, 1636, 1736, 75601, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0d\6\0\0\200\6\0\0" ) ) == 0x0 02618 2016 NtWaitForSingleObject ... ) == 0x0 02695 1716 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02694 1120 NtSetEventBoostPriority ... ) == 0x0 02688 520 NtSetEventBoostPriority ... ) == 0x0 02696 740 NtWaitForSingleObject (284, 0, 0x0, ... 02697 2016 NtSetEventBoostPriority (284, ... 02698 1736 NtResumeThread (888, ... 02699 1120 NtWaitForSingleObject (284, 0, 0x0, ... 02700 520 NtWaitForSingleObject (284, 0, 0x0, ... 02621 808 NtWaitForSingleObject ... ) == 0x0 02697 2016 NtSetEventBoostPriority ... ) == 0x0 02698 1736 NtResumeThread ... 1, ) == 0x0 02701 808 NtAllocateVirtualMemory (-1, 1429504, 0, 4096, 4096, 4, ... 02695 1716 NtDuplicateObject ... 892, ) == 0x0 02702 1664 NtWaitForSingleObject (92, 0, 0x0, ... 02701 808 NtAllocateVirtualMemory ... 1429504, 4096, ) == 0x0 02703 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02704 1716 NtWaitForSingleObject (284, 0, 0x0, ... 02705 2016 NtWaitForSingleObject (284, 0, 0x0, ... 02703 1736 NtAllocateVirtualMemory ... 101449728, 1048576, ) == 0x0 02706 1736 NtAllocateVirtualMemory (-1, 102490112, 0, 8192, 4096, 4, ... 102490112, 8192, ) == 0x0 02707 1736 NtProtectVirtualMemory (-1, (0x61be000), 4096, 260, ... (0x61be000), 4096, 4, ) == 0x0 02708 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 896, {1636, 1972}, ) == 0x0 02709 1736 NtQueryInformationThread (896, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1636,Tid=1972,}, 0x0, ) == 0x0 02710 808 NtSetEventBoostPriority (284, ... 02622 1252 NtWaitForSingleObject ... ) == 0x0 02711 1252 NtSetEventBoostPriority (284, ... 02628 868 NtWaitForSingleObject ... ) == 0x0 02712 868 NtSetEventBoostPriority (284, ... 02625 1484 NtWaitForSingleObject ... ) == 0x0 02713 1484 NtSetEventBoostPriority (284, ... 02633 476 NtWaitForSingleObject ... ) == 0x0 02714 476 NtSetEventBoostPriority (284, ... 02636 2020 NtWaitForSingleObject ... ) == 0x0 02715 2020 NtSetEventBoostPriority (284, ... 02632 192 NtWaitForSingleObject ... ) == 0x0 02716 192 NtSetEventBoostPriority (284, ... 02643 776 NtWaitForSingleObject ... ) == 0x0 02717 776 NtSetEventBoostPriority (284, ... 02652 752 NtWaitForSingleObject ... ) == 0x0 02718 752 NtSetEventBoostPriority (284, ... 02653 624 NtWaitForSingleObject ... ) == 0x0 02719 624 NtSetEventBoostPriority (284, ... 02654 380 NtWaitForSingleObject ... ) == 0x0 02720 380 NtSetEventBoostPriority (284, ... 02659 1440 NtWaitForSingleObject ... ) == 0x0 02721 1440 NtSetEventBoostPriority (284, ... 02662 644 NtWaitForSingleObject ... ) == 0x0 02722 644 NtSetEventBoostPriority (284, ... 02663 1288 NtWaitForSingleObject ... ) == 0x0 02723 1288 NtSetEventBoostPriority (284, ... 02665 1924 NtWaitForSingleObject ... ) == 0x0 02724 1924 NtSetEventBoostPriority (284, ... 02671 1516 NtWaitForSingleObject ... ) == 0x0 02725 1516 NtSetEventBoostPriority (284, ... 02673 1316 NtWaitForSingleObject ... ) == 0x0 02726 1316 NtSetEventBoostPriority (284, ... 02675 1964 NtWaitForSingleObject ... ) == 0x0 02727 1964 NtSetEventBoostPriority (284, ... 02677 1624 NtWaitForSingleObject ... ) == 0x0 02728 1624 NtSetEventBoostPriority (284, ... 02683 896 NtWaitForSingleObject ... ) == 0x0 02729 896 NtSetEventBoostPriority (284, ... 02684 1628 NtWaitForSingleObject ... ) == 0x0 02730 1628 NtSetEventBoostPriority (284, ... 02685 940 NtWaitForSingleObject ... ) == 0x0 02731 940 NtSetEventBoostPriority (284, ... 02689 1612 NtWaitForSingleObject ... ) == 0x0 02732 1612 NtSetEventBoostPriority (284, ... 02690 876 NtWaitForSingleObject ... ) == 0x0 02733 876 NtSetEventBoostPriority (284, ... 02696 740 NtWaitForSingleObject ... ) == 0x0 02734 740 NtSetEventBoostPriority (284, ... 02699 1120 NtWaitForSingleObject ... ) == 0x0 02735 1120 NtSetEventBoostPriority (284, ... 02700 520 NtWaitForSingleObject ... ) == 0x0 02736 520 NtSetEventBoostPriority (284, ... 02704 1716 NtWaitForSingleObject ... ) == 0x0 02737 1716 NtSetEventBoostPriority (284, ... 02705 2016 NtWaitForSingleObject ... ) == 0x0 02738 2016 NtSetEventBoostPriority (128, ... 00781 2012 NtWaitForSingleObject ... ) == 0x0 02739 2012 NtSetEventBoostPriority (128, ... 00789 1028 NtWaitForSingleObject ... ) == 0x0 02740 1028 NtSetEventBoostPriority (128, ... 00794 384 NtWaitForSingleObject ... ) == 0x0 02741 384 NtSetEventBoostPriority (128, ... 00800 1180 NtWaitForSingleObject ... ) == 0x0 02742 1180 NtSetEventBoostPriority (128, ... 01063 500 NtWaitForSingleObject ... ) == 0x0 02743 500 NtSetEventBoostPriority (128, ... 01182 252 NtWaitForSingleObject ... ) == 0x0 02744 252 NtSetEventBoostPriority (128, ... 01186 1096 NtWaitForSingleObject ... ) == 0x0 02745 1096 NtSetEventBoostPriority (128, ... 01235 420 NtWaitForSingleObject ... ) == 0x0 02746 420 NtSetEventBoostPriority (128, ... 01282 376 NtWaitForSingleObject ... ) == 0x0 02747 376 NtSetEventBoostPriority (128, ... 01310 928 NtWaitForSingleObject ... ) == 0x0 02748 928 NtSetEventBoostPriority (128, ... 01316 1168 NtWaitForSingleObject ... ) == 0x0 02749 1168 NtSetEventBoostPriority (128, ... 01323 1732 NtWaitForSingleObject ... ) == 0x0 02750 1732 NtSetEventBoostPriority (128, ... 01326 120 NtWaitForSingleObject ... ) == 0x0 02751 120 NtSetEventBoostPriority (128, ... 01333 428 NtWaitForSingleObject ... ) == 0x0 02752 428 NtSetEventBoostPriority (128, ... 01337 1300 NtWaitForSingleObject ... ) == 0x0 02753 1300 NtSetEventBoostPriority (128, ... 01339 748 NtWaitForSingleObject ... ) == 0x0 02754 748 NtSetEventBoostPriority (128, ... 01353 948 NtWaitForSingleObject ... ) == 0x0 02755 948 NtSetEventBoostPriority (128, ... 01355 1384 NtWaitForSingleObject ... ) == 0x0 02756 1384 NtSetEventBoostPriority (128, ... 01356 1064 NtWaitForSingleObject ... ) == 0x0 02757 1064 NtSetEventBoostPriority (128, ... 