Summary:


NtCallbackReturn(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtUnmapViewOfSection(>) 
 8 
NtOpenKey(>) 
 102 

NtGdiCreateBitmap(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtQueryVirtualMemory(>) 
 9 
NtContinue(>) 
 107 

NtGdiInit(>) 
 1 
NtQueryPerformanceCounter(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 
NtQuerySystemInformation(>) 
 119 

NtGdiQueryFontAssocInfo(>) 
 1 
NtQuerySystemTime(>) 
 2 
NtOpenThreadToken(>) 
 10 
NtQueryInformationThread(>) 
 175 

NtGdiSelectBitmap(>) 
 1 
NtSetInformationObject(>) 
 2 
NtSetInformationFile(>) 
 10 
NtResumeThread(>) 
 178 

NtOpenKeyedEvent(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtQuerySection(>) 
 11 
NtCreateThread(>) 
 185 

NtOpenSymbolicLinkObject(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtTestAlert(>) 
 202 

NtQueryObject(>) 
 1 
NtReadFile(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtRegisterThreadTerminatePort(>) 
 204 

NtQuerySymbolicLinkObject(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtCreateFile(>) 
 15 
NtDuplicateObject(>) 
 207 

NtRaiseException(>) 
 1 
NtCreateIoCompletion(>) 
 4 
NtSetValueKey(>) 
 16 
NtRequestWaitReplyPort(>) 
 209 

NtSetInformationProcess(>) 
 1 
NtWriteFile(>) 
 4 
NtCreateKey(>) 
 17 
NtQueryValueKey(>) 
 224 

NtUserCallNoParam(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtOpenFile(>) 
 20 
NtProtectVirtualMemory(>) 
 268 

NtUserGetThreadDesktop(>) 
 1 
NtQueryInformationToken(>) 
 5 
NtOpenSection(>) 
 21 
NtClose(>) 
 291 

NtCreateMutant(>) 
 2 
NtConnectPort(>) 
 6 
NtQueryAttributesFile(>) 
 30 
NtAllocateVirtualMemory(>) 
 461 

NtGdiCreateSolidBrush(>) 
 2 
NtQueryVolumeInformationFile(>) 
 6 
NtMapViewOfSection(>) 
 33 
NtSetEventBoostPriority(>) 
 595 

NtNotifyChangeKey(>) 
 2 
NtFsControlFile(>) 
 8 
NtDeviceIoControlFile(>) 
 36 
NtWaitForSingleObject(>) 
 914 

NtOpenDirectoryObject(>) 
 2 
NtQueryInformationFile(>) 
 8 
NtFlushInstructionCache(>) 
 45 

NtOpenProcessToken(>) 
 2 
NtQueryInformationProcess(>) 
 8 
NtCreateEvent(>) 
 63 