01365 1024 NtWaitForSingleObject ... ) == 0x0 02758 1024 NtSetEventBoostPriority (128, ... 01391 596 NtWaitForSingleObject ... ) == 0x0 02759 596 NtSetEventBoostPriority (128, ... 01393 188 NtWaitForSingleObject ... ) == 0x0 02760 188 NtSetEventBoostPriority (128, ... 01394 1132 NtWaitForSingleObject ... ) == 0x0 02761 1132 NtSetEventBoostPriority (128, ... 01462 2040 NtWaitForSingleObject ... ) == 0x0 02762 2040 NtSetEventBoostPriority (128, ... 01463 1600 NtWaitForSingleObject ... ) == 0x0 02763 1600 NtSetEventBoostPriority (128, ... 01464 1372 NtWaitForSingleObject ... ) == 0x0 02764 1372 NtSetEventBoostPriority (128, ... 01470 216 NtWaitForSingleObject ... ) == 0x0 02765 216 NtSetEventBoostPriority (128, ... 01499 152 NtWaitForSingleObject ... ) == 0x0 02766 152 NtSetEventBoostPriority (128, ... 01518 2036 NtWaitForSingleObject ... ) == 0x0 02767 2036 NtSetEventBoostPriority (128, ... 01545 1708 NtWaitForSingleObject ... ) == 0x0 02768 1708 NtSetEventBoostPriority (128, ... 01564 1776 NtWaitForSingleObject ... ) == 0x0 02769 1776 NtSetEventBoostPriority (128, ... 01582 1324 NtWaitForSingleObject ... ) == 0x0 02770 1324 NtSetEventBoostPriority (128, ... 01600 1884 NtWaitForSingleObject ... ) == 0x0 02771 1884 NtSetEventBoostPriority (128, ... 01626 248 NtWaitForSingleObject ... ) == 0x0 02772 248 NtSetEventBoostPriority (128, ... 01646 1652 NtWaitForSingleObject ... ) == 0x0 02773 1652 NtSetEventBoostPriority (128, ... 01662 588 NtWaitForSingleObject ... ) == 0x0 02774 588 NtSetEventBoostPriority (128, ... 01685 440 NtWaitForSingleObject ... ) == 0x0 02775 440 NtSetEventBoostPriority (128, ... 01703 1296 NtWaitForSingleObject ... ) == 0x0 02776 1296 NtSetEventBoostPriority (128, ... 01721 1620 NtWaitForSingleObject ... ) == 0x0 02777 1620 NtSetEventBoostPriority (128, ... 01754 1588 NtWaitForSingleObject ... ) == 0x0 02778 1588 NtSetEventBoostPriority (128, ... 01769 2044 NtWaitForSingleObject ... ) == 0x0 02779 2044 NtSetEventBoostPriority (128, ... 01786 1308 NtWaitForSingleObject ... ) == 0x0 02780 1308 NtSetEventBoostPriority (128, ... 01801 1676 NtWaitForSingleObject ... ) == 0x0 02781 1676 NtSetEventBoostPriority (128, ... 01830 1376 NtWaitForSingleObject ... ) == 0x0 02782 1376 NtSetEventBoostPriority (128, ... 01991 1436 NtWaitForSingleObject ... ) == 0x0 02783 1436 NtSetEventBoostPriority (128, ... 02001 724 NtWaitForSingleObject ... ) == 0x0 02784 724 NtSetEventBoostPriority (128, ... 02002 1276 NtWaitForSingleObject ... ) == 0x0 02785 1276 NtSetEventBoostPriority (128, ... 02009 1368 NtWaitForSingleObject ... ) == 0x0 02786 1368 NtSetEventBoostPriority (128, ... 02010 704 NtWaitForSingleObject ... ) == 0x0 02787 704 NtSetEventBoostPriority (128, ... 02011 1568 NtWaitForSingleObject ... ) == 0x0 02788 1568 NtSetEventBoostPriority (128, ... 02037 1104 NtWaitForSingleObject ... ) == 0x0 02789 1104 NtSetEventBoostPriority (128, ... 02046 784 NtWaitForSingleObject ... ) == 0x0 02790 784 NtSetEventBoostPriority (128, ... 02052 1792 NtWaitForSingleObject ... ) == 0x0 02791 1792 NtSetEventBoostPriority (128, ... 02545 1404 NtWaitForSingleObject ... ) == 0x0 02792 1404 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 900, ) == 0x0 02791 1792 NtSetEventBoostPriority ... ) == 0x0 02790 784 NtSetEventBoostPriority ... ) == 0x0 02789 1104 NtSetEventBoostPriority ... ) == 0x0 02788 1568 NtSetEventBoostPriority ... ) == 0x0 02787 704 NtSetEventBoostPriority ... ) == 0x0 02786 1368 NtSetEventBoostPriority ... ) == 0x0 02785 1276 NtSetEventBoostPriority ... ) == 0x0 02784 724 NtSetEventBoostPriority ... ) == 0x0 02783 1436 NtSetEventBoostPriority ... ) == 0x0 02779 2044 NtSetEventBoostPriority ... ) == 0x0 02773 1652 NtSetEventBoostPriority ... ) == 0x0 02766 152 NtSetEventBoostPriority ... ) == 0x0 02764 1372 NtSetEventBoostPriority ... ) == 0x0 02763 1600 NtSetEventBoostPriority ... ) == 0x0 02762 2040 NtSetEventBoostPriority ... ) == 0x0 02761 1132 NtSetEventBoostPriority ... ) == 0x0 02760 188 NtSetEventBoostPriority ... ) == 0x0 02759 596 NtSetEventBoostPriority ... ) == 0x0 02758 1024 NtSetEventBoostPriority ... ) == 0x0 02757 1064 NtSetEventBoostPriority ... ) == 0x0 02756 1384 NtSetEventBoostPriority ... ) == 0x0 02755 948 NtSetEventBoostPriority ... ) == 0x0 02754 748 NtSetEventBoostPriority ... ) == 0x0 02753 1300 NtSetEventBoostPriority ... ) == 0x0 02752 428 NtSetEventBoostPriority ... ) == 0x0 02751 120 NtSetEventBoostPriority ... ) == 0x0 02750 1732 NtSetEventBoostPriority ... ) == 0x0 02749 1168 NtSetEventBoostPriority ... ) == 0x0 02746 420 NtSetEventBoostPriority ... ) == 0x0 02745 1096 NtSetEventBoostPriority ... ) == 0x0 02744 252 NtSetEventBoostPriority ... ) == 0x0 02743 500 NtSetEventBoostPriority ... ) == 0x0 02742 1180 NtSetEventBoostPriority ... ) == 0x0 02741 384 NtSetEventBoostPriority ... ) == 0x0 02740 1028 NtSetEventBoostPriority ... ) == 0x0 02739 2012 NtSetEventBoostPriority ... ) == 0x0 02738 2016 NtSetEventBoostPriority ... ) == 0x0 02737 1716 NtSetEventBoostPriority ... ) == 0x0 02736 520 NtSetEventBoostPriority ... ) == 0x0 02735 1120 NtSetEventBoostPriority ... ) == 0x0 02734 740 NtSetEventBoostPriority ... ) == 0x0 02733 876 NtSetEventBoostPriority ... ) == 0x0 02732 1612 NtSetEventBoostPriority ... ) == 0x0 02731 940 NtSetEventBoostPriority ... ) == 0x0 02730 1628 NtSetEventBoostPriority ... ) == 0x0 02729 896 NtSetEventBoostPriority ... ) == 0x0 02728 1624 NtSetEventBoostPriority ... ) == 0x0 02727 1964 NtSetEventBoostPriority ... ) == 0x0 02726 1316 NtSetEventBoostPriority ... ) == 0x0 02725 1516 NtSetEventBoostPriority ... ) == 0x0 02724 1924 NtSetEventBoostPriority ... ) == 0x0 02723 1288 NtSetEventBoostPriority ... ) == 0x0 02722 644 NtSetEventBoostPriority ... ) == 0x0 02721 1440 NtSetEventBoostPriority ... ) == 0x0 02720 380 NtSetEventBoostPriority ... ) == 0x0 02719 624 NtSetEventBoostPriority ... ) == 0x0 02718 752 NtSetEventBoostPriority ... ) == 