NtOpenProcessTokenEx(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482748, {status=0x0, info=1}, ) }, 0, 32, ... -2147482748, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482748, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482748, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482748, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482748, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482748, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482748, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482748, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482748, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482748, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482748, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482748, 0, 0x0, 0x0, 0x90120,  (-2147482748, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147481484, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147481484, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147481484, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147481484, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147481484, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00037   896   NtClose  (-2147482104, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147481628, ) == 0x0
 00053   896   NtClose  (-2147481628, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147482760, ) == 0x0
 00055   896   NtClose  (-2147482760, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147482764, ) == 0x0
 00057   896   NtClose  (-2147482764, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00059   896   NtClose  (-2147482688, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482136, ) == 0x0
 00061   896   NtClose  (-2147482136, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482136, ... -2147481480, ) == 0x0
 00063   896   NtClose  (-2147481480, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481480, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147481484, ... ) == 0x0
 00093   896   NtClose  (-2147482104, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147481628, ... ) == 0x0
 00102   896   NtClose  (-2147482760, ... ) == 0x0
 00103   896   NtClose  (-2147482764, ... ) == 0x0
 00104   896   NtClose  (-2147482688, ... ) == 0x0
 00105   896   NtClose  (-2147482136, ... ) == 0x0
 00106   896   NtClose  (-2147481480, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481480, ) == 0x0
 00145   896   NtClose  (-2147481480, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481480, ... -2147482136, ) == 0x0
 00147   896   NtClose  (-2147482136, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482136, ... -2147482688, ) == 0x0
 00149   896   NtClose  (-2147482688, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482688, ... -2147482764, ) == 0x0
 00151   896   NtClose  (-2147482764, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482764, ... -2147482760, ) == 0x0
 00153   896   NtClose  (-2147482760, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147481628, ) == 0x0
 00155   896   NtClose  (-2147481628, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481480, ... ) == 0x0
 00178   896   NtClose  (-2147482136, ... ) == 0x0
 00179   896   NtClose  (-2147482688, ... ) == 0x0
 00180   896   NtClose  (-2147482764, ... ) == 0x0
 00181   896   NtClose  (-2147482760, ... ) == 0x0
 00182   896   NtClose  (-2147481628, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482748, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81842, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81842, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81842, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 94224, 4, ... (0x409000), 98304, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 98304, 128, ... (0x409000), 98304, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 94224, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x419010,}, 4, ... ) == 0x0
 00260   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00261   896   NtContinue  (1244400, 0, ...
 00262   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3276800, 4096, ) == 0x0
 00263   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00264   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtClose  (16, ... ) == 0x0
 00266   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00267   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00268   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00269   896   NtClose  (16, ... ) == 0x0
 00270   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00271   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00272   896   NtClose  (16, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00276   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00277   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00278   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00287   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00291   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00294   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00295   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00296   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00297   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00298   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00299   896   NtClose  (16, ... ) == 0x0
 00300   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00301   896   NtClose  (28, ... ) == 0x0
 00302   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00303   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00304   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00305   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00306   896   NtClose  (28, ... ) == 0x0
 00307   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00308   896   NtClose  (16, ... ) == 0x0
 00309   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00310   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00311   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00312   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00313   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00314   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00315   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00316   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00318   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00319   896   NtClose  (36, ... ) == 0x0
 00320   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00321   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00322   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00323   896   NtClose  (36, ... ) == 0x0
 00324   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   896   NtClose  (32, ... ) == 0x0
 00326   896   NtClose  (16, ... ) == 0x0
 00327   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00328   896   NtClose  (28, ... ) == 0x0
 00329   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00330   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00331   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00332   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00333   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00334   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00335   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00336   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00337   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00338   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00339   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00340   896   NtClose  (28, ... ) == 0x0
 00341   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00342   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00343   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00344   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00345   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00346   896   NtClose  (28, ... ) == 0x0
 00347   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00348   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00349   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00350   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00351   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00352   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00353   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00355   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00356   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00358   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00359   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00360   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00362   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00364   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00365   896   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00366   896   NtClose  (28, ... ) == 0x0
 00367   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00368   896   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00369   896   NtClose  (28, ... ) == 0x0
 00370   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00371   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00372   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00373   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00374   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00375   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00376   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00377   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00378   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00379   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00380   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 16, ) }, ... 16, ) == 0x0
 00381   896   NtQueryValueKey  (16,  (16, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   896   NtClose  (16, ... ) == 0x0
 00383   896   NtMapViewOfSection  (-2147482748, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x430000), 0x0, 1060864, ) == 0x0
 00384   896   NtClose  (-2147482748, ... ) == 0x0
 00385   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 16, ) == 0x0
 00386   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00387   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482748, ) == 0x0
 00388   896   NtQueryInformationToken  (-2147482748, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00389   896   NtQueryInformationToken  (-2147482748, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00390   896   NtClose  (-2147482748, ... ) == 0x0
 00391   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5505024, 4096, ) == 0x0
 00392   896   NtFreeVirtualMemory  (-1, (0x540000), 4096, 32768, ... (0x540000), 4096, ) == 0x0
 00393   896   NtDuplicateObject  (-1, 32, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00394   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00395   896   NtQueryValueKey  (-2147482748,  (-2147482748, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00396   896   NtClose  (-2147482748, ... ) == 0x0
 00397   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00398   896   NtQueryValueKey  (-2147482748,  (-2147482748, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00399   896   NtClose  (-2147482748, ... ) == 0x0
 00400   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00401   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00402   896   NtUserCallNoParam  (24, ... ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  (0, ...
 00404   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5505024, 4096, ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00405   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00406   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00407   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00408   896   NtGdiCreateSolidBrush  (0, 0, ...
 00409   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8716288, 4096, ) == 0x0
 00408   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00410   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00411   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00412   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00413   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00414   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00415   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00416   896   NtClose  (44, ... ) == 0x0
 00417   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00418   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00419   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00420   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00421   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00422   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00423   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00424   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00425   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00426   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00427   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00428   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00429   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00430   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00431   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00432   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00433   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00434   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00435   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00436   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00437   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00438   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00439   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00440   896   NtCallbackReturn  (0, 0, 0, ...
 00441   896   NtGdiInit  (... ) == 0x1
 00442   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00443   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00444   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 8781824, 28672, ) == 0x0
 00445   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00447   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00448   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00449   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 48, ) == 0x0
 00450   896   NtQuerySection  (48, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00451   896   NtClose  (44, ... ) == 0x0
 00452   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00453   896   NtClose  (48, ... ) == 0x0
 00454   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 48, ) }, ... 48, ) == 0x0
 00455   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00456   896   NtClose  (48, ... ) == 0x0
 00457   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00458   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00459   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00460   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00461   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00462   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00463   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00465   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00466   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 48, {status=0x0, info=1}, ) }, 5, 96, ... 48, {status=0x0, info=1}, ) == 0x0
 00467   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 48, ... 44, ) == 0x0
 00468   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00469   896   NtClose  (48, ... ) == 0x0
 00470   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00471   896   NtClose  (44, ... ) == 0x0
 00472   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00473   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00474   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00475   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00476   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00477   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00478   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00479   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00480   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8847360, 65536, ) == 0x0
 00481   896   NtAllocateVirtualMemory  (-1, 8847360, 0, 4096, 4096, 4, ... 8847360, 4096, ) == 0x0
 00482   896   NtAllocateVirtualMemory  (-1, 8851456, 0, 8192, 4096, 4, ... 8851456, 8192, ) == 0x0
 00483   896   NtAllocateVirtualMemory  (-1, 8859648, 0, 4096, 4096, 4, ... 8859648, 4096, ) == 0x0
 00484   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00485   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x880000), 0x0, 12288, ) == 0x0
 00486   896   NtClose  (44, ... ) == 0x0
 00487   896   NtAllocateVirtualMemory  (-1, 8863744, 0, 4096, 4096, 4, ... 8863744, 4096, ) == 0x0
 00488   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00489   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00490   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00491   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00492   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00493   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00495   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00496   896   NtFreeVirtualMemory  (-1, (0x860000), 0, 32768, ... (0x860000), 28672, ) == 0x0
 00497   896   NtFreeVirtualMemory  (-1, (0x320144), 0, 32768, ... (0x320000), 4096, ) == 0x0
 00498   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00499   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00500   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00501   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 20480, 4096, 4, ... 3280896, 20480, ) == 0x0
 00502   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8978432, 1048576, ) == 0x0
 00503   896   NtAllocateVirtualMemory  (-1, 8978432, 0, 32768, 4096, 4, ... 8978432, 32768, ) == 0x0
 00504   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00505   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "Jobaka3"}, 0, ... 48, ) }, 0, ... 48, ) == 0x0
 00506   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00507   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00508   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00509   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00510   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Protocol_Catalog9"}, ... 60, ) }, ... 60, ) == 0x0
 00511   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00512   896   NtNotifyChangeKey  (60, 56, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00513   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00514   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00515   896   NtQueryValueKey  (60,  (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 00516   896   NtQueryValueKey  (60,  (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 00517   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Catalog_Entries"}, ... 64, ) }, ... 64, ) == 0x0
 00518   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00519   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000001"}, ... 68, ) }, ... 68, ) == 0x0
 00520   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00521   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00522   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00523   896   NtClose  (68, ... ) == 0x0
 00524   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000002"}, ... 68, ) }, ... 68, ) == 0x0
 00525   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00526   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00527   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00528   896   NtClose  (68, ... ) == 0x0
 00529   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000003"}, ... 68, ) }, ... 68, ) == 0x0
 00530   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00531   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00532   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00533   896   NtClose  (68, ... ) == 0x0
 00534   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000004"}, ... 68, ) }, ... 68, ) == 0x0
 00535   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00536   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00537   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00538   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00539   896   NtClose  (68, ... ) == 0x0
 00540   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000005"}, ... 68, ) }, ... 68, ) == 0x0
 00541   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00542   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00543   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00544   896   NtClose  (68, ... ) == 0x0
 00545   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000006"}, ... 68, ) }, ... 68, ) == 0x0
 00546   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00547   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00548   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00549   896   NtClose  (68, ... ) == 0x0
 00550   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000007"}, ... 68, ) }, ... 68, ) == 0x0
 00551   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00552   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00553   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00554   896   NtClose  (68, ... ) == 0x0
 00555   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000008"}, ... 68, ) }, ... 68, ) == 0x0
 00556   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00557   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00558   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00559   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00560   896   NtClose  (68, ... ) == 0x0
 00561   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000009"}, ... 68, ) }, ... 68, ) == 0x0
 00562   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00563   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00564   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00565   896   NtClose  (68, ... ) == 0x0
 00566   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000010"}, ... 68, ) }, ... 68, ) == 0x0
 00567   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00568   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00569   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00570   896   NtClose  (68, ... ) == 0x0
 00571   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000011"}, ... 68, ) }, ... 68, ) == 0x0
 00572   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00573   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00574   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00575   896   NtClose  (68, ... ) == 0x0
 00576   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000012"}, ... 68, ) }, ... 68, ) == 0x0
 00577   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00578   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00579   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00580   896   NtClose  (68, ... ) == 0x0
 00581   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000013"}, ... 68, ) }, ... 68, ) == 0x0
 00582   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00583   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00584   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00585   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00586   896   NtClose  (68, ... ) == 0x0
 00587   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000014"}, ... 68, ) }, ... 68, ) == 0x0
 00588   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00589   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00590   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00591   896   NtClose  (68, ... ) == 0x0
 00592   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000015"}, ... 68, ) }, ... 68, ) == 0x0
 00593   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00594   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00595   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00596   896   NtClose  (68, ... ) == 0x0
 00597   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000016"}, ... 68, ) }, ... 68, ) == 0x0
 00598   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00599   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00600   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00601   896   NtClose  (68, ... ) == 0x0
 00602   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000017"}, ... 68, ) }, ... 68, ) == 0x0
 00603   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00604   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00605   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00606   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00607   896   NtClose  (68, ... ) == 0x0
 00608   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000018"}, ... 68, ) }, ... 68, ) == 0x0
 00609   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00610   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00611   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00612   896   NtClose  (68, ... ) == 0x0
 00613   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000019"}, ... 68, ) }, ... 68, ) == 0x0
 00614   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00615   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00616   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00617   896   NtClose  (68, ... ) == 0x0
 00618   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000020"}, ... 68, ) }, ... 68, ) == 0x0
 00619   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00620   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00622   896   NtClose  (68, ... ) == 0x0
 00623   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000021"}, ... 68, ) }, ... 68, ) == 0x0
 00624   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00625   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00627   896   NtClose  (68, ... ) == 0x0
 00628   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000022"}, ... 68, ) }, ... 68, ) == 0x0
 00629   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00630   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00632   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 00633   896   NtClose  (68, ... ) == 0x0
 00634   896   NtClose  (64, ... ) == 0x0
 00635   896   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00636   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00637   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 68, ) }, ... 68, ) == 0x0
 00638   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00639   896   NtNotifyChangeKey  (68, 64, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00640   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00641   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00642   896   NtQueryValueKey  (68,  (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00643   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "Catalog_Entries"}, ... 72, ) }, ... 72, ) == 0x0
 00644   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000001"}, ... 76, ) }, ... 76, ) == 0x0
 00645   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00646   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00647   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00648   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00649   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00650   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00651   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00652   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00653   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00654   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00655   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00656   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00657   896   NtClose  (76, ... ) == 0x0
 00658   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000002"}, ... 76, ) }, ... 76, ) == 0x0
 00659   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00660   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00661   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00662   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00663   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00664   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00665   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00666   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00668   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00669   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00670   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00671   896   NtClose  (76, ... ) == 0x0
 00672   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000003"}, ... 76, ) }, ... 76, ) == 0x0
 00673   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00674   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00675   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00676   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00677   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00678   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00679   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00680   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00681   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00682   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00684   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   896   NtClose  (76, ... ) == 0x0
 00686   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000004"}, ... 76, ) }, ... 76, ) == 0x0
 00687   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00688   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00689   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00690   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00691   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00692   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00693   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 00694   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00695   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 00696   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   896   NtClose  (76, ... ) == 0x0
 00700   896   NtClose  (72, ... ) == 0x0
 00701   896   NtWaitForSingleObject  (64, 0, {0, 0}, ... ) == 0x102
 00702   896   NtClose  (52, ... ) == 0x0
 00703   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00704   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00705   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00706   896   NtQueryValueKey  (52,  (52, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00707   896   NtClose  (52, ... ) == 0x0
 00708   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00709   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 52, ) == 0x0
 00710   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) == 0x0
 00711   896   NtQueryInformationFile  (72, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 00712   896   NtQueryInformationFile  (72, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00713   896   NtQueryInformationFile  (72, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00714   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 8192, 4096, 4, ... 1359872, 8192, ) == 0x0
 00715   896   NtQueryInformationFile  (72, 1355896, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 00716   896   NtQueryInformationFile  (72, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00717   896   NtQueryInformationFile  (72, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 00718   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 00719   896   NtClose  (-2147482748, ... ) == 0x0
 00718   896   NtCreateFile  ... 76, {status=0x0, info=2}, ) == 0x0
 00720   896   NtQueryVolumeInformationFile  (76, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00721   896   NtQueryInformationFile  (76, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00722   896   NtQueryVolumeInformationFile  (72, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00723   896   NtQueryVolumeInformationFile  (72, 1239912, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00724   896   NtSetInformationFile  (76, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00725   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 72, ... 80, ) == 0x0
 00726   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x990000), {0, 0}, 90112, ) == 0x0
 00727   896   NtClose  (80, ... ) == 0x0
 00728   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0    \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0d\347\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 00729   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24592, 0x0, 0, ... {status=0x0, info=24592}, ) , 24592, 0x0, 0, ... {status=0x0, info=24592}, ) == 0x0
 00730   896   NtUnmapViewOfSection  (-1, 0x990000, ... ) == 0x0
 00731   896   NtSetInformationFile  (76, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 00732   896   NtClose  (72, ... ) == 0x0
 00733   896   NtClose  (76, ... ) == 0x0
 00734   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 76, ) }, ... 76, ) == 0x0
 00735   896   NtSetValueKey  (76,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 00736   896   NtSetInformationFile  (-2147482448, -135747792, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00737   896   NtSetInformationFile  (-2147482448, -135747884, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00738   896   NtSetInformationFile  (-2147482448, -135748192, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00739   896   NtSetInformationFile  (-2147482448, -135748288, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00735   896   NtSetValueKey  ... ) == 0x0
 00740   896   NtClose  (76, ... ) == 0x0
 00741   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 76, ) }, 0, ... 76, ) == 0x0
 00742   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10027008, 1048576, ) == 0x0
 00743   896   NtAllocateVirtualMemory  (-1, 11067392, 0, 8192, 4096, 4, ... 11067392, 8192, ) == 0x0
 00744   896   NtProtectVirtualMemory  (-1, (0xa8e000), 4096, 260, ... (0xa8e000), 4096, 4, ) == 0x0
 00745   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 72, {1252, 2016}, ) == 0x0
 00746   896   NtQueryInformationThread  (72, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00747   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00748   896   NtResumeThread  (72, ... 1, ) == 0x0
 00749   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11075584, 1048576, ) == 0x0
 00750  2016   NtTestAlert  (... ) == 0x0
 00751  2016   NtContinue  (11074864, 1, ...
 00752  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00753  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 80, ) == 0x0
 00754  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00755  2016   NtAllocateVirtualMemory  (-1, 11063296, 0, 4096, 4096, 260, ...
 00756   896   NtAllocateVirtualMemory  (-1, 12115968, 0, 8192, 4096, 4, ... 12115968, 8192, ) == 0x0
 00757   896   NtProtectVirtualMemory  (-1, (0xb8e000), 4096, 260, ... (0xb8e000), 4096, 4, ) == 0x0
 00758   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 84, {1252, 596}, ) == 0x0
 00759   896   NtQueryInformationThread  (84, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1252,Tid=596,}, 0x0, ) == 0x0
 00760   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ) == 0x0
 00755  2016   NtAllocateVirtualMemory  ... 11063296, 4096, ) == 0x0
 00761  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11071988, ... ) }, 11071988, ... ) == 0x0
 00762  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00763  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 88, ... 92, ) == 0x0
 00764  2016   NtClose  (88, ... ) == 0x0
 00765  2016   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb90000), 0x0, 245760, ) == 0x0
 00766  2016   NtClose  (92, ...
 00767   896   NtResumeThread  (84, ... 1, ) == 0x0
 00768   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 12386304, 1048576, ) == 0x0
 00769   896   NtAllocateVirtualMemory  (-1, 13426688, 0, 8192, 4096, 4, ... 13426688, 8192, ) == 0x0
 00770   896   NtProtectVirtualMemory  (-1, (0xcce000), 4096, 260, ... (0xcce000), 4096, 4, ) == 0x0
 00771   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 88, {1252, 376}, ) == 0x0
 00772   896   NtQueryInformationThread  (88, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=376,}, 0x0, ) == 0x0
 00766  2016   NtClose  ... ) == 0x0
 00773   596   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 92, ) == 0x0
 00774   596   NtWaitForSingleObject  (92, 0, 0x0, ...
 00775   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0x\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\0\0\0\344\4\0\0x\1\0\0" )  ) == 0x0
 00776   896   NtResumeThread  (88, ... 1, ) == 0x0
 00777   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00778  2016   NtUnmapViewOfSection  (-1, 0xb90000, ...
 00779   376   NtWaitForSingleObject  (92, 0, 0x0, ...
 00778  2016   NtUnmapViewOfSection  ... ) == 0x0
 00780  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11072296, ... ) }, 11072296, ... ) == 0x0
 00781  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00782  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ... 100, ) == 0x0
 00783  2016   NtQuerySection  (100, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00784  2016   NtClose  (96, ... ) == 0x0
 00777   896   NtAllocateVirtualMemory  ... 13434880, 1048576, ) == 0x0
 00785   896   NtAllocateVirtualMemory  (-1, 14475264, 0, 8192, 4096, 4, ... 14475264, 8192, ) == 0x0
 00786   896   NtProtectVirtualMemory  (-1, (0xdce000), 4096, 260, ... (0xdce000), 4096, 4, ) == 0x0
 00787   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 96, {1252, 420}, ) == 0x0
 00788   896   NtQueryInformationThread  (96, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=420,}, 0x0, ) == 0x0
 00789   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\244\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\244\1\0\0" )  ) == 0x0
 00790  2016   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 00791  2016   NtClose  (100, ... ) == 0x0
 00792  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00793  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00794  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00795   896   NtResumeThread  (96, ... 1, ) == 0x0
 00796   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14483456, 1048576, ) == 0x0
 00797   896   NtAllocateVirtualMemory  (-1, 15523840, 0, 8192, 4096, 4, ... 15523840, 8192, ) == 0x0
 00798   896   NtProtectVirtualMemory  (-1, (0xece000), 4096, 260, ... (0xece000), 4096, 4, ) == 0x0
 00799   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 100, {1252, 384}, ) == 0x0
 00800   896   NtQueryInformationThread  (100, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 00801  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 00802   420   NtWaitForSingleObject  (92, 0, 0x0, ...
 00801  2016   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 00803  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00804  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00805  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00806  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00807  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00808   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 00809   896   NtResumeThread  (100, ... 1, ) == 0x0
 00810   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15532032, 1048576, ) == 0x0
 00811   896   NtAllocateVirtualMemory  (-1, 16572416, 0, 8192, 4096, 4, ... 16572416, 8192, ) == 0x0
 00812   896   NtProtectVirtualMemory  (-1, (0xfce000), 4096, 260, ... (0xfce000), 4096, 4, ) == 0x0
 00813   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00814   384   NtWaitForSingleObject  (92, 0, 0x0, ...
 00813   896   NtCreateThread  ... 104, {1252, 1028}, ) == 0x0
 00815   896   NtQueryInformationThread  (104, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 00816   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\4\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 00817  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00818  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00819  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00820  2016   NtSetEventBoostPriority  (92, ...
 00774   596   NtWaitForSingleObject  ... ) == 0x0
 00821   596   NtSetEventBoostPriority  (92, ...
 00779   376   NtWaitForSingleObject  ... ) == 0x0
 00822   376   NtSetEventBoostPriority  (92, ...
 00802   420   NtWaitForSingleObject  ... ) == 0x0
 00823   420   NtSetEventBoostPriority  (92, ...
 00814   384   NtWaitForSingleObject  ... ) == 0x0
 00824   384   NtTestAlert  (... ) == 0x0
 00823   420   NtSetEventBoostPriority  ... ) == 0x0
 00822   376   NtSetEventBoostPriority  ... ) == 0x0
 00821   596   NtSetEventBoostPriority  ... ) == 0x0
 00820  2016   NtSetEventBoostPriority  ... ) == 0x0
 00825   896   NtResumeThread  (104, ...
 00826   384   NtContinue  (15531312, 1, ...
 00827   420   NtTestAlert  (...
 00828   376   NtTestAlert  (...
 00829  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00825   896   NtResumeThread  ... 1, ) == 0x0
 00830   384   NtRegisterThreadTerminatePort  (24, ...
 00827   420   NtTestAlert  ... ) == 0x0
 00828   376   NtTestAlert  ... ) == 0x0
 00829  2016   NtCreateEvent  ... 108, ) == 0x0
 00831   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00830   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 00832   420   NtContinue  (14482736, 1, ...
 00833   376   NtContinue  (13434160, 1, ...
 00834   596   NtTestAlert  (...
 00835  1028   NtTestAlert  (...
 00831   896   NtAllocateVirtualMemory  ... 16580608, 1048576, ) == 0x0
 00836   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00837   420   NtRegisterThreadTerminatePort  (24, ...
 00838   376   NtRegisterThreadTerminatePort  (24, ...
 00834   596   NtTestAlert  ... ) == 0x0
 00835  1028   NtTestAlert  ... ) == 0x0
 00839   896   NtAllocateVirtualMemory  (-1, 17620992, 0, 8192, 4096, 4, ...
 00836   384   NtDuplicateObject  ... 112, ) == 0x0
 00837   420   NtRegisterThreadTerminatePort  ... ) == 0x0
 00838   376   NtRegisterThreadTerminatePort  ... ) == 0x0
 00840   596   NtContinue  (12123440, 1, ...
 00841  1028   NtContinue  (16579888, 1, ...
 00839   896   NtAllocateVirtualMemory  ... 17620992, 8192, ) == 0x0
 00842   384   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00843   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00844   376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00845   596   NtRegisterThreadTerminatePort  (24, ...
 00846  1028   NtRegisterThreadTerminatePort  (24, ...
 00847  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 00848   896   NtProtectVirtualMemory  (-1, (0x10ce000), 4096, 260, ...
 00842   384   NtWaitForSingleObject  ... ) == 0x102
 00843   420   NtDuplicateObject  ... 116, ) == 0x0
 00845   596   NtRegisterThreadTerminatePort  ... ) == 0x0
 00846  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 00847  2016   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00848   896   NtProtectVirtualMemory  ... (0x10ce000), 4096, 4, ) == 0x0
 00849   384   NtAllocateVirtualMemory  (-1, 15519744, 0, 4096, 4096, 260, ...
 00850   420   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00851   596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00844   376   NtDuplicateObject  ... 120, ) == 0x0
 00852  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11071908, ... }, 11071908, ...
 00853   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00849   384   NtAllocateVirtualMemory  ... 15519744, 4096, ) == 0x0
 00850   420   NtWaitForSingleObject  ... ) == 0x102
 00854  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00855   376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00853   896   NtCreateThread  ... 124, {1252, 2012}, ) == 0x0
 00856   384   NtWaitForSingleObject  (92, 0, 0x0, ...
 00857   420   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00854  1028   NtDuplicateObject  ... 128, ) == 0x0
 00855   376   NtWaitForSingleObject  ... ) == 0x102
 00858   896   NtQueryInformationThread  (124, Basic, 28, ...
 00857   420   NtCreateEvent  ... 132, ) == 0x0
 00859  1028   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00860   376   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00858   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 00851   596   NtDuplicateObject  ... 136, ) == 0x0