0x0 02717 776 NtSetEventBoostPriority ... ) == 0x0 02715 2020 NtSetEventBoostPriority ... ) == 0x0 02714 476 NtSetEventBoostPriority ... ) == 0x0 02712 868 NtSetEventBoostPriority ... ) == 0x0 02711 1252 NtSetEventBoostPriority ... ) == 0x0 02710 808 NtSetEventBoostPriority ... ) == 0x0 02782 1376 NtSetEventBoostPriority ... ) == 0x0 02781 1676 NtSetEventBoostPriority ... ) == 0x0 02780 1308 NtSetEventBoostPriority ... ) == 0x0 02778 1588 NtSetEventBoostPriority ... ) == 0x0 02777 1620 NtSetEventBoostPriority ... ) == 0x0 02776 1296 NtSetEventBoostPriority ... ) == 0x0 02775 440 NtSetEventBoostPriority ... ) == 0x0 02774 588 NtSetEventBoostPriority ... ) == 0x0 02772 248 NtSetEventBoostPriority ... ) == 0x0 02771 1884 NtSetEventBoostPriority ... ) == 0x0 02770 1324 NtSetEventBoostPriority ... ) == 0x0 02769 1776 NtSetEventBoostPriority ... ) == 0x0 02768 1708 NtSetEventBoostPriority ... ) == 0x0 02767 2036 NtSetEventBoostPriority ... ) == 0x0 02765 216 NtSetEventBoostPriority ... ) == 0x0 02748 928 NtSetEventBoostPriority ... ) == 0x0 02747 376 NtSetEventBoostPriority ... ) == 0x0 02716 192 NtSetEventBoostPriority ... ) == 0x0 02713 1484 NtSetEventBoostPriority ... ) == 0x0 02793 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75601, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75601, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0d\6\0\0\264\7\0\0" ... ... 02794 1404 NtAllocateVirtualMemory (-1, 1433600, 0, 4096, 4096, 4, ... 02795 1792 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02796 1104 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02797 784 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02798 1568 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02799 704 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02800 1368 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02801 1276 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02802 724 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02803 1436 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02804 2044 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02805 1652 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02806 152 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02807 1372 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02808 1600 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02809 1132 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02810 2040 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02811 596 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02812 188 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02813 1024 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02814 1064 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02815 1384 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02816 948 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02817 748 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02818 1300 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02819 428 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02820 120 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02821 1732 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02822 420 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02823 1168 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02824 1096 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02825 252 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02826 500 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02827 1180 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02828 384 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02829 1028 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02830 2016 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02831 2012 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02832 1716 NtWaitForSingleObject (284, 0, 0x0, ... 02833 520 NtWaitForSingleObject (284, 0, 0x0, ... 02834 740 NtWaitForSingleObject (284, 0, 0x0, ... 02835 1120 NtWaitForSingleObject (284, 0, 0x0, ... 02836 876 NtWaitForSingleObject (284, 0, 0x0, ... 02837 1612 NtWaitForSingleObject (284, 0, 0x0, ... 02838 940 NtWaitForSingleObject (284, 0, 0x0, ... 02839 896 NtWaitForSingleObject (284, 0, 0x0, ... 02840 1628 NtWaitForSingleObject (284, 0, 0x0, ... 02841 1624 NtWaitForSingleObject (284, 0, 0x0, ... 02842 1964 NtWaitForSingleObject (284, 0, 0x0, ... 02843 1316 NtWaitForSingleObject (284, 0, 0x0, ... 02844 1924 NtWaitForSingleObject (284, 0, 0x0, ... 02845 1516 NtSetEventBoostPriority (92, ... 02846 1288 NtWaitForSingleObject (284, 0, 0x0, ... 02847 1440 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 02848 644 NtWaitForSingleObject (284, 0, 0x0, ... 02849 380 NtWaitForSingleObject (340, 0, 0x0, ... 02850 624 NtWaitForSingleObject (284, 0, 0x0, ... 02851 752 NtWaitForSingleObject (284, 0, 0x0, ... 02852 2020 NtWaitForSingleObject (284, 0, 0x0, ... 02853 476 NtWaitForSingleObject (284, 0, 0x0, ... 02854 776 NtSetEventBoostPriority (340, ... 02855 868 NtWaitForSingleObject (284, 0, 0x0, ... 02856 808 NtWaitForSingleObject (284, 0, 0x0, ... 02857 1376 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02858 1676 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02859 1308 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02860 1588 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02861 1620 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02862 1296 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02863 440 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02864 588 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02865 248 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02866 1884 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02867 1324 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02868 1776 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02869 1708 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02870 2036 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02871 216 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02872 928 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02873 376 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 02874 192 NtWaitForSingleObject (284, 0, 0x0, ... 02875 1484 NtWaitForSingleObject (284, 0, 0x0, ... 02793 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75602, 0} ... {28, 56, reply, 0, 1636, 1736, 75602, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0d\6\0\0\264\7\0\0" ) ) == 0x0 02794 1404 NtAllocateVirtualMemory ... 1433600, 4096, ) == 0x0 02795 1792 NtCreateEvent ... 904, ) == 0x0 02876 1252 NtWaitForSingleObject (284, 0, 0x0, ... 02797 784 NtCreateEvent ... 908, ) == 0x0 02798 1568 NtCreateEvent ... 912, ) == 0x0 02799 704 NtCreateEvent ... 916, ) == 0x0 02800 1368 NtCreateEvent ... 920, ) == 0x0 02801 1276 NtCreateEvent ... 924, ) == 0x0 02802 724 NtCreateEvent ... 928, ) == 0x0 02803 1436 NtCreateEvent ... 932, ) == 0x0 02804 2044 NtCreateEvent ... 936, ) == 0x0 02805 1652 NtCreateEvent ... 940, ) == 0x0 02806 152 NtCreateEvent ... 944, ) == 0x0 02807 1372 NtCreateEvent ... 948, ) == 0x0 02808 1600 NtCreateEvent ... 952, ) == 0x0 02796 1104 NtCreateEvent ... 956, ) == 0x0 02810 2040 NtCreateEvent ... 960, ) == 0x0 02809 1132 NtCreateEvent ... 964, ) == 0x0 02812 188 NtCreateEvent ... 968, ) == 0x0 02813 1024 NtCreateEvent ... 972, ) == 0x0 02814 1064 NtCreateEvent ... 976, ) == 0x0 02815 1384 NtCreateEvent ... 980, ) == 0x0 02816 948 NtCreateEvent ... 984, ) == 0x0 02817 748 NtCreateEvent ... 988, ) == 0x0 02818 1300 NtCreateEvent ... 992, ) == 0x0 02819 428 NtCreateEvent ... 996, ) == 0x0 02820 120 NtCreateEvent ... 1000, ) == 0x0 02821 1732 NtCreateEvent ... 1004, ) == 0x0 02811 596 NtCreateEvent ... 1008, ) == 0x0 02823 1168 NtCreateEvent ... 1012, ) == 0x0 02824 1096 NtCreateEvent ... 1016, ) == 0x0 02825 252 NtCreateEvent ... 1020, ) == 0x0 02826 500 NtCreateEvent ... 1024, ) == 0x0 02827 1180 NtCreateEvent ... 1028, ) == 0x0 02828 384 NtCreateEvent ... 1032, ) == 0x0 02829 1028 NtCreateEvent ... 1036, ) == 0x0 02822 420 NtCreateEvent ... 1040, ) == 0x0 02831 2012 NtCreateEvent ... 1044, ) == 0x0 02830 2016 NtCreateEvent ... 1048, ) == 0x0 02702 1664 NtWaitForSingleObject ... ) == 0x0 02845 1516 NtSetEventBoostPriority ... ) == 0x0 02847 1440 NtDuplicateObject ... 1052, ) == 0x0 02644 312 NtWaitForSingleObject ... ) == 0x0 02854 776 NtSetEventBoostPriority ... ) == 0x0 02857 1376 NtCreateEvent ... 1056, ) == 0x0 02858 1676 NtCreateEvent ... 1060, ) == 0x0 02859 1308 NtCreateEvent ... 1064, ) == 0x0 02860 1588 NtCreateEvent ... 1068, ) == 0x0 02861 1620 NtCreateEvent ... 1072, ) == 0x0 02862 1296 NtCreateEvent ... 1076, ) == 0x0 02863 440 NtCreateEvent ... 1080, ) == 0x0 02864 588 NtCreateEvent ... 1084, ) == 0x0 02865 248 NtCreateEvent ... 1088, ) == 0x0 02866 1884 NtCreateEvent ... 1092, ) == 0x0 02867 1324 NtCreateEvent ... 1096, ) == 0x0 02868 1776 NtCreateEvent ... 1100, ) == 0x0 02869 1708 NtCreateEvent ... 1104, ) == 0x0 02870 2036 NtCreateEvent ... 1108, ) == 0x0 02871 216 NtCreateEvent ... 1112, ) == 0x0 02872 928 NtCreateEvent ... 1116, ) == 0x0 02873 376 NtCreateEvent ... 1120, ) == 0x0 02877 1736 NtResumeThread (896, ... 02878 1404 NtSetEventBoostPriority (284, ... 02879 1792 NtWaitForSingleObject (284, 0, 0x0, ... 02880 784 NtWaitForSingleObject (284, 0, 0x0, ... 02881 1568 NtWaitForSingleObject (284, 0, 0x0, ... 02882 704 NtWaitForSingleObject (284, 0, 0x0, ... 02883 1368 NtWaitForSingleObject (284, 0, 0x0, ... 02884 1276 NtWaitForSingleObject (284, 0, 0x0, ... 02885 724 NtWaitForSingleObject (284, 0, 0x0, ... 02886 1436 NtWaitForSingleObject (284, 0, 0x0, ... 02887 2044 NtWaitForSingleObject (284, 0, 0x0, ... 02888 1652 NtWaitForSingleObject (284, 0, 0x0, ... 02889 152 NtWaitForSingleObject (284, 0, 0x0, ... 02890 1372 NtWaitForSingleObject (284, 0, 0x0, ... 02891 1600 NtWaitForSingleObject (284, 0, 0x0, ... 02892 1104 NtWaitForSingleObject (284, 0, 0x0, ... 02893 2040 NtWaitForSingleObject (284, 0, 0x0, ... 02894 1132 NtWaitForSingleObject (284, 0, 0x0, ... 02895 188 NtWaitForSingleObject (284, 0, 0x0, ... 02896 1024 NtWaitForSingleObject (284, 0, 0x0, ... 02897 1064 NtWaitForSingleObject (284, 0, 0x0, ... 02898 1384 NtWaitForSingleObject (284, 0, 0x0, ... 02899 948 NtWaitForSingleObject (284, 0, 0x0, ... 02900 748 NtWaitForSingleObject (284, 0, 0x0, ... 02901 1300 NtWaitForSingleObject (284, 0, 0x0, ... 02902 428 NtWaitForSingleObject (284, 0, 0x0, ... 02903 120 NtWaitForSingleObject (284, 0, 0x0, ... 02904 1732 NtWaitForSingleObject (284, 0, 0x0, ... 02905 596 NtWaitForSingleObject (284, 0, 0x0, ... 02906 1168 NtWaitForSingleObject (284, 0, 0x0, ... 02907 1096 NtWaitForSingleObject (284, 0, 0x0, ... 02908 252 NtWaitForSingleObject (284, 0, 0x0, ... 02909 500 NtWaitForSingleObject (284, 0, 0x0, ... 02910 1180 NtWaitForSingleObject (284, 0, 0x0, ... 02911 384 NtWaitForSingleObject (284, 0, 0x0, ... 02912 1028 NtWaitForSingleObject (284, 0, 0x0, ... 02913 420 NtWaitForSingleObject (284, 0, 0x0, ... 02914 2012 NtWaitForSingleObject (284, 0, 0x0, ... 02915 1664 NtWaitForSingleObject (284, 0, 0x0, ... 02916 2016 NtWaitForSingleObject (284, 0, 0x0, ... 02917 1516 NtTestAlert (... 02918 312 NtWaitForSingleObject (284, 0, 0x0, ... 02919 1440 NtWaitForSingleObject (284, 0, 0x0, ... 02920 776 NtWaitForSingleObject (64, 0, {0, 0}, ... 02921 1376 NtWaitForSingleObject (284, 0, 0x0, ... 02922 1676 NtWaitForSingleObject (284, 0, 0x0, ... 02923 1308 NtWaitForSingleObject (284, 0, 0x0, ... 02924 1588 NtWaitForSingleObject (284, 0, 0x0, ... 02925 1620 NtWaitForSingleObject (284, 0, 0x0, ... 02926 1296 NtWaitForSingleObject (284, 0, 0x0, ... 02927 440 NtWaitForSingleObject (284, 0, 0x0, ... 02928 588 NtWaitForSingleObject (284, 0, 0x0, ... 