 00859  1028   NtWaitForSingleObject  ... ) == 0x102
 00860   376   NtCreateEvent  ... 140, ) == 0x0
 00861   420   NtWaitForSingleObject  (132, 0, 0x0, ...
 00862   596   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00863  1028   NtWaitForSingleObject  (132, 0, 0x0, ...
 00864   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\334\7\0\0" ...  ...
 00862   596   NtWaitForSingleObject  ... ) == 0x102
 00865   376   NtClose  (140, ...
 00864   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81851, 0}  ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 00866   596   NtWaitForSingleObject  (132, 0, 0x0, ...
 00865   376   NtClose  ... ) == 0x0
 00867   896   NtResumeThread  (124, ...
 00868   376   NtWaitForSingleObject  (132, 0, 0x0, ...
 00867   896   NtResumeThread  ... 1, ) == 0x0
 00869   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17629184, 1048576, ) == 0x0
 00870   896   NtAllocateVirtualMemory  (-1, 18669568, 0, 8192, 4096, 4, ... 18669568, 8192, ) == 0x0
 00871   896   NtProtectVirtualMemory  (-1, (0x11ce000), 4096, 260, ... (0x11ce000), 4096, 4, ) == 0x0
 00872   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00873  2012   NtWaitForSingleObject  (92, 0, 0x0, ...
 00872   896   NtCreateThread  ... 140, {1252, 1168}, ) == 0x0
 00874   896   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 00875   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\220\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 00876   896   NtResumeThread  (140, ... 1, ) == 0x0
 00877   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18677760, 1048576, ) == 0x0
 00878   896   NtAllocateVirtualMemory  (-1, 19718144, 0, 8192, 4096, 4, ... 19718144, 8192, ) == 0x0
 00879  1168   NtWaitForSingleObject  (92, 0, 0x0, ...
 00880   896   NtProtectVirtualMemory  (-1, (0x12ce000), 4096, 260, ... (0x12ce000), 4096, 4, ) == 0x0
 00881   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 144, {1252, 1180}, ) == 0x0
 00882   896   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 00852  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00883  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11071908, ... ) }, 11071908, ... ) == 0x0
 00884  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 00885  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 152, ) == 0x0
 00886  2016   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00887  2016   NtClose  (148, ... ) == 0x0
 00888  2016   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 00889   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 00890   896   NtResumeThread  (144, ... 1, ) == 0x0
 00891   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19726336, 1048576, ) == 0x0
 00892   896   NtAllocateVirtualMemory  (-1, 20766720, 0, 8192, 4096, 4, ... 20766720, 8192, ) == 0x0
 00893   896   NtProtectVirtualMemory  (-1, (0x13ce000), 4096, 260, ... (0x13ce000), 4096, 4, ) == 0x0
 00894   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00888  2016   NtMapViewOfSection  ... (0x662b0000), 0x0, 360448, ) == 0x0
 00895  1180   NtWaitForSingleObject  (92, 0, 0x0, ...
 00896  2016   NtClose  (152, ... ) == 0x0
 00897  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00898  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00899  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00900  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00901  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 00894   896   NtCreateThread  ... 152, {1252, 928}, ) == 0x0
 00902   896   NtQueryInformationThread  (152, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 00903   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\240\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\0\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 00904   896   NtResumeThread  (152, ... 1, ) == 0x0
 00905   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00901  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 00906   928   NtWaitForSingleObject  (92, 0, 0x0, ...
 00907  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00908  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00909  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00910  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00911  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00912  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 00905   896   NtAllocateVirtualMemory  ... 20774912, 1048576, ) == 0x0
 00913   896   NtAllocateVirtualMemory  (-1, 21815296, 0, 8192, 4096, 4, ... 21815296, 8192, ) == 0x0
 00914   896   NtProtectVirtualMemory  (-1, (0x14ce000), 4096, 260, ... (0x14ce000), 4096, 4, ) == 0x0
 00915   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 148, {1252, 428}, ) == 0x0
 00916   896   NtQueryInformationThread  (148, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 00917   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 00912  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 00918  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00919  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00920  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00921  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00922  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00923  2016   NtSetEventBoostPriority  (92, ...
 00924   896   NtResumeThread  (148, ... 1, ) == 0x0
 00925   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21823488, 1048576, ) == 0x0
 00926   896   NtAllocateVirtualMemory  (-1, 22863872, 0, 8192, 4096, 4, ... 22863872, 8192, ) == 0x0
 00927   896   NtProtectVirtualMemory  (-1, (0x15ce000), 4096, 260, ... (0x15ce000), 4096, 4, ) == 0x0
 00928   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 156, {1252, 1732}, ) == 0x0
 00929   896   NtQueryInformationThread  (156, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 00856   384   NtWaitForSingleObject  ... ) == 0x0
 00923  2016   NtSetEventBoostPriority  ... ) == 0x0
 00930   428   NtWaitForSingleObject  (92, 0, 0x0, ...
 00931   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15526864, ... }, 15526864, ...
 00932  2016   NtWaitForSingleObject  (92, 0, 0x0, ...
 00931   384   NtQueryAttributesFile  ... ) == 0x0
 00933   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\0\0\0\344\4\0\0\304\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\0\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 00934   896   NtResumeThread  (156, ... 1, ) == 0x0
 00935   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22872064, 1048576, ) == 0x0
 00936   896   NtAllocateVirtualMemory  (-1, 23912448, 0, 8192, 4096, 4, ... 23912448, 8192, ) == 0x0
 00937   896   NtProtectVirtualMemory  (-1, (0x16ce000), 4096, 260, ... (0x16ce000), 4096, 4, ) == 0x0
 00938   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00939   384   NtSetEventBoostPriority  (92, ...
 00940  1732   NtWaitForSingleObject  (92, 0, 0x0, ...
 00873  2012   NtWaitForSingleObject  ... ) == 0x0
 00939   384   NtSetEventBoostPriority  ... ) == 0x0
 00941  2012   NtSetEventBoostPriority  (92, ...
 00879  1168   NtWaitForSingleObject  ... ) == 0x0
 00942  1168   NtSetEventBoostPriority  (92, ...
 00895  1180   NtWaitForSingleObject  ... ) == 0x0
 00943  1180   NtSetEventBoostPriority  (92, ...
 00906   928   NtWaitForSingleObject  ... ) == 0x0
 00944   928   NtSetEventBoostPriority  (92, ...
 00930   428   NtWaitForSingleObject  ... ) == 0x0
 00945   428   NtSetEventBoostPriority  (92, ...
 00932  2016   NtWaitForSingleObject  ... ) == 0x0
 00946  2016   NtSetEventBoostPriority  (92, ...
 00940  1732   NtWaitForSingleObject  ... ) == 0x0
 00947  1732   NtTestAlert  (... ) == 0x0
 00946  2016   NtSetEventBoostPriority  ... ) == 0x0
 00945   428   NtSetEventBoostPriority  ... ) == 0x0
 00944   928   NtSetEventBoostPriority  ... ) == 0x0
 00943  1180   NtSetEventBoostPriority  ... ) == 0x0
 00942  1168   NtSetEventBoostPriority  ... ) == 0x0
 00941  2012   NtSetEventBoostPriority  ... ) == 0x0
 00948   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00938   896   NtCreateThread  ... 160, {1252, 748}, ) == 0x0
 00949  1732   NtContinue  (22871344, 1, ...
 00950  2016   NtQuerySystemInformation  (Basic, 44, ...
 00951   428   NtTestAlert  (...
 00952   928   NtTestAlert  (...
 00953  1180   NtTestAlert  (...
 00954  1168   NtTestAlert  (...
 00948   384   NtCreateEvent  ... 164, ) == 0x0
 00955   896   NtQueryInformationThread  (160, Basic, 28, ...
 00956  1732   NtRegisterThreadTerminatePort  (24, ...
 00950  2016   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00951   428   NtTestAlert  ... ) == 0x0
 00952   928   NtTestAlert  ... ) == 0x0
 00953  1180   NtTestAlert  ... ) == 0x0
 00954  1168   NtTestAlert  ... ) == 0x0
 00957   384   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 00955   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 00956  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 00958  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... }, ...
 00959   428   NtContinue  (21822768, 1, ...
 00960   928   NtContinue  (20774192, 1, ...
 00961  1180   NtContinue  (19725616, 1, ...
 00962  1168   NtContinue  (18677040, 1, ...
 00957   384   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00963   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\0\0\0\344\4\0\0\354\2\0\0" ...  ...
 00964  1732   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00958  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00965   428   NtRegisterThreadTerminatePort  (24, ...
 00966   928   NtRegisterThreadTerminatePort  (24, ...
 00967  1180   NtRegisterThreadTerminatePort  (24, ...
 00968  1168   NtRegisterThreadTerminatePort  (24, ...
 00969  2012   NtTestAlert  (...
 00963   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81857, 0}  ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\0\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 00964  1732   NtDuplicateObject  ... 168, ) == 0x0
 00970  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... }, ...
 00965   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 00966   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 00967  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 00968  1168   NtRegisterThreadTerminatePort  ... ) == 0x0
 00969  2012   NtTestAlert  ... ) == 0x0
 00971   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 15526968, ... }, 15526968, ...
 00972  1732   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00970  2016   NtOpenKey  ... 172, ) == 0x0
 00973   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00974   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00975  1180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00976  1168   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00977  2012   NtContinue  (17628464, 1, ...
 00978   896   NtResumeThread  (160, ...
 00972  1732   NtWaitForSingleObject  ... ) == 0x102
 00979  2016   NtQueryValueKey  (172,  (172, "MaxRpcSize", Partial, 144, ... , Partial, 144, ...
 00973   428   NtDuplicateObject  ... 176, ) == 0x0
 00974   928   NtDuplicateObject  ... 180, ) == 0x0
 00975  1180   NtDuplicateObject  ... 184, ) == 0x0
 00980  2012   NtRegisterThreadTerminatePort  (24, ...
 00978   896   NtResumeThread  ... 1, ) == 0x0
 00981  1732   NtWaitForSingleObject  (132, 0, 0x0, ...
 00979  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00982   428   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00983   928   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00984  1180   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00980  2012   NtRegisterThreadTerminatePort  ... ) == 0x0
 00985   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00986  2016   NtClose  (172, ...
 00982   428   NtWaitForSingleObject  ... ) == 0x102
 00983   928   NtWaitForSingleObject  ... ) == 0x102
 00984  1180   NtWaitForSingleObject  ... ) == 0x102
 00987  2012   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00985   896   NtAllocateVirtualMemory  ... 23920640, 1048576, ) == 0x0
 00986  2016   NtClose  ... ) == 0x0
 00988   428   NtWaitForSingleObject  (132, 0, 0x0, ...
 00989   928   NtWaitForSingleObject  (132, 0, 0x0, ...
 00990  1180   NtWaitForSingleObject  (132, 0, 0x0, ...
 00976  1168   NtDuplicateObject  ... 172, ) == 0x0
 00991   748   NtWaitForSingleObject  (92, 0, 0x0, ...
 00992   896   NtAllocateVirtualMemory  (-1, 24961024, 0, 8192, 4096, 4, ...
 00993  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... }, ...
 00994  1168   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00992   896   NtAllocateVirtualMemory  ... 24961024, 8192, ) == 0x0
 00993  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00994  1168   NtWaitForSingleObject  ... ) == 0x102
 00987  2012   NtDuplicateObject  ... 188, ) == 0x0
 00995   896   NtProtectVirtualMemory  (-1, (0x17ce000), 4096, 260, ...
 00971   384   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00996  1168   NtWaitForSingleObject  (132, 0, 0x0, ...
 00997  2012   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00995   896   NtProtectVirtualMemory  ... (0x17ce000), 4096, 4, ) == 0x0
 00998   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 15526968, ... }, 15526968, ...
 00997  2012   NtWaitForSingleObject  ... ) == 0x102
 00999   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01000  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01001  2012   NtWaitForSingleObject  (132, 0, 0x0, ...
 00999   896   NtCreateThread  ... 192, {1252, 900}, ) == 0x0
 01000  2016   NtCreateEvent  ... 196, ) == 0x0
 01002   896   NtQueryInformationThread  (192, Basic, 28, ...
 01003  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01002   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 01003  2016   NtCreateEvent  ... 200, ) == 0x0
 00998   384   NtQueryAttributesFile  ... ) == 0x0
 01004  2016   NtQuerySystemTime  (...
 01005   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... }, 5, 96, ...
 01004  2016   NtQuerySystemTime  ... {1445547914, 29929616}, ) == 0x0
 01005   384   NtOpenFile  ... 204, {status=0x0, info=1}, ) == 0x0
 01006   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\204\3\0\0" ...  ...
 01007   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 204, ...
 01006   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81858, 0}  ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 01007   384   NtCreateSection  ... 208, ) == 0x0
 01008   896   NtResumeThread  (192, ...
 01009   384   NtQuerySection  (208, Image, 48, ...
 01008   896   NtResumeThread  ... 1, ) == 0x0
 01010  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01011   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01010  2016   NtCreateEvent  ... 212, ) == 0x0
 01009   384   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01012   900   NtWaitForSingleObject  (92, 0, 0x0, ...
 01013  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... }, ...
 01014   384   NtClose  (204, ...
 01013  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01014   384   NtClose  ... ) == 0x0
 01015  2016   NtQuerySystemInformation  (Performance, 312, ...
 01016   384   NtMapViewOfSection  (208, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01015  2016   NtQuerySystemInformation  ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01016   384   NtMapViewOfSection  ... (0x76f20000), 0x0, 159744, ) == 0x0
 01011   896   NtAllocateVirtualMemory  ... 24969216, 1048576, ) == 0x0
 01017   384   NtClose  (208, ...
 01018   896   NtAllocateVirtualMemory  (-1, 26009600, 0, 8192, 4096, 4, ...
 01019  2016   NtQueryInformationProcess  (-1, QuotaLimits, 32, ...
 01018   896   NtAllocateVirtualMemory  ... 26009600, 8192, ) == 0x0
 01019  2016   NtQueryInformationProcess  ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01020   896   NtProtectVirtualMemory  (-1, (0x18ce000), 4096, 260, ...
 01021  2016   NtQueryInformationProcess  (-1, VmCounters, 44, ...
 01020   896   NtProtectVirtualMemory  ... (0x18ce000), 4096, 4, ) == 0x0
 01021  2016   NtQueryInformationProcess  ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01022   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01023  2016   NtWaitForSingleObject  (92, 0, 0x0, ...
 01017   384   NtClose  ... ) == 0x0
 01024   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01025   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01026   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01027   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01028   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01029   384   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01022   896   NtCreateThread  ... 208, {1252, 1388}, ) == 0x0
 01030   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 01031   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 01032   896   NtResumeThread  (208, ... 1, ) == 0x0
 01033   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26017792, 1048576, ) == 0x0
 01034   896   NtAllocateVirtualMemory  (-1, 27058176, 0, 8192, 4096, 4, ... 27058176, 8192, ) == 0x0
 01029   384   NtFlushInstructionCache  ... ) == 0x0
 01035  1388   NtWaitForSingleObject  (92, 0, 0x0, ...
 01036   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01037   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01038   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01039   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01040   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01041   384   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01042   896   NtProtectVirtualMemory  (-1, (0x19ce000), 4096, 260, ... (0x19ce000), 4096, 4, ) == 0x0
 01043   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 204, {1252, 2036}, ) == 0x0
 01044   896   NtQueryInformationThread  (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 01045   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 01046   896   NtResumeThread  (204, ... 1, ) == 0x0
 01047   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01041   384   NtFlushInstructionCache  ... ) == 0x0
 01048  2036   NtWaitForSingleObject  (92, 0, 0x0, ...
 01049   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01050   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01051   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01052   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01053   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01054   384   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01047   896   NtAllocateVirtualMemory  ... 27066368, 1048576, ) == 0x0
 01055   896   NtAllocateVirtualMemory  (-1, 28106752, 0, 8192, 4096, 4, ... 28106752, 8192, ) == 0x0
 01056   896   NtProtectVirtualMemory  (-1, (0x1ace000), 4096, 260, ... (0x1ace000), 4096, 4, ) == 0x0
 01057   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 216, {1252, 1372}, ) == 0x0
 01058   896   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 01059   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 01054   384   NtFlushInstructionCache  ... ) == 0x0
 01060   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01061   384   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 220, 2, ) }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 220, 2, ) , 0, ... 220, 2, ) == 0x0
 01062   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01063   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01064   384   NtQueryValueKey  (224,  (224, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01065   384   NtQueryValueKey  (220,  (220, "DisableAdapterDomainName", Partial, 144, ... , Partial, 144, ...
 01066   896   NtResumeThread  (216, ... 1, ) == 0x0
 01067   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28114944, 1048576, ) == 0x0
 01068   896   NtAllocateVirtualMemory  (-1, 29155328, 0, 8192, 4096, 4, ... 29155328, 8192, ) == 0x0
 01069   896   NtProtectVirtualMemory  (-1, (0x1bce000), 4096, 260, ... (0x1bce000), 4096, 4, ) == 0x0
 01070   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 228, {1252, 1600}, ) == 0x0
 01071   896   NtQueryInformationThread  (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 01065   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01072  1372   NtWaitForSingleObject  (92, 0, 0x0, ...
 01073   384   NtQueryValueKey  (224,  (224, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01074   384   NtQueryValueKey  (220,  (220, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01075   384   NtQueryValueKey  (224,  (224, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01076   384   NtQueryValueKey  (220,  (220, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   384   NtQueryValueKey  (224,  (224, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01078   384   NtQueryValueKey  (220,  (220, "AllowUnqualifiedQuery", Partial, 144, ... , Partial, 144, ...
 01079   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 01080   896   NtResumeThread  (228, ... 1, ) == 0x0
 01081   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29163520, 1048576, ) == 0x0
 01082   896   NtAllocateVirtualMemory  (-1, 30203904, 0, 8192, 4096, 4, ... 30203904, 8192, ) == 0x0
 01083   896   NtProtectVirtualMemory  (-1, (0x1cce000), 4096, 260, ... (0x1cce000), 4096, 4, ) == 0x0
 01084   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01078   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01085  1600   NtWaitForSingleObject  (92, 0, 0x0, ...
 01086   384   NtQueryValueKey  (224,  (224, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087   384   NtQueryValueKey  (224,  (224, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01088   384   NtQueryValueKey  (224,  (224, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01089   384   NtQueryValueKey  (224,  (224, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01090   384   NtQueryValueKey  (224,  (224, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01091   384   NtQueryValueKey  (224,  (224, "UseEdns", Partial, 144, ... , Partial, 144, ...
 01084   896   NtCreateThread  ... 232, {1252, 1948}, ) == 0x0
 01092   896   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 01093   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81863, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 01094   896   NtResumeThread  (232, ... 1, ) == 0x0