02929 248 NtWaitForSingleObject (284, 0, 0x0, ... 02930 1884 NtWaitForSingleObject (284, 0, 0x0, ... 02931 1324 NtWaitForSingleObject (284, 0, 0x0, ... 02932 1776 NtWaitForSingleObject (284, 0, 0x0, ... 02933 1708 NtWaitForSingleObject (284, 0, 0x0, ... 02934 2036 NtWaitForSingleObject (284, 0, 0x0, ... 02935 216 NtWaitForSingleObject (284, 0, 0x0, ... 02936 928 NtWaitForSingleObject (284, 0, 0x0, ... 02877 1736 NtResumeThread ... 1, ) == 0x0 02832 1716 NtWaitForSingleObject ... ) == 0x0 02878 1404 NtSetEventBoostPriority ... ) == 0x0 02917 1516 NtTestAlert ... ) == 0x0 02920 776 NtWaitForSingleObject ... ) == 0x102 02937 1716 NtSetEventBoostPriority (284, ... 02938 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02939 1404 NtWaitForSingleObject (284, 0, 0x0, ... 02940 1516 NtContinue (100400432, 1, ... 02833 520 NtWaitForSingleObject ... ) == 0x0 02937 1716 NtSetEventBoostPriority ... ) == 0x0 02941 776 NtWaitForSingleObject (284, 0, 0x0, ... 02942 376 NtWaitForSingleObject (284, 0, 0x0, ... 02943 1972 NtWaitForSingleObject (92, 0, 0x0, ... 02944 520 NtSetEventBoostPriority (284, ... 02945 1516 NtRegisterThreadTerminatePort (24, ... 02946 1716 NtWaitForSingleObject (284, 0, 0x0, ... 02938 1736 NtAllocateVirtualMemory ... 102498304, 1048576, ) == 0x0 02835 1120 NtWaitForSingleObject ... ) == 0x0 02944 520 NtSetEventBoostPriority ... ) == 0x0 02945 1516 NtRegisterThreadTerminatePort ... ) == 0x0 02947 1120 NtSetEventBoostPriority (284, ... 02948 1736 NtAllocateVirtualMemory (-1, 103538688, 0, 8192, 4096, 4, ... 02949 520 NtWaitForSingleObject (284, 0, 0x0, ... 02836 876 NtWaitForSingleObject ... ) == 0x0 02947 1120 NtSetEventBoostPriority ... ) == 0x0 02950 1516 NtWaitForSingleObject (284, 0, 0x0, ... 02948 1736 NtAllocateVirtualMemory ... 103538688, 8192, ) == 0x0 02951 876 NtSetEventBoostPriority (284, ... 02952 1120 NtWaitForSingleObject (284, 0, 0x0, ... 02837 1612 NtWaitForSingleObject ... ) == 0x0 02951 876 NtSetEventBoostPriority ... ) == 0x0 02953 1736 NtProtectVirtualMemory (-1, (0x62be000), 4096, 260, ... 02954 1612 NtSetEventBoostPriority (284, ... 02955 876 NtWaitForSingleObject (284, 0, 0x0, ... 02838 940 NtWaitForSingleObject ... ) == 0x0 02954 1612 NtSetEventBoostPriority ... ) == 0x0 02953 1736 NtProtectVirtualMemory ... (0x62be000), 4096, 4, ) == 0x0 02956 940 NtSetEventBoostPriority (284, ... 02957 1612 NtWaitForSingleObject (284, 0, 0x0, ... 02834 740 NtWaitForSingleObject ... ) == 0x0 02956 940 NtSetEventBoostPriority ... ) == 0x0 02958 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02959 740 NtSetEventBoostPriority (284, ... 02960 940 NtWaitForSingleObject (284, 0, 0x0, ... 02840 1628 NtWaitForSingleObject ... ) == 0x0 02959 740 NtSetEventBoostPriority ... ) == 0x0 02958 1736 NtCreateThread ... 1124, {1636, 780}, ) == 0x0 02961 1628 NtSetEventBoostPriority (284, ... 02962 740 NtWaitForSingleObject (284, 0, 0x0, ... 02963 1736 NtQueryInformationThread (1124, Basic, 28, ... 02841 1624 NtWaitForSingleObject ... ) == 0x0 02961 1628 NtSetEventBoostPriority ... ) == 0x0 02964 1624 NtSetEventBoostPriority (284, ... 02963 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1636,Tid=780,}, 0x0, ) == 0x0 02842 1964 NtWaitForSingleObject ... ) == 0x0 02964 1624 NtSetEventBoostPriority ... ) == 0x0 02965 1628 NtWaitForSingleObject (284, 0, 0x0, ... 02966 1964 NtSetEventBoostPriority (284, ... 02967 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75602, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75602, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\4\0\0d\6\0\0\14\3\0\0" ... ... 02968 1624 NtWaitForSingleObject (284, 0, 0x0, ... 02843 1316 NtWaitForSingleObject ... ) == 0x0 02966 1964 NtSetEventBoostPriority ... ) == 0x0 02967 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75603, 0} ... {28, 56, reply, 0, 1636, 1736, 75603, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\4\0\0d\6\0\0\14\3\0\0" ) ) == 0x0 02969 1316 NtSetEventBoostPriority (284, ... 02970 1964 NtWaitForSingleObject (284, 0, 0x0, ... 02839 896 NtWaitForSingleObject ... ) == 0x0 02969 1316 NtSetEventBoostPriority ... ) == 0x0 02971 1736 NtResumeThread (1124, ... 02972 896 NtSetEventBoostPriority (284, ... 02973 1316 NtWaitForSingleObject (284, 0, 0x0, ... 02846 1288 NtWaitForSingleObject ... ) == 0x0 02971 1736 NtResumeThread ... 1, ) == 0x0 02972 896 NtSetEventBoostPriority ... ) == 0x0 02974 1288 NtSetEventBoostPriority (284, ... 02975 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 02976 896 NtWaitForSingleObject (284, 0, 0x0, ... 02844 1924 NtWaitForSingleObject ... ) == 0x0 02974 1288 NtSetEventBoostPriority ... ) == 0x0 02975 1736 NtAllocateVirtualMemory ... 103546880, 1048576, ) == 0x0 02977 1924 NtSetEventBoostPriority (284, ... 02978 1288 NtWaitForSingleObject (284, 0, 0x0, ... 02848 644 NtWaitForSingleObject ... ) == 0x0 02979 1736 NtAllocateVirtualMemory (-1, 104587264, 0, 8192, 4096, 4, ... 02977 1924 NtSetEventBoostPriority ... ) == 0x0 02980 780 NtWaitForSingleObject (92, 0, 0x0, ... 02981 644 NtSetEventBoostPriority (284, ... 02979 1736 NtAllocateVirtualMemory ... 104587264, 8192, ) == 0x0 02982 1924 NtWaitForSingleObject (284, 0, 0x0, ... 02850 624 NtWaitForSingleObject ... ) == 0x0 02981 644 NtSetEventBoostPriority ... ) == 0x0 02983 624 NtSetEventBoostPriority (284, ... 02851 752 NtWaitForSingleObject ... ) == 0x0 02984 752 NtSetEventBoostPriority (284, ... 02852 2020 NtWaitForSingleObject ... ) == 0x0 02985 2020 NtSetEventBoostPriority (284, ... 02855 868 NtWaitForSingleObject ... ) == 0x0 02986 868 NtSetEventBoostPriority (284, ... 02856 808 NtWaitForSingleObject ... ) == 0x0 02987 808 NtSetEventBoostPriority (284, ... 02874 192 NtWaitForSingleObject ... ) == 0x0 02988 192 NtSetEventBoostPriority (284, ... 02875 1484 NtWaitForSingleObject ... ) == 0x0 02989 1484 NtSetEventBoostPriority (284, ... 02876 1252 NtWaitForSingleObject ... ) == 0x0 02990 1252 NtAllocateVirtualMemory (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0 02991 1252 NtSetEventBoostPriority (284, ... 02989 1484 NtSetEventBoostPriority ... ) == 0x0 02988 192 NtSetEventBoostPriority ... ) == 0x0 02987 808 NtSetEventBoostPriority ... ) == 0x0 02986 868 NtSetEventBoostPriority ... ) == 0x0 02984 752 NtSetEventBoostPriority ... ) == 0x0 02983 624 NtSetEventBoostPriority ... ) == 0x0 02992 644 NtWaitForSingleObject (340, 0, 0x0, ... 02985 2020 NtSetEventBoostPriority ... ) == 0x0 02993 1736 NtProtectVirtualMemory (-1, (0x63be000), 4096, 260, ... 02853 476 NtWaitForSingleObject ... ) == 0x0 02991 1252 NtSetEventBoostPriority ... ) == 0x0 02994 1484 NtWaitForSingleObject (284, 0, 0x0, ... 02995 192 NtWaitForSingleObject (284, 0, 0x0, ... 02996 868 NtWaitForSingleObject (284, 0, 0x0, ... 02997 752 NtWaitForSingleObject (340, 0, 0x0, ... 02998 624 NtWaitForSingleObject (340, 0, 0x0, ... 02999 808 NtWaitForSingleObject (284, 0, 0x0, ... 03000 2020 NtAllocateVirtualMemory (-1, 14405632, 0, 4096, 4096, 260, ... 02993 1736 NtProtectVirtualMemory ... (0x63be000), 4096, 4, ) == 0x0 03001 476 NtSetEventBoostPriority (284, ... 03002 1252 NtWaitForSingleObject (284, 0, 0x0, ... 03000 2020 NtAllocateVirtualMemory ... 14405632, 4096, ) == 0x0 03003 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02879 1792 NtWaitForSingleObject ... ) == 0x0 03001 476 NtSetEventBoostPriority ... ) == 0x0 03003 1736 NtCreateThread ... 1128, {1636, 1656}, ) == 0x0 03004 1792 NtSetEventBoostPriority (284, ... 03005 476 NtWaitForSingleObject (284, 0, 0x0, ... 03006 1736 NtQueryInformationThread (1128, Basic, 28, ... 02880 784 NtWaitForSingleObject ... ) == 0x0 03004 1792 NtSetEventBoostPriority ... ) == 0x0 03007 784 NtSetEventBoostPriority (284, ... 03006 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1636,Tid=1656,}, 0x0, ) == 0x0 03008 2020 NtWaitForSingleObject (284, 0, 0x0, ... 02881 1568 NtWaitForSingleObject ... ) == 0x0 03007 784 NtSetEventBoostPriority ... ) == 0x0 03009 1792 NtWaitForSingleObject (284, 0, 0x0, ... 03010 1568 NtSetEventBoostPriority (284, ... 03011 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75603, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75603, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\4\0\0d\6\0\0x\6\0\0" ... ... 02882 704 NtWaitForSingleObject ... ) == 0x0 03010 1568 NtSetEventBoostPriority ... ) == 0x0 03012 704 NtSetEventBoostPriority (284, ... 03011 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75604, 0} ... {28, 56, reply, 0, 1636, 1736, 75604, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\4\0\0d\6\0\0x\6\0\0" ) ) == 0x0 03013 784 NtWaitForSingleObject (284, 0, 0x0, ... 02883 1368 NtWaitForSingleObject ... ) == 0x0 03012 704 NtSetEventBoostPriority ... ) == 0x0 03014 1736 NtResumeThread (1128, ... 03015 1368 NtSetEventBoostPriority (284, ... 03016 1568 NtWaitForSingleObject (284, 0, 0x0, ... 02884 1276 NtWaitForSingleObject ... ) == 0x0 03015 1368 NtSetEventBoostPriority ... ) == 0x0 03014 1736 NtResumeThread ... 1, ) == 0x0 03017 1276 NtSetEventBoostPriority (284, ... 03018 704 NtWaitForSingleObject (284, 0, 0x0, ... 03019 1656 NtWaitForSingleObject (92, 0, 0x0, ... 02885 724 NtWaitForSingleObject ... ) == 0x0 03017 1276 NtSetEventBoostPriority ... ) == 0x0 03020 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 03021 724 NtSetEventBoostPriority (284, ... 03022 1368 NtWaitForSingleObject (284, 0, 0x0, ... 03023 1276 NtWaitForSingleObject (284, 0, 0x0, ... 02886 1436 NtWaitForSingleObject ... ) == 0x0 03021 724 NtSetEventBoostPriority ... ) == 0x0 03024 1436 NtSetEventBoostPriority (284, ... 03020 1736 NtAllocateVirtualMemory ... 104595456, 1048576, ) == 0x0 02887 2044 NtWaitForSingleObject ... ) == 0x0 03024 1436 NtSetEventBoostPriority ... ) == 0x0 03025 2044 NtSetEventBoostPriority (284, ... 03026 1736 NtAllocateVirtualMemory (-1, 105635840, 0, 8192, 4096, 4, ... 03027 724 NtWaitForSingleObject (284, 0, 0x0, ... 02888 1652 NtWaitForSingleObject ... ) == 0x0 03025 2044 NtSetEventBoostPriority ... ) == 0x0 03026 1736 NtAllocateVirtualMemory ... 105635840, 8192, ) == 0x0 03028 1652 NtSetEventBoostPriority (284, ... 03029 1436 NtWaitForSingleObject (284, 0, 0x0, ... 02889 152 NtWaitForSingleObject ... ) == 0x0 03028 1652 NtSetEventBoostPriority ... ) == 0x0 03030 1736 NtProtectVirtualMemory (-1, (0x64be000), 4096, 260, ... 03031 152 NtSetEventBoostPriority (284, ... 03032 2044 NtWaitForSingleObject (284, 0, 0x0, ... 02890 1372 NtWaitForSingleObject ... ) == 0x0 03031 152 NtSetEventBoostPriority ... ) == 0x0 03030 1736 NtProtectVirtualMemory ... (0x64be000), 4096, 4, ) == 0x0 03033 1372 NtSetEventBoostPriority (284, ... 03034 1652 NtWaitForSingleObject (284, 0, 0x0, ... 02891 1600 NtWaitForSingleObject ... ) == 0x0 03033 1372 NtSetEventBoostPriority ... ) == 0x0 03035 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 03036 1600 NtSetEventBoostPriority (284, ... 03037 152 NtWaitForSingleObject (284, 0, 0x0, ... 03038 1372 NtWaitForSingleObject (284, 0, 0x0, ... 02892 1104 NtWaitForSingleObject ... ) == 0x0 03036 1600 NtSetEventBoostPriority ... ) == 0x0 03039 1104 NtSetEventBoostPriority (284, ... 03035 1736 NtCreateThread ... 1132, {1636, 1248}, ) == 0x0 02893 2040 NtWaitForSingleObject ... ) == 0x0 03039 1104 NtSetEventBoostPriority ... ) == 0x0 03040 2040 NtSetEventBoostPriority (284, ... 03041 1736 NtQueryInformationThread (1132, Basic, 28, ... 03042 1600 NtWaitForSingleObject (284, 0, 0x0, ... 02894 1132 NtWaitForSingleObject ... ) == 0x0 03040 2040 NtSetEventBoostPriority ... ) == 0x0 03041 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1636,Tid=1248,}, 0x0, ) == 0x0 03043 1132 NtSetEventBoostPriority (284, ... 03044 1104 NtWaitForSingleObject (284, 0, 0x0, ... 