 01095   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30212096, 1048576, ) == 0x0
 01096   896   NtAllocateVirtualMemory  (-1, 31252480, 0, 8192, 4096, 4, ... 31252480, 8192, ) == 0x0
 01091   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01097  1948   NtWaitForSingleObject  (92, 0, 0x0, ...
 01098   384   NtQueryValueKey  (224,  (224, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01099   384   NtQueryValueKey  (224,  (224, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01100   384   NtQueryValueKey  (224,  (224, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01101   384   NtQueryValueKey  (220,  (220, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01102   384   NtQueryValueKey  (224,  (224, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01103   384   NtQueryValueKey  (224,  (224, "RegisterAdapterName", Partial, 144, ... , Partial, 144, ...
 01104   896   NtProtectVirtualMemory  (-1, (0x1dce000), 4096, 260, ... (0x1dce000), 4096, 4, ) == 0x0
 01105   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 236, {1252, 252}, ) == 0x0
 01106   896   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 01107   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81864, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 01108   896   NtResumeThread  (236, ... 1, ) == 0x0
 01109   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01103   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01110   252   NtWaitForSingleObject  (92, 0, 0x0, ...
 01111   384   NtQueryValueKey  (220,  (220, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01112   384   NtQueryValueKey  (224,  (224, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01113   384   NtQueryValueKey  (220,  (220, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01114   384   NtQueryValueKey  (224,  (224, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01115   384   NtQueryValueKey  (220,  (220, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01116   384   NtQueryValueKey  (224,  (224, "RegistrationTtl", Partial, 144, ... , Partial, 144, ...
 01109   896   NtAllocateVirtualMemory  ... 31260672, 1048576, ) == 0x0
 01117   896   NtAllocateVirtualMemory  (-1, 32301056, 0, 8192, 4096, 4, ... 32301056, 8192, ) == 0x0
 01118   896   NtProtectVirtualMemory  (-1, (0x1ece000), 4096, 260, ... (0x1ece000), 4096, 4, ) == 0x0
 01119   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 240, {1252, 1300}, ) == 0x0
 01120   896   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 01121   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 01116   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01122   384   NtQueryValueKey  (220,  (220, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01123   384   NtQueryValueKey  (224,  (224, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01124   384   NtQueryValueKey  (220,  (220, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01125   384   NtQueryValueKey  (224,  (224, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01126   384   NtQueryValueKey  (220,  (220, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01127   384   NtQueryValueKey  (224,  (224, "UpdateSecurityLevel", Partial, 144, ... , Partial, 144, ...
 01128   896   NtResumeThread  (240, ... 1, ) == 0x0
 01129   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32309248, 1048576, ) == 0x0
 01130   896   NtAllocateVirtualMemory  (-1, 33349632, 0, 8192, 4096, 4, ... 33349632, 8192, ) == 0x0
 01131   896   NtProtectVirtualMemory  (-1, (0x1fce000), 4096, 260, ... (0x1fce000), 4096, 4, ) == 0x0
 01132   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 244, {1252, 1096}, ) == 0x0
 01133   896   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 01127   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134  1300   NtWaitForSingleObject  (92, 0, 0x0, ...
 01135   384   NtQueryValueKey  (220,  (220, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01136   384   NtQueryValueKey  (224,  (224, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01137   384   NtQueryValueKey  (224,  (224, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01138   384   NtQueryValueKey  (224,  (224, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01139   384   NtQueryValueKey  (224,  (224, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01140   384   NtQueryValueKey  (224,  (224, "MaxCacheTtl", Partial, 144, ... , Partial, 144, ...
 01141   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81866, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 01142   896   NtResumeThread  (244, ... 1, ) == 0x0
 01143   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 33357824, 1048576, ) == 0x0
 01144   896   NtAllocateVirtualMemory  (-1, 34398208, 0, 8192, 4096, 4, ... 34398208, 8192, ) == 0x0
 01145   896   NtProtectVirtualMemory  (-1, (0x20ce000), 4096, 260, ... (0x20ce000), 4096, 4, ) == 0x0
 01146   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01140   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01147  1096   NtWaitForSingleObject  (92, 0, 0x0, ...
 01148   384   NtQueryValueKey  (224,  (224, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01149   384   NtQueryValueKey  (224,  (224, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01150   384   NtQueryValueKey  (224,  (224, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01151   384   NtQueryValueKey  (224,  (224, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01152   384   NtQueryValueKey  (224,  (224, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01153   384   NtQueryValueKey  (224,  (224, "MulticastSendLevel", Partial, 144, ... , Partial, 144, ...
 01146   896   NtCreateThread  ... 248, {1252, 1708}, ) == 0x0
 01154   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 01155   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 01156   896   NtResumeThread  (248, ... 1, ) == 0x0
 01157   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 34406400, 1048576, ) == 0x0
 01158   896   NtAllocateVirtualMemory  (-1, 35446784, 0, 8192, 4096, 4, ... 35446784, 8192, ) == 0x0
 01153   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01159  1708   NtWaitForSingleObject  (92, 0, 0x0, ...
 01160   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 252, ) }, ... 252, ) == 0x0
 01161   384   NtQueryValueKey  (252,  (252, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (252, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01162   384   NtClose  (252, ... ) == 0x0
 01163   384   NtClose  (220, ... ) == 0x0
 01164   384   NtClose  (224, ... ) == 0x0
 01165   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 01166   896   NtProtectVirtualMemory  (-1, (0x21ce000), 4096, 260, ... (0x21ce000), 4096, 4, ) == 0x0
 01167   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 224, {1252, 1024}, ) == 0x0
 01168   896   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 01169   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 01170   896   NtResumeThread  (224, ... 1, ) == 0x0
 01171   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01165   384   NtOpenKey  ... 220, ) == 0x0
 01172  1024   NtWaitForSingleObject  (92, 0, 0x0, ...
 01173   384   NtQueryValueKey  (220,  (220, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01174   384   NtQueryValueKey  (220,  (220, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01175   384   NtQueryValueKey  (220,  (220, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   384   NtClose  (220, ... ) == 0x0
 01177   384   NtSetEventBoostPriority  (92, ...
 00991   748   NtWaitForSingleObject  ... ) == 0x0
 01178   748   NtSetEventBoostPriority  (92, ...
 01012   900   NtWaitForSingleObject  ... ) == 0x0
 01179   900   NtSetEventBoostPriority  (92, ...
 01023  2016   NtWaitForSingleObject  ... ) == 0x0
 01180  2016   NtSetEventBoostPriority  (92, ...
 01035  1388   NtWaitForSingleObject  ... ) == 0x0
 01181  1388   NtSetEventBoostPriority  (92, ...
 01048  2036   NtWaitForSingleObject  ... ) == 0x0
 01182  2036   NtSetEventBoostPriority  (92, ...
 01072  1372   NtWaitForSingleObject  ... ) == 0x0
 01183  1372   NtSetEventBoostPriority  (92, ...
 01085  1600   NtWaitForSingleObject  ... ) == 0x0
 01184  1600   NtSetEventBoostPriority  (92, ...
 01097  1948   NtWaitForSingleObject  ... ) == 0x0
 01185  1948   NtSetEventBoostPriority  (92, ...
 01110   252   NtWaitForSingleObject  ... ) == 0x0
 01186   252   NtSetEventBoostPriority  (92, ...
 01134  1300   NtWaitForSingleObject  ... ) == 0x0
 01187  1300   NtSetEventBoostPriority  (92, ...
 01147  1096   NtWaitForSingleObject  ... ) == 0x0
 01188  1096   NtSetEventBoostPriority  (92, ...
 01159  1708   NtWaitForSingleObject  ... ) == 0x0
 01189  1708   NtSetEventBoostPriority  (92, ...
 01172  1024   NtWaitForSingleObject  ... ) == 0x0
 01190  1024   NtTestAlert  (... ) == 0x0
 01189  1708   NtSetEventBoostPriority  ... ) == 0x0
 01188  1096   NtSetEventBoostPriority  ... ) == 0x0
 01187  1300   NtSetEventBoostPriority  ... ) == 0x0
 01186   252   NtSetEventBoostPriority  ... ) == 0x0
 01185  1948   NtSetEventBoostPriority  ... ) == 0x0
 01184  1600   NtSetEventBoostPriority  ... ) == 0x0
 01183  1372   NtSetEventBoostPriority  ... ) == 0x0
 01182  2036   NtSetEventBoostPriority  ... ) == 0x0
 01181  1388   NtSetEventBoostPriority  ... ) == 0x0
 01180  2016   NtSetEventBoostPriority  ... ) == 0x0
 01179   900   NtSetEventBoostPriority  ... ) == 0x0
 01178   748   NtSetEventBoostPriority  ... ) == 0x0
 01177   384   NtSetEventBoostPriority  ... ) == 0x0
 01171   896   NtAllocateVirtualMemory  ... 35454976, 1048576, ) == 0x0
 01191  1024   NtContinue  (35454256, 1, ...
 01192  1708   NtTestAlert  (...
 01193  1096   NtTestAlert  (...
 01194  1300   NtTestAlert  (...
 01195   252   NtTestAlert  (...
 01196  1948   NtTestAlert  (...
 01197  1600   NtTestAlert  (...
 01198  1372   NtTestAlert  (...
 01199  2036   NtTestAlert  (...
 01200  1388   NtTestAlert  (...
 01201  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01202   900   NtTestAlert  (...
 01203   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01204   896   NtAllocateVirtualMemory  (-1, 36495360, 0, 8192, 4096, 4, ...
 01205  1024   NtRegisterThreadTerminatePort  (24, ...
 01192  1708   NtTestAlert  ... ) == 0x0
 01193  1096   NtTestAlert  ... ) == 0x0
 01194  1300   NtTestAlert  ... ) == 0x0
 01195   252   NtTestAlert  ... ) == 0x0
 01196  1948   NtTestAlert  ... ) == 0x0
 01197  1600   NtTestAlert  ... ) == 0x0
 01198  1372   NtTestAlert  ... ) == 0x0
 01199  2036   NtTestAlert  ... ) == 0x0
 01200  1388   NtTestAlert  ... ) == 0x0
 01201  2016   NtCreateEvent  ... 220, ) == 0x0
 01202   900   NtTestAlert  ... ) == 0x0
 01206   748   NtTestAlert  (...
 01204   896   NtAllocateVirtualMemory  ... 36495360, 8192, ) == 0x0
 01205  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 01207  1708   NtContinue  (34405680, 1, ...
 01208  1096   NtContinue  (33357104, 1, ...
 01209  1300   NtContinue  (32308528, 1, ...
 01210   252   NtContinue  (31259952, 1, ...
 01211  1948   NtContinue  (30211376, 1, ...
 01212  1600   NtContinue  (29162800, 1, ...
 01213  1372   NtContinue  (28114224, 1, ...
 01214  2036   NtContinue  (27065648, 1, ...
 01215  1388   NtContinue  (26017072, 1, ...
 01216  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01217   900   NtContinue  (24968496, 1, ...
 01206   748   NtTestAlert  ... ) == 0x0
 01218   896   NtProtectVirtualMemory  (-1, (0x22ce000), 4096, 260, ...
 01219  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01220  1708   NtRegisterThreadTerminatePort  (24, ...
 01221  1096   NtRegisterThreadTerminatePort  (24, ...
 01222  1300   NtRegisterThreadTerminatePort  (24, ...
 01223   252   NtRegisterThreadTerminatePort  (24, ...
 01224  1948   NtRegisterThreadTerminatePort  (24, ...
 01225  1600   NtRegisterThreadTerminatePort  (24, ...
 01226  1372   NtRegisterThreadTerminatePort  (24, ...
 01227  2036   NtRegisterThreadTerminatePort  (24, ...
 01228  1388   NtRegisterThreadTerminatePort  (24, ...
 01203   384   NtCreateEvent  ... 252, ) == 0x0
 01229   900   NtRegisterThreadTerminatePort  (24, ...
 01230   748   NtContinue  (23919920, 1, ...
 01218   896   NtProtectVirtualMemory  ... (0x22ce000), 4096, 4, ) == 0x0
 01219  1024   NtDuplicateObject  ... 256, ) == 0x0
 01220  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 01221  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 01222  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 01223   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 01224  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01225  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 01226  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 01227  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01228  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 01231   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01229   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 01232   748   NtRegisterThreadTerminatePort  (24, ...
 01233   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01234  1024   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01235  1708   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01236  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01237  1300   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ...
 01238   252   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01239  1948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01240  1600   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01241  1372   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01242  2036   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01243  1388   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01231   384   NtDuplicateObject  ... 260, ) == 0x0
 01244   900   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01232   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 01216  2016   NtDuplicateObject  ... 264, ) == 0x0
 01233   896   NtCreateThread  ... 268, {1252, 1324}, ) == 0x0
 01234  1024   NtWaitForSingleObject  ... ) == 0x102
 01235  1708   NtDuplicateObject  ... 272, ) == 0x0
 01236  1096   NtDuplicateObject  ... 276, ) == 0x0
 01237  1300   NtAllocateVirtualMemory  ... 1368064, 4096, ) == 0x0
 01238   252   NtCreateEvent  ... 280, ) == 0x0
 01239  1948   NtCreateEvent  ... 284, ) == 0x0
 01240  1600   NtCreateEvent  ... 288, ) == 0x0
 01241  1372   NtCreateEvent  ... 292, ) == 0x0
 01242  2036   NtCreateEvent  ... 296, ) == 0x0
 01245   384   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01243  1388   NtCreateEvent  ... 300, ) == 0x0
 01246   748   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01247  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01248   896   NtQueryInformationThread  (268, Basic, 28, ...
 01249  1024   NtWaitForSingleObject  (132, 0, 0x0, ...
 01250  1708   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01251  1096   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01252  1300   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01253   252   NtWaitForSingleObject  (280, 0, 0x0, ...
 01254  1948   NtClose  (284, ...
 01255  1600   NtClose  (288, ...
 01256  1372   NtClose  (292, ...
 01257  2036   NtClose  (296, ...
 01245   384   NtCreateEvent  ... 304, ) == 0x0
 01258  1388   NtClose  (300, ...
 01244   900   NtCreateEvent  ... 308, ) == 0x0
 01247  2016   NtCreateEvent  ... 312, ) == 0x0
 01248   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=1324,}, 0x0, ) == 0x0
 01250  1708   NtCreateEvent  ... 316, ) == 0x0
 01251  1096   NtCreateEvent  ... 320, ) == 0x0
 01252  1300   NtCreateEvent  ... 324, ) == 0x0
 01254  1948   NtClose  ... ) == 0x0
 01255  1600   NtClose  ... ) == 0x0
 01256  1372   NtClose  ... ) == 0x0
 01257  2036   NtClose  ... ) == 0x0
 01259   384   NtClose  (304, ...
 01258  1388   NtClose  ... ) == 0x0
 01260   900   NtClose  (308, ...
 01261  2016   NtClose  (312, ...
 01262   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0,\5\0\0" ...  ...
 01263  1708   NtClose  (316, ...
 01264  1096   NtClose  (320, ...
 01265  1300   NtClose  (324, ...
 01266  1948   NtWaitForSingleObject  (280, 0, 0x0, ...
 01267  1600   NtWaitForSingleObject  (280, 0, 0x0, ...
 01268  1372   NtWaitForSingleObject  (280, 0, 0x0, ...
 01269  2036   NtWaitForSingleObject  (280, 0, 0x0, ...
 01246   748   NtCreateEvent  ... 300, ) == 0x0
 01270  1388   NtWaitForSingleObject  (280, 0, 0x0, ...
 01260   900   NtClose  ... ) == 0x0
 01261  2016   NtClose  ... ) == 0x0
 01262   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81869, 0}  ... {28, 56, reply, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0,\5\0\0" )  ) == 0x0
 01263  1708   NtClose  ... ) == 0x0
 01264  1096   NtClose  ... ) == 0x0
 01265  1300   NtClose  ... ) == 0x0
 01271   748   NtClose  (300, ...
 01272   900   NtWaitForSingleObject  (280, 0, 0x0, ...
 01273  2016   NtWaitForSingleObject  (280, 0, 0x0, ...
 01259   384   NtClose  ... ) == 0x0
 01274  1708   NtWaitForSingleObject  (280, 0, 0x0, ...
 01275  1096   NtWaitForSingleObject  (280, 0, 0x0, ...
 01276  1300   NtSetEventBoostPriority  (280, ...
 01271   748   NtClose  ... ) == 0x0
 01277   896   NtResumeThread  (268, ...
 01278   384   NtWaitForSingleObject  (280, 0, 0x0, ...
 01279   748   NtWaitForSingleObject  (280, 0, 0x0, ...
 01277   896   NtResumeThread  ... 1, ) == 0x0
 01280   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 36503552, 1048576, ) == 0x0
 01281   896   NtAllocateVirtualMemory  (-1, 37543936, 0, 8192, 4096, 4, ... 37543936, 8192, ) == 0x0
 01282   896   NtProtectVirtualMemory  (-1, (0x23ce000), 4096, 260, ... (0x23ce000), 4096, 4, ) == 0x0
 01283   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 300, {1252, 1776}, ) == 0x0
 01284   896   NtQueryInformationThread  (300, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa0000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 01253   252   NtWaitForSingleObject  ... ) == 0x0
 01276  1300   NtSetEventBoostPriority  ... ) == 0x0
 01285  1324   NtAllocateVirtualMemory  (-1, 8867840, 0, 4096, 4096, 4, ...
 01286   252   NtSetEventBoostPriority  (280, ...
 01287  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01285  1324   NtAllocateVirtualMemory  ... 8867840, 4096, ) == 0x0
 01266  1948   NtWaitForSingleObject  ... ) == 0x0
 01286   252   NtSetEventBoostPriority  ... ) == 0x0
 01287  1300   NtDuplicateObject  ... 304, ) == 0x0
 01288  1948   NtSetEventBoostPriority  (280, ...
 01289  1324   NtTestAlert  (...
 01290   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" ...  ...
 01267  1600   NtWaitForSingleObject  ... ) == 0x0
 01288  1948   NtSetEventBoostPriority  ... ) == 0x0
 01291  1300   NtWaitForSingleObject  (280, 0, 0x0, ...
 01289  1324   NtTestAlert  ... ) == 0x0
 01292  1600   NtSetEventBoostPriority  (280, ...
 01290   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81870, 0}  ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 01293   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01268  1372   NtWaitForSingleObject  ... ) == 0x0
 01292  1600   NtSetEventBoostPriority  ... ) == 0x0
 01294  1324   NtContinue  (36502832, 1, ...
 01295   896   NtResumeThread  (300, ...
 01296  1372   NtSetEventBoostPriority  (280, ...
 01293   252   NtDuplicateObject  ... 324, ) == 0x0
 01297  1948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01298  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01269  2036   NtWaitForSingleObject  ... ) == 0x0
 01296  1372   NtSetEventBoostPriority  ... ) == 0x0
 01295   896   NtResumeThread  ... 1, ) == 0x0
 01299   252   NtWaitForSingleObject  (280, 0, 0x0, ...
 01297  1948   NtDuplicateObject  ... 320, ) == 0x0
 01300  2036   NtSetEventBoostPriority  (280, ...
 01298  1600   NtDuplicateObject  ... 316, ) == 0x0
 01301  1324   NtRegisterThreadTerminatePort  (24, ...
 01302  1776   NtTestAlert  (...
 01303   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01270  1388   NtWaitForSingleObject  ... ) == 0x0
 01300  2036   NtSetEventBoostPriority  ... ) == 0x0
 01304  1948   NtWaitForSingleObject  (280, 0, 0x0, ...
 01305  1600   NtWaitForSingleObject  (280, 0, 0x0, ...
 01301  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 01302  1776   NtTestAlert  ... ) == 0x0
 01306  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01307  1388   NtSetEventBoostPriority  (280, ...
 01303   896   NtAllocateVirtualMemory  ... 37552128, 1048576, ) == 0x0
 01308  1324   NtWaitForSingleObject  (280, 0, 0x0, ...
 01309  1776   NtContinue  (37551408, 1, ...
 01272   900   NtWaitForSingleObject  ... ) == 0x0
 01307  1388   NtSetEventBoostPriority  ... ) == 0x0
 01306  1372   NtDuplicateObject  ... 312, ) == 0x0
 01310   896   NtAllocateVirtualMemory  (-1, 38592512, 0, 8192, 4096, 4, ...
 01311   900   NtSetEventBoostPriority  (280, ...
 01312  1776   NtRegisterThreadTerminatePort  (24, ...
 01313  2036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01314  1372   NtWaitForSingleObject  (280, 0, 0x0, ...
 01273  2016   NtWaitForSingleObject  ... ) == 0x0
 01311   900   NtSetEventBoostPriority  ... ) == 0x0
 01310   896   NtAllocateVirtualMemory  ... 38592512, 8192, ) == 0x0
 01312  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 01313  2036   NtDuplicateObject  ... 308, ) == 0x0
 01315  2016   NtSetEventBoostPriority  (280, ...
 01316  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01317   896   NtProtectVirtualMemory  (-1, (0x24ce000), 4096, 260, ...
 01318   900   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01274  1708   NtWaitForSingleObject  ... ) == 0x0
 01319  2036   NtWaitForSingleObject  (280, 0, 0x0, ...
 01316  1388   NtDuplicateObject  ... 296, ) == 0x0
 01317   896   NtProtectVirtualMemory  ... (0x24ce000), 4096, 4, ) == 0x0
 01318   900   NtDuplicateObject  ... 292, ) == 0x0
 01320  1708   NtSetEventBoostPriority  (280, ...
 01321  1388   NtWaitForSingleObject  (280, 0, 0x0, ...
 01322   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01323   900   NtWaitForSingleObject  (280, 0, 0x0, ...
 01275  1096   NtWaitForSingleObject  ... ) == 0x0
 01320  1708   NtSetEventBoostPriority  ... ) == 0x0
 01315  2016   NtSetEventBoostPriority  ... ) == 0x0
 01324  1776   NtWaitForSingleObject  (280, 0, 0x0, ...
 01325  1096   NtSetEventBoostPriority  (280, ...
 01326  1708   NtWaitForSingleObject  (280, 0, 0x0, ...