02895 188 NtWaitForSingleObject ... ) == 0x0 03043 1132 NtSetEventBoostPriority ... ) == 0x0 03045 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75604, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75604, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\4\0\0d\6\0\0\340\4\0\0" ... ... 03046 188 NtSetEventBoostPriority (284, ... 03047 2040 NtWaitForSingleObject (284, 0, 0x0, ... 02896 1024 NtWaitForSingleObject ... ) == 0x0 03046 188 NtSetEventBoostPriority ... ) == 0x0 03045 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75605, 0} ... {28, 56, reply, 0, 1636, 1736, 75605, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\4\0\0d\6\0\0\340\4\0\0" ) ) == 0x0 03048 1024 NtSetEventBoostPriority (284, ... 03049 1132 NtWaitForSingleObject (284, 0, 0x0, ... 03050 188 NtWaitForSingleObject (284, 0, 0x0, ... 02897 1064 NtWaitForSingleObject ... ) == 0x0 03048 1024 NtSetEventBoostPriority ... ) == 0x0 03051 1064 NtSetEventBoostPriority (284, ... 03052 1736 NtResumeThread (1132, ... 02898 1384 NtWaitForSingleObject ... ) == 0x0 03051 1064 NtSetEventBoostPriority ... ) == 0x0 03053 1384 NtSetEventBoostPriority (284, ... 03052 1736 NtResumeThread ... 1, ) == 0x0 03054 1024 NtWaitForSingleObject (284, 0, 0x0, ... 02899 948 NtWaitForSingleObject ... ) == 0x0 03053 1384 NtSetEventBoostPriority ... ) == 0x0 03055 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 03056 948 NtSetEventBoostPriority (284, ... 03057 1064 NtWaitForSingleObject (284, 0, 0x0, ... 03058 1248 NtWaitForSingleObject (92, 0, 0x0, ... 02900 748 NtWaitForSingleObject ... ) == 0x0 03056 948 NtSetEventBoostPriority ... ) == 0x0 03055 1736 NtAllocateVirtualMemory ... 105644032, 1048576, ) == 0x0 03059 748 NtSetEventBoostPriority (284, ... 03060 1384 NtWaitForSingleObject (284, 0, 0x0, ... 02901 1300 NtWaitForSingleObject ... ) == 0x0 03059 748 NtSetEventBoostPriority ... ) == 0x0 03061 1736 NtAllocateVirtualMemory (-1, 106684416, 0, 8192, 4096, 4, ... 03062 1300 NtSetEventBoostPriority (284, ... 03063 948 NtWaitForSingleObject (284, 0, 0x0, ... 02902 428 NtWaitForSingleObject ... ) == 0x0 03062 1300 NtSetEventBoostPriority ... ) == 0x0 03061 1736 NtAllocateVirtualMemory ... 106684416, 8192, ) == 0x0 03064 428 NtSetEventBoostPriority (284, ... 03065 748 NtWaitForSingleObject (284, 0, 0x0, ... 03066 1300 NtWaitForSingleObject (284, 0, 0x0, ... 02903 120 NtWaitForSingleObject ... ) == 0x0 03064 428 NtSetEventBoostPriority ... ) == 0x0 03067 120 NtSetEventBoostPriority (284, ... 03068 1736 NtProtectVirtualMemory (-1, (0x65be000), 4096, 260, ... 02904 1732 NtWaitForSingleObject ... ) == 0x0 03067 120 NtSetEventBoostPriority ... ) == 0x0 03069 1732 NtSetEventBoostPriority (284, ... 03068 1736 NtProtectVirtualMemory ... (0x65be000), 4096, 4, ) == 0x0 03070 428 NtWaitForSingleObject (284, 0, 0x0, ... 02905 596 NtWaitForSingleObject ... ) == 0x0 03069 1732 NtSetEventBoostPriority ... ) == 0x0 03071 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 03072 596 NtSetEventBoostPriority (284, ... 03073 120 NtWaitForSingleObject (284, 0, 0x0, ... 02906 1168 NtWaitForSingleObject ... ) == 0x0 03072 596 NtSetEventBoostPriority ... ) == 0x0 03071 1736 NtCreateThread ... 1136, {1636, 1036}, ) == 0x0 03074 1168 NtSetEventBoostPriority (284, ... 03075 1732 NtWaitForSingleObject (284, 0, 0x0, ... 02907 1096 NtWaitForSingleObject ... ) == 0x0 03074 1168 NtSetEventBoostPriority ... ) == 0x0 03076 1736 NtQueryInformationThread (1136, Basic, 28, ... 03077 1096 NtSetEventBoostPriority (284, ... 03078 596 NtWaitForSingleObject (284, 0, 0x0, ... 02908 252 NtWaitForSingleObject ... ) == 0x0 03077 1096 NtSetEventBoostPriority ... ) == 0x0 03076 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1636,Tid=1036,}, 0x0, ) == 0x0 03079 252 NtSetEventBoostPriority (284, ... 03080 1168 NtWaitForSingleObject (284, 0, 0x0, ... 03081 1096 NtWaitForSingleObject (284, 0, 0x0, ... 02909 500 NtWaitForSingleObject ... ) == 0x0 03079 252 NtSetEventBoostPriority ... ) == 0x0 03082 500 NtSetEventBoostPriority (284, ... 03083 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75605, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75605, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\4\0\0d\6\0\0\14\4\0\0" ... ... 02910 1180 NtWaitForSingleObject ... ) == 0x0 03082 500 NtSetEventBoostPriority ... ) == 0x0 03084 1180 NtSetEventBoostPriority (284, ... 03083 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75606, 0} ... {28, 56, reply, 0, 1636, 1736, 75606, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\4\0\0d\6\0\0\14\4\0\0" ) ) == 0x0 03085 252 NtWaitForSingleObject (284, 0, 0x0, ... 02911 384 NtWaitForSingleObject ... ) == 0x0 03084 1180 NtSetEventBoostPriority ... ) == 0x0 03086 1736 NtResumeThread (1136, ... 03087 384 NtSetEventBoostPriority (284, ... 03088 500 NtWaitForSingleObject (284, 0, 0x0, ... 02912 1028 NtWaitForSingleObject ... ) == 0x0 03087 384 NtSetEventBoostPriority ... ) == 0x0 03086 1736 NtResumeThread ... 1, ) == 0x0 03089 1028 NtSetEventBoostPriority (284, ... 03090 1180 NtWaitForSingleObject (284, 0, 0x0, ... 03091 1036 NtWaitForSingleObject (92, 0, 0x0, ... 02913 420 NtWaitForSingleObject ... ) == 0x0 03089 1028 NtSetEventBoostPriority ... ) == 0x0 03092 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 03093 420 NtSetEventBoostPriority (284, ... 03094 384 NtWaitForSingleObject (284, 0, 0x0, ... 03095 1028 NtWaitForSingleObject (284, 0, 0x0, ... 02915 1664 NtWaitForSingleObject ... ) == 0x0 03093 420 NtSetEventBoostPriority ... ) == 0x0 03096 1664 NtSetEventBoostPriority (284, ... 03092 1736 NtAllocateVirtualMemory ... 106692608, 1048576, ) == 0x0 02914 2012 NtWaitForSingleObject ... ) == 0x0 03096 1664 NtSetEventBoostPriority ... ) == 0x0 03097 2012 NtSetEventBoostPriority (284, ... 03098 1736 NtAllocateVirtualMemory (-1, 107732992, 0, 8192, 4096, 4, ... 03099 420 NtWaitForSingleObject (284, 0, 0x0, ... 