 01327  2016   NtWaitForSingleObject  (280, 0, 0x0, ...
 01278   384   NtWaitForSingleObject  ... ) == 0x0
 01328   384   NtSetEventBoostPriority  (280, ...
 01279   748   NtWaitForSingleObject  ... ) == 0x0
 01329   748   NtSetEventBoostPriority  (280, ...
 01291  1300   NtWaitForSingleObject  ... ) == 0x0
 01330  1300   NtSetEventBoostPriority  (280, ...
 01299   252   NtWaitForSingleObject  ... ) == 0x0
 01331   252   NtSetEventBoostPriority  (280, ...
 01304  1948   NtWaitForSingleObject  ... ) == 0x0
 01332  1948   NtSetEventBoostPriority  (280, ...
 01305  1600   NtWaitForSingleObject  ... ) == 0x0
 01333  1600   NtSetEventBoostPriority  (280, ...
 01308  1324   NtWaitForSingleObject  ... ) == 0x0
 01334  1324   NtSetEventBoostPriority  (280, ...
 01314  1372   NtWaitForSingleObject  ... ) == 0x0
 01335  1372   NtSetEventBoostPriority  (280, ...
 01319  2036   NtWaitForSingleObject  ... ) == 0x0
 01336  2036   NtSetEventBoostPriority  (280, ...
 01321  1388   NtWaitForSingleObject  ... ) == 0x0
 01337  1388   NtSetEventBoostPriority  (280, ...
 01323   900   NtWaitForSingleObject  ... ) == 0x0
 01338   900   NtSetEventBoostPriority  (280, ...
 01324  1776   NtWaitForSingleObject  ... ) == 0x0
 01339  1776   NtSetEventBoostPriority  (280, ...
 01326  1708   NtWaitForSingleObject  ... ) == 0x0
 01340  1708   NtSetEventBoostPriority  (280, ...
 01327  2016   NtWaitForSingleObject  ... ) == 0x0
 01341  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... 288, ) }, ... 288, ) == 0x0
 01340  1708   NtSetEventBoostPriority  ... ) == 0x0
 01339  1776   NtSetEventBoostPriority  ... ) == 0x0
 01338   900   NtSetEventBoostPriority  ... ) == 0x0
 01337  1388   NtSetEventBoostPriority  ... ) == 0x0
 01336  2036   NtSetEventBoostPriority  ... ) == 0x0
 01335  1372   NtSetEventBoostPriority  ... ) == 0x0
 01334  1324   NtSetEventBoostPriority  ... ) == 0x0
 01333  1600   NtSetEventBoostPriority  ... ) == 0x0
 01332  1948   NtSetEventBoostPriority  ... ) == 0x0
 01331   252   NtSetEventBoostPriority  ... ) == 0x0
 01330  1300   NtSetEventBoostPriority  ... ) == 0x0
 01329   748   NtSetEventBoostPriority  ... ) == 0x0
 01328   384   NtSetEventBoostPriority  ... ) == 0x0
 01325  1096   NtSetEventBoostPriority  ... ) == 0x0
 01322   896   NtCreateThread  ... 284, {1252, 500}, ) == 0x0
 01342  2016   NtQueryValueKey  (288,  (288, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01343  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01344  1708   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01345   900   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01346  1388   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01347  2036   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01348  1372   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01349  1324   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01350  1600   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01351  1948   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01352   252   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01353  1300   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01354   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01355  1096   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01356   896   NtQueryInformationThread  (284, Basic, 28, ...
 01342  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01357   384   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ...
 01344  1708   NtWaitForSingleObject  ... ) == 0x102
 01345   900   NtWaitForSingleObject  ... ) == 0x102
 01346  1388   NtWaitForSingleObject  ... ) == 0x102
 01347  2036   NtWaitForSingleObject  ... ) == 0x102
 01348  1372   NtWaitForSingleObject  ... ) == 0x102
 01349  1324   NtDuplicateObject  ... 328, ) == 0x0
 01350  1600   NtWaitForSingleObject  ... ) == 0x102
 01351  1948   NtWaitForSingleObject  ... ) == 0x102
 01352   252   NtWaitForSingleObject  ... ) == 0x102
 01353  1300   NtWaitForSingleObject  ... ) == 0x102
 01354   748   NtDuplicateObject  ... 332, ) == 0x0
 01356   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 01358  2016   NtClose  (288, ...
 01357   384   NtAllocateVirtualMemory  ... 1372160, 4096, ) == 0x0
 01359  1708   NtWaitForSingleObject  (132, 0, 0x0, ...
 01360   900   NtWaitForSingleObject  (280, 0, 0x0, ...
 01361  1388   NtWaitForSingleObject  (280, 0, 0x0, ...
 01362  2036   NtWaitForSingleObject  (280, 0, 0x0, ...
 01363  1372   NtWaitForSingleObject  (280, 0, 0x0, ...
 01364  1324   NtWaitForSingleObject  (280, 0, 0x0, ...
 01365  1600   NtWaitForSingleObject  (280, 0, 0x0, ...
 01366  1948   NtWaitForSingleObject  (280, 0, 0x0, ...
 01367   252   NtWaitForSingleObject  (280, 0, 0x0, ...
 01368  1300   NtWaitForSingleObject  (280, 0, 0x0, ...
 01369   748   NtWaitForSingleObject  (280, 0, 0x0, ...
 01370   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\364\1\0\0" ...  ...
 01358  2016   NtClose  ... ) == 0x0
 01371   384   NtSetEventBoostPriority  (280, ...
 01370   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81871, 0}  ... {28, 56, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 01372  2016   NtWaitForSingleObject  (280, 0, 0x0, ...
 01360   900   NtWaitForSingleObject  ... ) == 0x0
 01371   384   NtSetEventBoostPriority  ... ) == 0x0
 01343  1776   NtDuplicateObject  ... 288, ) == 0x0
 01355  1096   NtWaitForSingleObject  ... ) == 0x102
 01373   900   NtSetEventBoostPriority  (280, ...
 01374   384   NtWaitForSingleObject  (280, 0, 0x0, ...
 01375  1776   NtWaitForSingleObject  (280, 0, 0x0, ...
 01361  1388   NtWaitForSingleObject  ... ) == 0x0
 01373   900   NtSetEventBoostPriority  ... ) == 0x0
 01376  1096   NtWaitForSingleObject  (280, 0, 0x0, ...
 01377  1388   NtSetEventBoostPriority  (280, ...
 01378   896   NtResumeThread  (284, ...
 01362  2036   NtWaitForSingleObject  ... ) == 0x0
 01377  1388   NtSetEventBoostPriority  ... ) == 0x0
 01379  2036   NtSetEventBoostPriority  (280, ...
 01378   896   NtResumeThread  ... 1, ) == 0x0
 01380   900   NtWaitForSingleObject  (132, 0, 0x0, ...
 01363  1372   NtWaitForSingleObject  ... ) == 0x0
 01379  2036   NtSetEventBoostPriority  ... ) == 0x0
 01381   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01382  1372   NtSetEventBoostPriority  (280, ...
 01383  1388   NtWaitForSingleObject  (132, 0, 0x0, ...
 01384   500   NtTestAlert  (...
 01364  1324   NtWaitForSingleObject  ... ) == 0x0
 01382  1372   NtSetEventBoostPriority  ... ) == 0x0
 01381   896   NtAllocateVirtualMemory  ... 38600704, 1048576, ) == 0x0
 01385  1324   NtSetEventBoostPriority  (280, ...
 01384   500   NtTestAlert  ... ) == 0x0
 01386  2036   NtWaitForSingleObject  (132, 0, 0x0, ...
 01365  1600   NtWaitForSingleObject  ... ) == 0x0
 01385  1324   NtSetEventBoostPriority  ... ) == 0x0
 01387   896   NtAllocateVirtualMemory  (-1, 39641088, 0, 8192, 4096, 4, ...
 01388   500   NtContinue  (38599984, 1, ...
 01389  1600   NtSetEventBoostPriority  (280, ...
 01390  1372   NtWaitForSingleObject  (132, 0, 0x0, ...
 01387   896   NtAllocateVirtualMemory  ... 39641088, 8192, ) == 0x0
 01366  1948   NtWaitForSingleObject  ... ) == 0x0
 01389  1600   NtSetEventBoostPriority  ... ) == 0x0
 01391   500   NtRegisterThreadTerminatePort  (24, ...
 01392  1324   NtWaitForSingleObject  (280, 0, 0x0, ...
 01393  1948   NtSetEventBoostPriority  (280, ...
 01394   896   NtProtectVirtualMemory  (-1, (0x25ce000), 4096, 260, ...
 01391   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 01367   252   NtWaitForSingleObject  ... ) == 0x0
 01393  1948   NtSetEventBoostPriority  ... ) == 0x0
 01394   896   NtProtectVirtualMemory  ... (0x25ce000), 4096, 4, ) == 0x0
 01395  1600   NtWaitForSingleObject  (132, 0, 0x0, ...
 01396   252   NtSetEventBoostPriority  (280, ...
 01397   500   NtWaitForSingleObject  (280, 0, 0x0, ...
 01398   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01368  1300   NtWaitForSingleObject  ... ) == 0x0
 01396   252   NtSetEventBoostPriority  ... ) == 0x0
 01399  1300   NtSetEventBoostPriority  (280, ...
 01398   896   NtCreateThread  ... 336, {1252, 248}, ) == 0x0
 01400  1948   NtWaitForSingleObject  (132, 0, 0x0, ...
 01369   748   NtWaitForSingleObject  ... ) == 0x0
 01399  1300   NtSetEventBoostPriority  ... ) == 0x0
 01401   896   NtQueryInformationThread  (336, Basic, 28, ...
 01402   748   NtSetEventBoostPriority  (280, ...
 01403   252   NtWaitForSingleObject  (132, 0, 0x0, ...
 01372  2016   NtWaitForSingleObject  ... ) == 0x0
 01402   748   NtSetEventBoostPriority  ... ) == 0x0
 01401   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 01404  2016   NtSetEventBoostPriority  (280, ...
 01405  1300   NtWaitForSingleObject  (132, 0, 0x0, ...
 01406   748   NtWaitForSingleObject  (280, 0, 0x0, ...
 01374   384   NtWaitForSingleObject  ... ) == 0x0
 01404  2016   NtSetEventBoostPriority  ... ) == 0x0
 01407   384   NtSetEventBoostPriority  (280, ...
 01408   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0\370\0\0\0" ...  ...
 01375  1776   NtWaitForSingleObject  ... ) == 0x0
 01407   384   NtSetEventBoostPriority  ... ) == 0x0
 01409  1776   NtSetEventBoostPriority  (280, ...
 01408   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81872, 0}  ... {28, 56, reply, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 01410  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01376  1096   NtWaitForSingleObject  ... ) == 0x0
 01409  1776   NtSetEventBoostPriority  ... ) == 0x0
 01411   896   NtResumeThread  (336, ...
 01412  1096   NtSetEventBoostPriority  (280, ...
 01410  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01413   384   NtWaitForSingleObject  (280, 0, 0x0, ...
 01392  1324   NtWaitForSingleObject  ... ) == 0x0
 01412  1096   NtSetEventBoostPriority  ... ) == 0x0
 01411   896   NtResumeThread  ... 1, ) == 0x0
 01414  2016   NtOpenThreadToken  (-2, 0x20008, 1, ...
 01415  1324   NtSetEventBoostPriority  (280, ...
 01416  1776   NtWaitForSingleObject  (280, 0, 0x0, ...
 01417   248   NtTestAlert  (...
 01418   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01397   500   NtWaitForSingleObject  ... ) == 0x0
 01415  1324   NtSetEventBoostPriority  ... ) == 0x0
 01414  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01417   248   NtTestAlert  ... ) == 0x0
 01419  1096   NtWaitForSingleObject  (132, 0, 0x0, ...
 01420   500   NtSetEventBoostPriority  (280, ...
 01421  1324   NtWaitForSingleObject  (280, 0, 0x0, ...
 01422  2016   NtWaitForSingleObject  (280, 0, 0x0, ...
 01423   248   NtContinue  (39648560, 1, ...
 01406   748   NtWaitForSingleObject  ... ) == 0x0
 01420   500   NtSetEventBoostPriority  ... ) == 0x0
 01418   896   NtAllocateVirtualMemory  ... 39649280, 1048576, ) == 0x0
 01424   748   NtSetEventBoostPriority  (280, ...
 01425   248   NtRegisterThreadTerminatePort  (24, ...
 01426   500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01413   384   NtWaitForSingleObject  ... ) == 0x0
 01424   748   NtSetEventBoostPriority  ... ) == 0x0
 01427   896   NtAllocateVirtualMemory  (-1, 40689664, 0, 8192, 4096, 4, ...
 01425   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 01428   384   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01429   748   NtWaitForSingleObject  (280, 0, 0x0, ...
 01427   896   NtAllocateVirtualMemory  ... 40689664, 8192, ) == 0x0
 01426   500   NtDuplicateObject  ... 340, ) == 0x0
 01428   384   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01430   248   NtWaitForSingleObject  (280, 0, 0x0, ...
 01431   896   NtProtectVirtualMemory  (-1, (0x26ce000), 4096, 260, ...
 01432   384   NtSetEventBoostPriority  (280, ...
 01433   500   NtWaitForSingleObject  (280, 0, 0x0, ...
 01431   896   NtProtectVirtualMemory  ... (0x26ce000), 4096, 4, ) == 0x0
 01434   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 344, {1252, 1884}, ) == 0x0
 01435   896   NtQueryInformationThread  (344, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 01436   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81873, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 01416  1776   NtWaitForSingleObject  ... ) == 0x0
 01432   384   NtSetEventBoostPriority  ... ) == 0x0
 01437  1776   NtSetEventBoostPriority  (280, ...
 01438   384   NtWaitForSingleObject  (280, 0, 0x0, ...
 01422  2016   NtWaitForSingleObject  ... ) == 0x0
 01437  1776   NtSetEventBoostPriority  ... ) == 0x0
 01439  2016   NtSetEventBoostPriority  (280, ...
 01421  1324   NtWaitForSingleObject  ... ) == 0x0
 01440  1324   NtSetEventBoostPriority  (280, ...
 01430   248   NtWaitForSingleObject  ... ) == 0x0
 01441   248   NtSetEventBoostPriority  (280, ...
 01429   748   NtWaitForSingleObject  ... ) == 0x0
 01442   748   NtSetEventBoostPriority  (280, ...
 01433   500   NtWaitForSingleObject  ... ) == 0x0
 01443   500   NtSetEventBoostPriority  (280, ...
 01438   384   NtWaitForSingleObject  ... ) == 0x0
 01444   384   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 348, {status=0x0, info=0}, ) }, 7, 16, ... 348, {status=0x0, info=0}, ) == 0x0
 01443   500   NtSetEventBoostPriority  ... ) == 0x0
 01441   248   NtSetEventBoostPriority  ... ) == 0x0
 01439  2016   NtSetEventBoostPriority  ... ) == 0x0
 01445  1776   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01442   748   NtSetEventBoostPriority  ... ) == 0x0
 01440  1324   NtSetEventBoostPriority  ... ) == 0x0
 01446   896   NtResumeThread  (344, ...
 01447   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355\201\30\244\241\2455\23\35R\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01448   248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01449   500   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01450  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11071600, ... }, 11071600, ...
 01451   748   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01452  1324   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01446   896   NtResumeThread  ... 1, ) == 0x0
 01453   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01445  1776   NtWaitForSingleObject  ... ) == 0x102
 01454  1884   NtWaitForSingleObject  (92, 0, 0x0, ...
 01449   500   NtWaitForSingleObject  ... ) == 0x102
 01450  2016   NtQueryAttributesFile  ... ) == 0x0
 01455   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01453   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01456  1776   NtWaitForSingleObject  (132, 0, 0x0, ...
 01457   500   NtWaitForSingleObject  (132, 0, 0x0, ...
 01458  2016   NtSetEventBoostPriority  (92, ...
 01455   896   NtAllocateVirtualMemory  ... 40697856, 1048576, ) == 0x0
 01459   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01454  1884   NtWaitForSingleObject  ... ) == 0x0
 01458  2016   NtSetEventBoostPriority  ... ) == 0x0
 01460   896   NtAllocateVirtualMemory  (-1, 41738240, 0, 8192, 4096, 4, ...
 01461  1884   NtTestAlert  (...
 01459   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01462  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01461  1884   NtTestAlert  ... ) == 0x0
 01460   896   NtAllocateVirtualMemory  ... 41738240, 8192, ) == 0x0
 01463   384   NtQuerySystemInformation  (Performance, 312, ...
 01462  2016   NtOpenKey  ... 352, ) == 0x0
 01448   248   NtDuplicateObject  ... 356, ) == 0x0
 01451   748   NtWaitForSingleObject  ... ) == 0x102
 01452  1324   NtWaitForSingleObject  ... ) == 0x102
 01464  1884   NtContinue  (40697136, 1, ...
 01465   896   NtProtectVirtualMemory  (-1, (0x27ce000), 4096, 260, ...
 01463   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01466   248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01467   748   NtWaitForSingleObject  (132, 0, 0x0, ...
 01468  1324   NtWaitForSingleObject  (132, 0, 0x0, ...
 01469  1884   NtRegisterThreadTerminatePort  (24, ...
 01465   896   NtProtectVirtualMemory  ... (0x27ce000), 4096, 4, ) == 0x0
 01470   384   NtQuerySystemInformation  (Exception, 16, ...
 01466   248   NtWaitForSingleObject  ... ) == 0x102
 01469  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 01471   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01470   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01472   248   NtWaitForSingleObject  (132, 0, 0x0, ...
 01473  1884   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01471   896   NtCreateThread  ... 360, {1252, 1308}, ) == 0x0
 01474   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01473  1884   NtDuplicateObject  ... 364, ) == 0x0
 01475   896   NtQueryInformationThread  (360, Basic, 28, ...
 01474   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01476  1884   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01475   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 01477   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01478  2016   NtQueryValueKey  (352,  (352, "Transports", Partial, 144, ... , Partial, 144, ...
 01476  1884   NtWaitForSingleObject  ... ) == 0x102
 01479   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\34\5\0\0" ...  ...
 01478  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01480  1884   NtWaitForSingleObject  (132, 0, 0x0, ...
 01479   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81874, 0}  ... {28, 56, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 01481  2016   NtQueryValueKey  (352,  (352, "Transports", Partial, 144, ... , Partial, 144, ...
 01482   896   NtResumeThread  (360, ...
 01481  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01482   896   NtResumeThread  ... 1, ) == 0x0
 01483  2016   NtClose  (352, ...
 01484   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01483  2016   NtClose  ... ) == 0x0
 01477   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01485  1308   NtTestAlert  (...
 01484   896   NtAllocateVirtualMemory  ... 41746432, 1048576, ) == 0x0
 01486   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01485  1308   NtTestAlert  ... ) == 0x0
 01487   896   NtAllocateVirtualMemory  (-1, 42786816, 0, 8192, 4096, 4, ...
 01486   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01488  1308   NtContinue  (41745712, 1, ...
 01487   896   NtAllocateVirtualMemory  ... 42786816, 8192, ) == 0x0
 01489  1308   NtRegisterThreadTerminatePort  (24, ...
 01490   896   NtProtectVirtualMemory  (-1, (0x28ce000), 4096, 260, ...
 01489  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 01490   896   NtProtectVirtualMemory  ... (0x28ce000), 4096, 4, ) == 0x0
 01491  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01492   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01493   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01491  2016   NtOpenKey  ... 352, ) == 0x0
 01492   384   NtCreateKey  ... -2147482748, 2, ) == 0x0
 01494  1308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01495  2016   NtQueryValueKey  (352,  (352, "Mapping", Partial, 144, ... , Partial, 144, ...
 01496   384   NtSetValueKey  (-2147482748,  (-2147482748, "Seed", 0, 3, "\37G\333\377N\256\13\262\206\22T\244\300Z<\11\213\371\333\263\271g\362\373\323\11\342 \266\354\312H\2\221S\2062\224\312>\314\206\34\340\377\314\311\7\303[J\311g\265\261\363\265\252\214\273\352\15\270`\225\24\252\342\5yU)\203\362=H\21\221`\37", 80, ... , 0, 3,  (-2147482748, "Seed", 0, 3, "\37G\333\377N\256\13\262\206\22T\244\300Z<\11\213\371\333\263\271g\362\373\323\11\342 \266\354\312H\2\221S\2062\224\312>\314\206\34\340\377\314\311\7\303[J\311g\265\261\363\265\252\214\273\352\15\270`\225\24\252\342\5yU)\203\362=H\21\221`\37", 80, ... , 80, ...
 01494  1308   NtDuplicateObject  ... 368, ) == 0x0
 01495  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01496   384   NtSetValueKey  ... ) == 0x0
 01497  1308   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01498  2016   NtQueryValueKey  (352,  (352, "Mapping", Partial, 144, ... , Partial, 144, ...
 01499   384   NtClose  (-2147482748, ...
 01497  1308   NtWaitForSingleObject  ... ) == 0x102
 01498  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01499   384   NtClose  ... ) == 0x0
 01500  1308   NtWaitForSingleObject  (132, 0, 0x0, ...
 01493   896   NtCreateThread  ... 372, {1252, 1676}, ) == 0x0
 01501  2016   NtQueryValueKey  (352,  (352, "Mapping", Partial, 152, ... , Partial, 152, ...
 01447   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\343\236\314\232\363-VY\271\2232d\14fF\214\252\12\350\206g\276\251\271\314^\226\300\221\244P'\243\341\38Kq\277\344"\202'\251]"\377\253B\11\375e$aI\247\\265\217\317\302PZ\7\226\237r\313\3\26A:\22\253\357\333\223\15\25\30071-\69\277\22\333\334\234\323y]y\11P\27i\332\~G\213$;\253\267?\27x\335\324\271\300\264\263H\11\316\35\236c1\355\231\270\307D\30k\264\7\231%\216J%]cVZc\275@\3419M\365b]\373X\342/\203+\256/\334F\277\367z\256U\356\256Y+\246'\266\35LR\334\211\277\221`\366\337\15'\205\261\325[\207=\203\274)0\33\345u\13\34\34\27\13\326\255\307n\237U*\335\31 \274Q\353mh!\240\322\305`\230\351ig\23\14\276\254w$fFsV\352\235\34\375\232\207\275[\321\317\354\35\33&\2\0~3", ) \202'\251] ... {status=0x0, info=256}, "\343\236\314\232\363-VY\271\2232d\14fF\214\252\12\350\206g\276\251\271\314^\226\300\221\244P'\243\341\38Kq\277\344"\202'\251]"\377\253B\11\375e$aI\247\\265\217\317\302PZ\7\226\237r\313\3\26A:\22\253\357\333\223\15\25\30071-\69\277\22\333\334\234\323y]y\11P\27i\332\~G\213$;\253\267?\27x\335\324\271\300\264\263H\11\316\35\236c1\355\231\270\307D\30k\264\7\231%\216J%]cVZc\275@\3419M\365b]\373X\342/\203+\256/\334F\277\367z\256U\356\256Y+\246'\266\35LR\334\211\277\221`\366\337\15'\205\261\325[\207=\203\274)0\33\345u\13\34\34\27\13\326\255\307n\237U*\335\31 \274Q\353mh!\240\322\305`\230\351ig\23\14\276\254w$fFsV\352\235\34\375\232\207\275[\321\317\354\35\33&\2\0~3", ) , ) == 0x0
 01502   896   NtQueryInformationThread  (372, Basic, 28, ...
 01501  2016   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01503   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01502   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 01504  2016   NtClose  (352, ...
 01503   384   NtCreateEvent  ... 376, ) == 0x0
 01505   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\1\0\0\344\4\0\0\214\6\0\0" ...  ...
 01504  2016   NtClose  ... ) == 0x0
 01506   384   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01505   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81875, 0}  ... {28, 56, reply, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\1\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 01507  2016   NtWaitForSingleObject  (280, 0, 0x0, ...
 01506   384   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01508   384   NtSetEventBoostPriority  (280, ...
 01507  2016   NtWaitForSingleObject  ... ) == 0x0
 01509  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 352, ) }, ... 352, ) == 0x0
 01510  2016   NtQueryValueKey  (352,  (352, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (352, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01511  2016   NtQueryValueKey  (352,  (352, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (352, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01512  2016   NtQueryValueKey  (352,  (352, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (352, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01508   384   NtSetEventBoostPriority  ... ) == 0x0
 01513   896   NtResumeThread  (372, ...
 01514   384   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15527428, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15527428, 188, ...
 01513   896   NtResumeThread  ... 1, ) == 0x0
 01515   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 42795008, 1048576, ) == 0x0
 01516   896   NtAllocateVirtualMemory  (-1, 43835392, 0, 8192, 4096, 4, ... 43835392, 8192, ) == 0x0
 01514   384   NtConnectPort  ... 380, 0x0, 0x0, 0x0, 188, ) == 0x0
 01517  2016   NtQueryValueKey  (352,  (352, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01518  1676   NtTestAlert  (...
 01519   384   NtRequestWaitReplyPort  (380, {200, 224, new_msg, 0, 1380344, 12, 2, 1}  (380, {200, 224, new_msg, 0, 1380344, 12, 2, 1} "\0\2\24\0\274\0\0\0\4>\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\330\1\24\0\4\0\0\0\1\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\1\0\0\0:\234\243\370\355\307\3248x\17\25\0\\1\24\0\12\0\0\0\0\0\0\0\0\20\0\0(\0\0\0\200\17\25\0R\3577\17\0\2\24\0\240\17\25\0\\1\24\0\0\0\0\0\0\0\0\0\240\17\25\0P\0\0\0\250\17\25\0\360\6\221|\330\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\354\0\372\31\221|\30\364\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01517  2016   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01518  1676   NtTestAlert  ... ) == 0x0
 01520  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11072556, ... }, 11072556, ...
 01521  1676   NtContinue  (42794288, 1, ...
 01520  2016   NtQueryAttributesFile  ... ) == 0x0
 01522  1676   NtRegisterThreadTerminatePort  (24, ...
 01523  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01522  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 01523  2016   NtOpenFile  ... 384, {status=0x0, info=1}, ) == 0x0
 01524   896   NtProtectVirtualMemory  (-1, (0x29ce000), 4096, 260, ...
 01519   384   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 384, 81877, 0}  ... {200, 224, reply, 0, 1252, 384, 81877, 0} "\7\2\24\0\274\0\0\0\4>\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\1\0\0\0:\234\243\370\355\307\3248x\17\25\0\\1\24\0\12\0\0\0\0\0\0\0\0\20\0\0(\0\0\0\200\17\25\0R\3577\17\0\2\24\0\240\17\25\0\\1\24\0\0\0\0\0\0\0\0\0\240\17\25\0P\0\0\0\250\17\25\0\360\6\221|\330\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\354\0\372\31\221|\30\364\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01525  1676   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01524   896   NtProtectVirtualMemory  ... (0x29ce000), 4096, 4, ) == 0x0
 01526   384   NtRequestWaitReplyPort  (380, {64, 88, new_msg, 0, 0, 0, 0, 0}  (380, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 01525  1676   NtDuplicateObject  ... 388, ) == 0x0
 01527   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01528  1676   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01527   896   NtCreateThread  ... 392, {1252, 1620}, ) == 0x0
 01526   384   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 384, 81878, 0}  ... {52, 76, reply, 0, 1252, 384, 81878, 0} "\2\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\37\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 01528  1676   NtWaitForSingleObject  ... ) == 0x102
 01529   896   NtQueryInformationThread  (392, Basic, 28, ...
 01530   384   NtClose  (376, ...
 01531  1676   NtWaitForSingleObject  (132, 0, 0x0, ...
 01529   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 01530   384   NtClose  ... ) == 0x0
 01532  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 384, ...
 01533   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0T\6\0\0" ...  ...
 01532  2016   NtCreateSection  ... 376, ) == 0x0
 01533   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 01534  2016   NtClose  (384, ...
 01535   896   NtResumeThread  (392, ...
 01534  2016   NtClose  ... ) == 0x0
 01535   896   NtResumeThread  ... 1, ) == 0x0
 01536  2016   NtMapViewOfSection  (376, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01537   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01536  2016   NtMapViewOfSection  ... (0x860000), 0x0, 20480, ) == 0x0
 01538   384   NtClose  (380, ...
 01539  1620   NtWaitForSingleObject  (92, 0, 0x0, ...
 01537   896   NtAllocateVirtualMemory  ... 43843584, 1048576, ) == 0x0
 01538   384   NtClose  ... ) == 0x0
 01540   896   NtAllocateVirtualMemory  (-1, 44883968, 0, 8192, 4096, 4, ...
 01541   384   NtWaitForSingleObject  (92, 0, 0x0, ...
 01540   896   NtAllocateVirtualMemory  ... 44883968, 8192, ) == 0x0
 01542   896   NtProtectVirtualMemory  (-1, (0x2ace000), 4096, 260, ... (0x2ace000), 4096, 4, ) == 0x0
 01543   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 380, {1252, 1296}, ) == 0x0
 01544   896   NtQueryInformationThread  (380, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 01545   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0\20\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 01546  2016   NtClose  (376, ... ) == 0x0
 01547   896   NtResumeThread  (380, ... 1, ) == 0x0
 01548   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 44892160, 1048576, ) == 0x0
 01549   896   NtAllocateVirtualMemory  (-1, 45932544, 0, 8192, 4096, 4, ...
 01550  2016   NtUnmapViewOfSection  (-1, 0x860000, ... ) == 0x0
 01551  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11072864, ... ) }, 11072864, ... ) == 0x0
 01552  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 376, {status=0x0, info=1}, ) }, 5, 96, ... 376, {status=0x0, info=1}, ) == 0x0
 01553  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 376, ... 384, ) == 0x0
 01549   896   NtAllocateVirtualMemory  ... 45932544, 8192, ) == 0x0
 01554  1296   NtWaitForSingleObject  (92, 0, 0x0, ...
 01555  2016   NtQuerySection  (384, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01556  2016   NtClose  (376, ... ) == 0x0
 01557  2016   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01558  2016   NtClose  (384, ... ) == 0x0
 01559  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ... (0x71a91000), 4096, 32, ) == 0x0
 01560   896   NtProtectVirtualMemory  (-1, (0x2bce000), 4096, 260, ... (0x2bce000), 4096, 4, ) == 0x0
 01561   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 384, {1252, 440}, ) == 0x0
 01562   896   NtQueryInformationThread  (384, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 01563  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 01564  2016   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 01565  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01566  2016   NtSetEventBoostPriority  (92, ...
 01539  1620   NtWaitForSingleObject  ... ) == 0x0
 01567  1620   NtSetEventBoostPriority  (92, ...
 01541   384   NtWaitForSingleObject  ... ) == 0x0
 01568   384   NtSetEventBoostPriority  (92, ...
 01554  1296   NtWaitForSingleObject  ... ) == 0x0
 01569  1296   NtTestAlert  (... ) == 0x0
 01568   384   NtSetEventBoostPriority  ... ) == 0x0
 01567  1620   NtSetEventBoostPriority  ... ) == 0x0
 01566  2016   NtSetEventBoostPriority  ... ) == 0x0
 01570   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0\270\1\0\0" ...  ...
 01571  1296   NtContinue  (44891440, 1, ...
 01572   384   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01573  2016   NtClose  (352, ...
 01570   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 01574  1296   NtRegisterThreadTerminatePort  (24, ...
 01572   384   NtCreateKey  ... 376, 2, ) == 0x0
 01573  2016   NtClose  ... ) == 0x0
 01575   896   NtResumeThread  (384, ...
 01574  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 01576   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01577  1620   NtTestAlert  (...
 01575   896   NtResumeThread  ... 1, ) == 0x0
 01578  1296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01576   384   NtOpenKey  ... 352, ) == 0x0
 01577  1620   NtTestAlert  ... ) == 0x0
 01579   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01578  1296   NtDuplicateObject  ... 396, ) == 0x0
 01580   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01581  1620   NtContinue  (43842864, 1, ...
 01582  2016   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11075200, 67, ... }, 0x0, 0, 3, 3, 0, 11075200, 67, ...
 01583   440   NtTestAlert  (...
 01584  1296   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01580   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01585  1620   NtRegisterThreadTerminatePort  (24, ...
 01582  2016   NtCreateFile  ... 400, {status=0x0, info=0}, ) == 0x0
 01583   440   NtTestAlert  ... ) == 0x0
 01579   896   NtAllocateVirtualMemory  ... 45940736, 1048576, ) == 0x0
 01584  1296   NtWaitForSingleObject  ... ) == 0x102
 01585  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 01586  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x1207b,  (400, 108, 0x0, 0x0, 0x1207b, "\7\0\0\0x\1\24\0\340\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 01587   440   NtContinue  (45940016, 1, ...
 01588   896   NtAllocateVirtualMemory  (-1, 46981120, 0, 8192, 4096, 4, ...
 01589  1296   NtWaitForSingleObject  (132, 0, 0x0, ...
 01590  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01586  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01591   440   NtRegisterThreadTerminatePort  (24, ...
 01588   896   NtAllocateVirtualMemory  ... 46981120, 8192, ) == 0x0
 01592   384   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... , Partial, 144, ...
 01593  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x1207b,  (400, 108, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", 16, 16, ... , 16, 16, ...
 01591   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 01594   896   NtProtectVirtualMemory  (-1, (0x2cce000), 4096, 260, ...
 01592   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01593  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01590  1620   NtDuplicateObject  ... 404, ) == 0x0
 01594   896   NtProtectVirtualMemory  ... (0x2cce000), 4096, 4, ) == 0x0
 01595   384   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... , Partial, 144, ...
 01596   440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01597  1620   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01598   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01595   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01596   440   NtDuplicateObject  ... 408, ) == 0x0
 01597  1620   NtWaitForSingleObject  ... ) == 0x102
 01599  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x12047,  (400, 108, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 01600   384   NtClose  (376, ...
 01601   440   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01602  1620   NtWaitForSingleObject  (132, 0, 0x0, ...
 01599  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 01600   384   NtClose  ... ) == 0x0
 01601   440   NtWaitForSingleObject  ... ) == 0x102
 01603  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ...
 01598   896   NtCreateThread  ... 376, {1252, 1588}, ) == 0x0
 01604   440   NtWaitForSingleObject  (132, 0, 0x0, ...
 01603  2016   NtWaitForSingleObject  ... ) == 0x102
 01605   896   NtQueryInformationThread  (376, Basic, 28, ...
 01606   384   NtClose  (352, ...
 01607  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x12003,  (400, 108, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 01605   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 01606   384   NtClose  ... ) == 0x0
 01608   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\04\6\0\0" ...  ...
 01609   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341e\353\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01608   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 01610   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01607  2016   NtDeviceIoControlFile  ... {status=0x0, info=352},  ... {status=0x0, info=352}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01610   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01611  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x12047,  (400, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01612   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01611  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01613   896   NtResumeThread  (376, ...
 01614  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x12037,  (400, 108, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 01613   896   NtResumeThread  ... 1, ) == 0x0
 01614  2016   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01615   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01612   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01616  1588   NtTestAlert  (...
 01615   896   NtAllocateVirtualMemory  ... 46989312, 1048576, ) == 0x0
 01617   384   NtQuerySystemInformation  (Performance, 312, ...
 01616  1588   NtTestAlert  ... ) == 0x0
 01618   896   NtAllocateVirtualMemory  (-1, 48029696, 0, 8192, 4096, 4, ...
 01617   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01619  1588   NtContinue  (46988592, 1, ...
 01618   896   NtAllocateVirtualMemory  ... 48029696, 8192, ) == 0x0
 01620   384   NtQuerySystemInformation  (Exception, 16, ...
 01621  1588   NtRegisterThreadTerminatePort  (24, ...
 01622  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x1200b,  (400, 108, 0x0, 0x0, 0x1200b, "\0\376\250\0\5\0\0\0\0\256\24\0", 12, 0, ... , 12, 0, ...
 01620   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01621  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01622  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01623   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01624   896   NtProtectVirtualMemory  (-1, (0x2dce000), 4096, 260, ...
 01625  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x12047,  (400, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\250\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01626  1588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01624   896   NtProtectVirtualMemory  ... (0x2dce000), 4096, 4, ) == 0x0
 01625  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01626  1588   NtDuplicateObject  ... 412, ) == 0x0
 01627   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01628  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 01629  1588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01627   896   NtCreateThread  ... 416, {1252, 2044}, ) == 0x0
 01628  2016   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01629  1588   NtWaitForSingleObject  ... ) == 0x102
 01630   896   NtQueryInformationThread  (416, Basic, 28, ...
 01623   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01631  1588   NtWaitForSingleObject  (132, 0, 0x0, ...
 01630   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 01632   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01633  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01632   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01633  2016   NtCreateEvent  ... 420, ) == 0x0
 01634   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01635  2016   NtWaitForSingleObject  (420, 0, 0x0, ...
 01634   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01636   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482764, 2, ) }, 0, 0x0, 0, ... -2147482764, 2, ) == 0x0
 01637   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\16\230?\262\4\364\371A9\327\322\264\373\33Qc\367\214,7V\356\275s\243z\337v\333\302\203\314tb\356\315E\351\274/\334\254\245d8UR_n\301\212\268\214\253{\302\276\220\20d\270g\211\3335p\226\354\217\2602R\271\223\241\316-\34y", 80, ... ) , 0, 3,  (-2147482764, "Seed", 0, 3, "\16\230?\262\4\364\371A9\327\322\264\373\33Qc\367\214,7V\356\275s\243z\337v\333\302\203\314tb\356\315E\351\274/\334\254\245d8UR_n\301\212\268\214\253{\302\276\220\20d\270g\211\3335p\226\354\217\2602R\271\223\241\316-\34y", 80, ... ) , 80, ... ) == 0x0
 01638   384   NtClose  (-2147482764, ... ) == 0x0
 01609   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\273\272\370'\225\234\334\25\233C\320VM\320\2\323\15\222<5\205x\310spE$\205\372N\01\331\343\354)\275\232\253\16s\310\273\276\341\266e\336'\213\322\232\310--I\273\313j\311\334\227\3251\365\22\261J\253L \252\3t\363\362X\227/J\326>\247\354\12\301=4\236\304\372Q\370\270\6d\341\372oxU\352\373\311\350@#\254\346\334\254\240\14p\367'\322\2471+\305\244xJ\275\252\4\246\247=\276\37\32\34\223\340\313c\26'\302\326\322-\276\7> \250\203\350|>\302\316\247Lq\225>\\314\243\364\200\316\311\242\2\202\254\230\351\234\201B8\202'\7d\273\36\345DW\26iB\301\27\244\3111\345\201\10\25+\327\262\220-\0\350\20\326\371NQ\266;\13\232\300z\257\252x4n\15#\327z\256\12/\203\215\10\264\377\221La\350\26h\257'\235\32\361\317\212\33\235+%p\317_\342k", ) , ) == 0x0
 01639   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\374\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 01640   896   NtResumeThread  (416, ... 1, ) == 0x0
 01641   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 48037888, 1048576, ) == 0x0
 01642   896   NtAllocateVirtualMemory  (-1, 49078272, 0, 8192, 4096, 4, ... 49078272, 8192, ) == 0x0
 01643   896   NtProtectVirtualMemory  (-1, (0x2ece000), 4096, 260, ... (0x2ece000), 4096, 4, ) == 0x0
 01644   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01645   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341\273\1lB\11\373\356\336\240\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01646  2044   NtTestAlert  (...
 01647   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01646  2044   NtTestAlert  ... ) == 0x0
 01647   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01648  2044   NtContinue  (48037168, 1, ...
 01649   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01650  2044   NtRegisterThreadTerminatePort  (24, ...
 01649   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01650  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 01651   384   NtQuerySystemInformation  (Performance, 312, ...
 01644   896   NtCreateThread  ... 424, {1252, 588}, ) == 0x0
 01652  2044   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 01653   896   NtQueryInformationThread  (424, Basic, 28, ...
 01652  2044   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 01653   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 01654  2044   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01655   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0L\2\0\0" ...  ...
 01654  2044   NtDuplicateObject  ... 428, ) == 0x0
 01655   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 01656  2044   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01651   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01657   384   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01658   384   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01659   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01660   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01661   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482764, 2, ) }, 0, 0x0, 0, ... -2147482764, 2, ) == 0x0
 01662   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\34\247@\272\250\224\205\332\264\307K\244\230AT\5\367\u\7j/\5<\3a\341#\241_C\225\306\207Y\7\316d\237.C\276\214\1\325\231w\356\366<\12\333\312`\246\376\337z\345\227d\232\332\357[t\14\7|\307t\241-\271\173\366\35", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\34\247@\272\250\224\205\332\264\307K\244\230AT\5\367\u\7j/\5<\3a\341#\241_C\225\306\207Y\7\316d\237.C\276\214\1\325\231w\356\366<\12\333\312`\246\376\337z\345\227d\232\332\357[t\14\7|\307t\241-\271\173\366\35", 80, ... , 80, ...
 01663   896   NtResumeThread  (424, ...
 01656  2044   NtWaitForSingleObject  ... ) == 0x102
 01663   896   NtResumeThread  ... 1, ) == 0x0
 01664  2044   NtWaitForSingleObject  (132, 0, 0x0, ...
 01665   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 49086464, 1048576, ) == 0x0
 01666   896   NtAllocateVirtualMemory  (-1, 50126848, 0, 8192, 4096, 4, ... 50126848, 8192, ) == 0x0
 01667   896   NtProtectVirtualMemory  (-1, (0x2fce000), 4096, 260, ... (0x2fce000), 4096, 4, ) == 0x0
 01668   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 432, {1252, 1652}, ) == 0x0
 01669   896   NtQueryInformationThread  (432, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 01662   384   NtSetValueKey  ... ) == 0x0
 01670   588   NtTestAlert  (...
 01671   384   NtClose  (-2147482764, ...
 01670   588   NtTestAlert  ... ) == 0x0
 01671   384   NtClose  ... ) == 0x0
 01672   588   NtContinue  (49085744, 1, ...
 01645   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "v\214\370\251\206\211kH\323\304\254\222\2\272\25\216\253\23p\226\253\251\221N\267E\32\240\241\352\15k\30\273\325P\333\203\224\275\343\26*\312\223\351\32\360a\343\232\272%\307c\213\306\231\245\365s w\22\373\1pU\346t\267\207\332\332\201"\276$u\237\271\244\26Y\4?4\234\200\244"by5\13\32\24\322\375C\364\306\320\337o7\320\320\250\350M.nY\12\300\353N`\343\267\35\236\14F\353\17(}D\364\333\223\373\26<6I\343/\362\335\327\3578\301i\15\13\336\275\353\355\217\315\212\216F\2608\374v\375FX%\37\226*[\245\226\337\377\267d\16\21@\356\342\340\343\217\364cu\17:\12u\5od\27\207\7|\366K\227_t\214\375I\202oA\201\260\3\234\303vR\3361\16\316\17\263\336D.N\204\15\201\236\32.zn\257,\35\346\\322\4\356E\310V_\200\260\326U\33\241V!\335i", ) \276$u\237\271\244\26Y\4?4\234\200\244 ... {status=0x0, info=256}, "v\214\370\251\206\211kH\323\304\254\222\2\272\25\216\253\23p\226\253\251\221N\267E\32\240\241\352\15k\30\273\325P\333\203\224\275\343\26*\312\223\351\32\360a\343\232\272%\307c\213\306\231\245\365s w\22\373\1pU\346t\267\207\332\332\201"\276$u\237\271\244\26Y\4?4\234\200\244"by5\13\32\24\322\375C\364\306\320\337o7\320\320\250\350M.nY\12\300\353N`\343\267\35\236\14F\353\17(}D\364\333\223\373\26<6I\343/\362\335\327\3578\301i\15\13\336\275\353\355\217\315\212\216F\2608\374v\375FX%\37\226*[\245\226\337\377\267d\16\21@\356\342\340\343\217\364cu\17:\12u\5od\27\207\7|\366K\227_t\214\375I\202oA\201\260\3\234\303vR\3361\16\316\17\263\336D.N\204\15\201\236\32.zn\257,\35\346\\322\4\356E\310V_\200\260\326U\33\241V!\335i", ) , ) == 0x0