02916 2016 NtWaitForSingleObject ... ) == 0x0 03097 2012 NtSetEventBoostPriority ... ) == 0x0 03098 1736 NtAllocateVirtualMemory ... 107732992, 8192, ) == 0x0 03100 2016 NtSetEventBoostPriority (284, ... 03101 1664 NtSetEventBoostPriority (92, ... 02918 312 NtWaitForSingleObject ... ) == 0x0 03100 2016 NtSetEventBoostPriority ... ) == 0x0 03102 1736 NtProtectVirtualMemory (-1, (0x66be000), 4096, 260, ... 03103 312 NtSetEventBoostPriority (284, ... 02943 1972 NtWaitForSingleObject ... ) == 0x0 03101 1664 NtSetEventBoostPriority ... ) == 0x0 03104 2012 NtWaitForSingleObject (284, 0, 0x0, ... 02919 1440 NtWaitForSingleObject ... ) == 0x0 03105 1972 NtWaitForSingleObject (284, 0, 0x0, ... 03103 312 NtSetEventBoostPriority ... ) == 0x0 03102 1736 NtProtectVirtualMemory ... (0x66be000), 4096, 4, ) == 0x0 03106 1664 NtTestAlert (... 03107 1440 NtSetEventBoostPriority (284, ... 03108 2016 NtWaitForSingleObject (284, 0, 0x0, ... 03109 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 02921 1376 NtWaitForSingleObject ... ) == 0x0 03107 1440 NtSetEventBoostPriority ... ) == 0x0 03106 1664 NtTestAlert ... ) == 0x0 03110 312 NtSetEventBoostPriority (340, ... 03111 1376 NtSetEventBoostPriority (284, ... 03109 1736 NtCreateThread ... 1140, {1636, 760}, ) == 0x0 03112 1664 NtContinue (101449008, 1, ... 02922 1676 NtWaitForSingleObject ... ) == 0x0 03111 1376 NtSetEventBoostPriority ... ) == 0x0 02645 1124 NtWaitForSingleObject ... ) == 0x0 03110 312 NtSetEventBoostPriority ... ) == 0x0 03113 1736 NtQueryInformationThread (1140, Basic, 28, ... 03114 1676 NtSetEventBoostPriority (284, ... 03115 1664 NtRegisterThreadTerminatePort (24, ... 03116 1124 NtWaitForSingleObject (284, 0, 0x0, ... 03117 1376 NtWaitForSingleObject (284, 0, 0x0, ... 03118 312 NtWaitForSingleObject (64, 0, {0, 0}, ... 02923 1308 NtWaitForSingleObject ... ) == 0x0 03114 1676 NtSetEventBoostPriority ... ) == 0x0 03113 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1636,Tid=760,}, 0x0, ) == 0x0 03119 1440 NtWaitForSingleObject (340, 0, 0x0, ... 03115 1664 NtRegisterThreadTerminatePort ... ) == 0x0 03120 1308 NtSetEventBoostPriority (284, ... 03118 312 NtWaitForSingleObject ... ) == 0x102 03121 1676 NtWaitForSingleObject (284, 0, 0x0, ... 03122 1736 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1636, 1736, 75606, 0} (24, {28, 56, new_msg, 0, 1636, 1736, 75606, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\4\0\0d\6\0\0\370\2\0\0" ... ... 02924 1588 NtWaitForSingleObject ... ) == 0x0 03120 1308 NtSetEventBoostPriority ... ) == 0x0 03123 1664 NtWaitForSingleObject (284, 0, 0x0, ... 03124 312 NtWaitForSingleObject (128, 0, 0x0, ... 03125 1588 NtSetEventBoostPriority (284, ... 03122 1736 NtRequestWaitReplyPort ... {28, 56, reply, 0, 1636, 1736, 75607, 0} ... {28, 56, reply, 0, 1636, 1736, 75607, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\4\0\0d\6\0\0\370\2\0\0" ) ) == 0x0 03126 1308 NtWaitForSingleObject (284, 0, 0x0, ... 02925 1620 NtWaitForSingleObject ... ) == 0x0 03125 1588 NtSetEventBoostPriority ... ) == 0x0 03127 1736 NtResumeThread (1140, ... 03128 1620 NtSetEventBoostPriority (284, ... 03129 1588 NtWaitForSingleObject (284, 0, 0x0, ... 02926 1296 NtWaitForSingleObject ... ) == 0x0 03128 1620 NtSetEventBoostPriority ... ) == 0x0 03127 1736 NtResumeThread ... 1, ) == 0x0 03130 1296 NtSetEventBoostPriority (284, ... 03131 1620 NtWaitForSingleObject (284, 0, 0x0, ... 02927 440 NtWaitForSingleObject ... ) == 0x0 03130 1296 NtSetEventBoostPriority ... ) == 0x0 03132 1736 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 03133 760 NtWaitForSingleObject (92, 0, 0x0, ... 03134 440 NtSetEventBoostPriority (284, ... 03135 1296 NtWaitForSingleObject (284, 0, 0x0, ... 03132 1736 NtAllocateVirtualMemory ... 107741184, 1048576, ) == 0x0 02928 588 NtWaitForSingleObject ... ) == 0x0 03134 440 NtSetEventBoostPriority ... ) == 0x0 03136 588 NtSetEventBoostPriority (284, ... 03137 1736 NtAllocateVirtualMemory (-1, 108781568, 0, 8192, 4096, 4, ... 02929 248 NtWaitForSingleObject ... ) == 0x0 03136 588 NtSetEventBoostPriority ... ) == 0x0 03138 440 NtWaitForSingleObject (284, 0, 0x0, ... 03139 248 NtSetEventBoostPriority (284, ... 03137 1736 NtAllocateVirtualMemory ... 108781568, 8192, ) == 0x0 03140 588 NtWaitForSingleObject (284, 0, 0x0, ... 02930 1884 NtWaitForSingleObject ... ) == 0x0 03139 248 NtSetEventBoostPriority ... ) == 0x0 03141 1736 NtProtectVirtualMemory (-1, (0x67be000), 4096, 260, ... 03142 1884 NtSetEventBoostPriority (284, ... 03143 248 NtWaitForSingleObject (284, 0, 0x0, ... 02931 1324 NtWaitForSingleObject ... ) == 0x0 03142 1884 NtSetEventBoostPriority ... ) == 0x0 03141 1736 NtProtectVirtualMemory ... (0x67be000), 4096, 4, ) == 0x0 03144 1324 NtSetEventBoostPriority (284, ... 03145 1884 NtWaitForSingleObject (284, 0, 0x0, ... 02932 1776 NtWaitForSingleObject ... ) == 0x0 03144 1324 NtSetEventBoostPriority ... ) == 0x0 03146 1736 NtCreateThread (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 03147 1776 NtSetEventBoostPriority (284, ... 03148 1324 NtWaitForSingleObject (284, 0, 0x0, ... 02933 1708 NtWaitForSingleObject ... ) == 0x0 03147 1776 NtSetEventBoostPriority ... ) == 0x0 03146 1736 NtCreateThread ... 1144, {1636, 860}, ) == 0x0 03149 1708 NtSetEventBoostPriority (284, ... 03150 1776 NtWaitForSingleObject (284, 0, 0x0, ... 02934 2036 NtWaitForSingleObject ... ) == 0x0 03149 1708 NtSetEventBoostPriority ... ) == 0x0 03151 1736 NtQueryInformationThread (1144, Basic, 28, ... 03152 2036 NtSetEventBoostPriority (284, ... 03153 1708 NtWaitForSingleObject (284, 0, 0x0, ... 02935 216 NtWaitForSingleObject ... ) == 0x0 03152 2036 NtSetEventBoostPriority ... ) == 0x0 03151 1736 NtQueryInformationThread ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1636,Tid=860,}, 0x0, ) == 0x0 03154 216 NtSetEventBoostPriority (284, ... 03155 2036 NtWaitForSingleObject (284, 0, 0x0, ...