 01673   588   NtRegisterThreadTerminatePort  (24, ...
 01674   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341\273\1lB\11\373\356\0JlB\11\373\356\336\240\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01673   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01675   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01676   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0t\6\0\0" ...  ...
 01677   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01676   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 01677   588   NtDuplicateObject  ... 436, ) == 0x0
 01678   896   NtResumeThread  (432, ...
 01679   588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01678   896   NtResumeThread  ... 1, ) == 0x0
 01679   588   NtWaitForSingleObject  ... ) == 0x102
 01680   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01681   588   NtWaitForSingleObject  (132, 0, 0x0, ...
 01675   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01682  1652   NtTestAlert  (...
 01680   896   NtAllocateVirtualMemory  ... 50135040, 1048576, ) == 0x0
 01683   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01682  1652   NtTestAlert  ... ) == 0x0
 01684   896   NtAllocateVirtualMemory  (-1, 51175424, 0, 8192, 4096, 4, ...
 01683   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01685  1652   NtContinue  (50134320, 1, ...
 01684   896   NtAllocateVirtualMemory  ... 51175424, 8192, ) == 0x0
 01686   384   NtQuerySystemInformation  (Performance, 312, ...
 01687  1652   NtRegisterThreadTerminatePort  (24, ...
 01688   896   NtProtectVirtualMemory  (-1, (0x30ce000), 4096, 260, ...
 01686   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01687  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 01688   896   NtProtectVirtualMemory  ... (0x30ce000), 4096, 4, ) == 0x0
 01689   384   NtQuerySystemInformation  (Exception, 16, ...
 01690   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01691  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01689   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01691  1652   NtDuplicateObject  ... 440, ) == 0x0
 01692   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01693  1652   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01692   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01693  1652   NtWaitForSingleObject  ... ) == 0x102
 01694   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01695  1652   NtWaitForSingleObject  (132, 0, 0x0, ...
 01694   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01690   896   NtCreateThread  ... 444, {1252, 1376}, ) == 0x0
 01696   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01697   896   NtQueryInformationThread  (444, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 01698   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0`\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 01699   896   NtResumeThread  (444, ... 1, ) == 0x0
 01700   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 51183616, 1048576, ) == 0x0
 01701   896   NtAllocateVirtualMemory  (-1, 52224000, 0, 8192, 4096, 4, ... 52224000, 8192, ) == 0x0
 01696   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01702  1376   NtTestAlert  (...
 01703   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01702  1376   NtTestAlert  ... ) == 0x0
 01703   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 01704  1376   NtContinue  (51182896, 1, ...
 01705   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\21O\200|u\344n7"\14\312\311\273y\226\20\222\202\270\236\345\220$\372\2065\334\266\374\327\217+\3254\27\323\255q~\236Ln\224\27\3074\354\245\236P7j\344g\347;\350@\237nq\21\240U5@\323-N\224h^\300T0, 3,  (-2147482764, "Seed", 0, 3, "\21O\200|u\344n7"\14\312\311\273y\226\20\222\202\270\236\345\220$\372\2065\334\266\374\327\217+\3254\27\323\255q~\236Ln\224\27\3074\354\245\236P7j\344g\347;\350@\237nq\21\240U5@\323-N\224h^\300T14\312\311\273y\226\20\222\202\270\236\345\220$\372\2065\334\266\374\327\217+\3254\27\323\255q~\236Ln\224\27\3074\354\245\236P7j\344g\347;\350@\237nq\21\240U5@\323-N\224h^\300T370\224\354=", 80, ...
 01706  1376   NtRegisterThreadTerminatePort  (24, ...
 01705   384   NtSetValueKey  ... ) == 0x0
 01706  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 01707   384   NtClose  (-2147482764, ...
 01708   896   NtProtectVirtualMemory  (-1, (0x31ce000), 4096, 260, ...
 01709  1376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01708   896   NtProtectVirtualMemory  ... (0x31ce000), 4096, 4, ) == 0x0
 01709  1376   NtDuplicateObject  ... 448, ) == 0x0
 01710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01711  1376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01710   896   NtCreateThread  ... 452, {1252, 1436}, ) == 0x0
 01711  1376   NtWaitForSingleObject  ... ) == 0x102
 01712   896   NtQueryInformationThread  (452, Basic, 28, ...
 01713  1376   NtWaitForSingleObject  (132, 0, 0x0, ...
 01712   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 01707   384   NtClose  ... ) == 0x0
 01674   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\246]\2721\16ye0\346\377tq\236\333n\220\23rSw\253\366[g> \33B\222\352\303\344%\377\0\255\35\241\222\320\213\36Th\317\202\215\317\360\6\3273\234r\36\20e\247\10\2617\322\2161%X\263\256l\206&\30\7\342p\3139\3D\17b\201tH\304LHu\3572\326\246S\220\324\326fv\305H\202>\32\356}\200\366\366\21%\355@SDT"\301\273f\307\264Q\321\305 c>\353\237z\346C\303d$R\267\366B\231\11\200\263\361\237\2608@\2072R\340\361\2465a\272\246\362\246\31\274\331C\241\372O8\325GYy\344g\3412\226\211E\22\356\276\273\247\232\33\353\206&i\250YdB\362t\378%,h[\207\237\235^\26\30'6\364y<\330\336;\207\177c\370e\323z\261\263E\344\220\263\277\217\350\367M\35\205\370FQM\205m\374\332d>\3403y\304\10G\373t\317\333", ) \301\273f\307\264Q\321\305 c>\353\237z\346C\303d$R\267\366B\231\11\200\263\361\237\2608@\2072R\340\361\2465a\272\246\362\246\31\274\331C\241\372O8\325GYy\344g\3412\226\211E\22\356\276\273\247\232\33\353\206&i\250YdB\362t\378%,h[\207\237\235^\26\30'6\364y<\330\336;\207\177c\370e\323z\261\263E\344\220\263\277\217\350\367M\35\205\370FQM\205m\374\332d>\3403y\304\10G\373t\317\333", ) == 0x0
 01714   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341\273\1lB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\336\240\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01715   384   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01716   384   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01717   384   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01718   384   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01719   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01720   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\234\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 01721   896   NtResumeThread  (452, ... 1, ) == 0x0
 01722   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 52232192, 1048576, ) == 0x0
 01723   896   NtAllocateVirtualMemory  (-1, 53272576, 0, 8192, 4096, 4, ... 53272576, 8192, ) == 0x0
 01724   896   NtProtectVirtualMemory  (-1, (0x32ce000), 4096, 260, ... (0x32ce000), 4096, 4, ) == 0x0
 01725   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01719   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01726  1436   NtTestAlert  (...
 01727   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01726  1436   NtTestAlert  ... ) == 0x0
 01727   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01728  1436   NtContinue  (52231472, 1, ...
 01729   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01730  1436   NtRegisterThreadTerminatePort  (24, ...
 01729   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01730  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 01731   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01725   896   NtCreateThread  ... 456, {1252, 1368}, ) == 0x0
 01732  1436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01733   896   NtQueryInformationThread  (456, Basic, 28, ...
 01732  1436   NtDuplicateObject  ... 460, ) == 0x0
 01733   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 01734  1436   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01735   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0X\5\0\0" ...  ...
 01734  1436   NtWaitForSingleObject  ... ) == 0x102
 01735   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 01736  1436   NtWaitForSingleObject  (132, 0, 0x0, ...
 01731   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 01737   896   NtResumeThread  (456, ...
 01738   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\327sZ\244\245\33o\256r\363\370\237\3668g\370p\353s\316w\204\225\270\236\376\322\346\227\260&=]N[zF[\310\14\327\0\242\5\234%o\274|IH\226\363K\332\376\223\306\34U\33U\377\343\203p7p\267s\306\265.\323u?\306y\272f", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\327sZ\244\245\33o\256r\363\370\237\3668g\370p\353s\316w\204\225\270\236\376\322\346\227\260&=]N[zF[\310\14\327\0\242\5\234%o\274|IH\226\363K\332\376\223\306\34U\33U\377\343\203p7p\267s\306\265.\323u?\306y\272f", 80, ... , 80, ...
 01737   896   NtResumeThread  ... 1, ) == 0x0
 01738   384   NtSetValueKey  ... ) == 0x0
 01739   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01740   384   NtClose  (-2147482764, ...
 01739   896   NtAllocateVirtualMemory  ... 53280768, 1048576, ) == 0x0
 01740   384   NtClose  ... ) == 0x0
 01741   896   NtAllocateVirtualMemory  (-1, 54321152, 0, 8192, 4096, 4, ...
 01714   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\200\267lZ\275\333\260\351x\226\373\260]x\235\212\301\3215w\23\204\337\207\2263\376\330\320\310,!_\325\202\200|oC\265\264\13\113"Cz\233\304\355\233\13\11\250@\372\314\320[\320\2404\333\257p\376\340\364'\207\311\340\304;\200%r\336\311\251\315\263\232(\313\362\220\343o\36\311B\315l\3058\267\177\231\217\335\370''&\344{\244\360\362\264V\317\215g\7\20\205\231\353\337\335\224KB\364\371h\205\177\\4rG\213\210P\277\325N3\253\201\227\202\220y\20\21\331!\14\313$OY>!ZI1\25\316$S\14\253\367\237\311\320\222\34\211\371\273!\377\2616\321{\237\204\227\354\364\326\307\5\366\22lU\333\300\257A\211]\10\365\256\355\7/\267\10\221\177?\336\30d\277\355dUh]\234\252x0i;\7\6/_\31\16\33\214\311\363\22\354\202\\2228:`m\212R\321\16\355\310\364\15W\215\352", ) Cz\233\304\355\233\13\11\250@\372\314\320[\320\2404\333\257p\376\340\364'\207\311\340\304;\200%r\336\311\251\315\263\232(\313\362\220\343o\36\311B\315l\3058\267\177\231\217\335\370''&\344{\244\360\362\264V\317\215g\7\20\205\231\353\337\335\224KB\364\371h\205\177\\4rG\213\210P\277\325N3\253\201\227\202\220y\20\21\331!\14\313$OY>!ZI1\25\316$S\14\253\367\237\311\320\222\34\211\371\273!\377\2616\321{\237\204\227\354\364\326\307\5\366\22lU\333\300\257A\211]\10\365\256\355\7/\267\10\221\177?\336\30d\277\355dUh]\234\252x0i;\7\6/_\31\16\33\214\311\363\22\354\202\\2228:`m\212R\321\16\355\310\364\15W\215\352", ) == 0x0
 01741   896   NtAllocateVirtualMemory  ... 54321152, 8192, ) == 0x0
 01742  1368   NtTestAlert  (...
 01743   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341\273\1lB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\336\240\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01742  1368   NtTestAlert  ... ) == 0x0
 01744   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01745  1368   NtContinue  (53280048, 1, ...
 01744   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01746  1368   NtRegisterThreadTerminatePort  (24, ...
 01747   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01746  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 01747   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01748   896   NtProtectVirtualMemory  (-1, (0x33ce000), 4096, 260, ...
 01749   384   NtQuerySystemInformation  (Performance, 312, ...
 01748   896   NtProtectVirtualMemory  ... (0x33ce000), 4096, 4, ) == 0x0
 01750  1368   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01751   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01750  1368   NtDuplicateObject  ... 464, ) == 0x0
 01751   896   NtCreateThread  ... 468, {1252, 724}, ) == 0x0
 01752  1368   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01753   896   NtQueryInformationThread  (468, Basic, 28, ...
 01752  1368   NtWaitForSingleObject  ... ) == 0x102
 01753   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 01754  1368   NtWaitForSingleObject  (132, 0, 0x0, ...
 01749   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01755   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" ...  ...
 01756   384   NtQuerySystemInformation  (Exception, 16, ...
 01755   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 01756   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01757   896   NtResumeThread  (468, ...
 01758   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01757   896   NtResumeThread  ... 1, ) == 0x0
 01758   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01759   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01760   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01761   724   NtTestAlert  (...
 01759   896   NtAllocateVirtualMemory  ... 54329344, 1048576, ) == 0x0
 01761   724   NtTestAlert  ... ) == 0x0
 01762   896   NtAllocateVirtualMemory  (-1, 55369728, 0, 8192, 4096, 4, ...
 01763   724   NtContinue  (54328624, 1, ...
 01762   896   NtAllocateVirtualMemory  ... 55369728, 8192, ) == 0x0
 01764   724   NtRegisterThreadTerminatePort  (24, ...
 01765   896   NtProtectVirtualMemory  (-1, (0x34ce000), 4096, 260, ...
 01764   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 01765   896   NtProtectVirtualMemory  ... (0x34ce000), 4096, 4, ) == 0x0
 01760   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01766   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01767   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01768   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01767   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01768   724   NtDuplicateObject  ... 472, ) == 0x0
 01769   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01770   724   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01769   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 01770   724   NtWaitForSingleObject  ... ) == 0x102
 01771   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\367\342s\31\341xBV\12\230\343,\23\271\274\227\272z@\271\353n\353\233\302\375>m\17.\204V\10h\177\217\347\3\353\27L3\202}\306@\213\252g\320\3760j\276\302\301\7\210\246F\307\200b\213\234\16\311R\314-s\344\325"\321\7\210\26\223\12", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\367\342s\31\341xBV\12\230\343,\23\271\274\227\272z@\271\353n\353\233\302\375>m\17.\204V\10h\177\217\347\3\353\27L3\202}\306@\213\252g\320\3760j\276\302\301\7\210\246F\307\200b\213\234\16\311R\314-s\344\325"\321\7\210\26\223\12", 80, ... \321\7\210\26\223\12", 80, ...
 01772   724   NtWaitForSingleObject  (132, 0, 0x0, ...
 01766   896   NtCreateThread  ... 476, {1252, 1276}, ) == 0x0
 01771   384   NtSetValueKey  ... ) == 0x0
 01773   896   NtQueryInformationThread  (476, Basic, 28, ...
 01774   384   NtClose  (-2147482764, ...
 01773   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 01774   384   NtClose  ... ) == 0x0
 01775   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\374\4\0\0" ...  ...
 01743   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "P\260\25\230Q\230FJ\242\254\370\342P\300\263Sr\351 \262\330B\320~\372z]E\26\225\341\255\247+\237:kO\25\263d.t\13\341\215A6{\24D\246\350+^\306\316\315\270E\352\262\357\251\223\271\267\2760\252\336\243\346\257\1770\215\220\262\301f!\307r\0\345=\371hq=?\21\10u\331\322t\205hd\272\2\356<\1\360\12\377\263\33bM3\273\366\222\2\363\0\222G\326,\2wl\232\33\310\317\333\233\212\354(t\23\344\233=yo\30\4\233\262t.<\23e\272\275V]\30\376A\322\375||I\246\25~\11i2\2062\246\272\261bj\324\223\374\203\326\23\230\354z+z\37\260{\375\360[\21\273\246|$\10Kg&\35\364\37\340\326\264^=m\2035\372\4s\364\235G\260\13\13\310\254\335\0\301\17\203", ) f!\307r\0\345=\371hq=?\21\10u\331\322t\205hd\272\2\356<\1\360\12\377\263\33bM3\273\366\222\2\363\0\222G\326,\2wl\232\33\310\317\333\233\212\354(t\23\344\233=yo\30\4\233\262t.<\23e\272\275V]\30\376A\322\375||I\246\25~\11i2\2062\246\272\261bj\324\223\374\203\326\23\230\354z+z\37\260{\375\360[\21\273\246|$\10Kg&\35\364\37\340\326\264^=m\2035\372\4s\364\235G\260\13\13\310\254\335\0\301\17\203", ) == 0x0
 01775   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 01776   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341\273\1lB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\336\240\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01777   384   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01778   384   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01779   384   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01780   384   NtQuerySystemInformation  (Exception, 16, ...
 01781   896   NtResumeThread  (476, ... 1, ) == 0x0
 01782   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 55377920, 1048576, ) == 0x0
 01783   896   NtAllocateVirtualMemory  (-1, 56418304, 0, 8192, 4096, 4, ... 56418304, 8192, ) == 0x0
 01784   896   NtProtectVirtualMemory  (-1, (0x35ce000), 4096, 260, ... (0x35ce000), 4096, 4, ) == 0x0
 01785   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 480, {1252, 220}, ) == 0x0
 01786   896   NtQueryInformationThread  (480, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 01780   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01787  1276   NtTestAlert  (...
 01788   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01787  1276   NtTestAlert  ... ) == 0x0
 01788   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01789  1276   NtContinue  (55377200, 1, ...
 01790   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01791  1276   NtRegisterThreadTerminatePort  (24, ...
 01790   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01791  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 01792   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01793   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\334\0\0\0" ...  ...
 01794  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01793   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81892, 0}  ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 01794  1276   NtDuplicateObject  ... 484, ) == 0x0
 01795   896   NtResumeThread  (480, ...
 01796  1276   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01795   896   NtResumeThread  ... 1, ) == 0x0
 01796  1276   NtWaitForSingleObject  ... ) == 0x102
 01797   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01798  1276   NtWaitForSingleObject  (132, 0, 0x0, ...
 01792   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01799   220   NtTestAlert  (...
 01797   896   NtAllocateVirtualMemory  ... 56426496, 1048576, ) == 0x0
 01800   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01799   220   NtTestAlert  ... ) == 0x0
 01801   896   NtAllocateVirtualMemory  (-1, 57466880, 0, 8192, 4096, 4, ...
 01800   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 01802   220   NtContinue  (56425776, 1, ...
 01801   896   NtAllocateVirtualMemory  ... 57466880, 8192, ) == 0x0
 01803   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\275\242E\21J\337\313\1DI\242\220e\344\376b\247\276\3\363q\260\257\30g6 d\245\256/1_\271\347}\324\361\23\246\\351(\210P\223\22\326\340\253U\36\311 0\350\342, 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\275\242E\21J\337\313\1DI\242\220e\344\376b\247\276\3\363q\260\257\30g6 d\245\256/1_\271\347}\324\361\23\246\\351(\210P\223\22\326\340\253U\36\311 0\350\342, 80, ... , 80, ...
 01804   220   NtRegisterThreadTerminatePort  (24, ...
 01805   896   NtProtectVirtualMemory  (-1, (0x36ce000), 4096, 260, ...
 01803   384   NtSetValueKey  ... ) == 0x0
 01804   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 01805   896   NtProtectVirtualMemory  ... (0x36ce000), 4096, 4, ) == 0x0
 01806   384   NtClose  (-2147482764, ...
 01807   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01808   220   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01806   384   NtClose  ... ) == 0x0
 01808   220   NtDuplicateObject  ... 488, ) == 0x0
 01776   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\373\375(\274\3401\242I\276\240\12\333E\355!\237\235\226N'\214\341\235e\346\32 \364\230\315\212\310\31\204\331^E\366t\247\315'\346\325\336\16\301^#\350\260\242\324\302C\32\307\212sh\275#\304\245}Q\362\343\12=\13*gV:.S7@N\363\321!:\267\357\344:\270\341\202\263\224l\316\351\351\6U\377E.@\2711\347\367\311WL\304\10\202\242\326\251F|!\22\337\335\234\271\247\321@LHT\177\243\3\271\310\304\310+\263\202\244vn\214\223\365\304\231\312\35d\200'\253\224\250f\220 4\376\2136\277\303\222\2771\245\226\i\304\324\350\350\A\260\341\266\353\375i\350\213\276\260\263D\0q\24\33X\276L\235M\215\33\334\243\355i\357\373YS\2450\24\347\35E\334\31\23686b\223\201\275\371\264\37\11?+\212N\263\244\316J\]\244\1\210D\314\344\256\33\36\307\345G\317{"Q<\", ) Q<\", ) == 0x0
 01809   220   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01810   384   NtDeviceIoControlFile  (348, 0, 0x0, 0x0, 0x390008,  (348, 0, 0x0, 0x0, 0x390008, "O\13(\226hF\355_\362\314\225\303\237\341\273\1lB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\0JlB\11\373\356\336\240\4voQ\34\246\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01809   220   NtWaitForSingleObject  ... ) == 0x102
 01811   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01812   220   NtWaitForSingleObject  (132, 0, 0x0, ...
 01811   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01807   896   NtCreateThread  ... 492, {1252, 1328}, ) == 0x0
 01813   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01814   896   NtQueryInformationThread  (492, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 01815   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\00\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 01816   896   NtResumeThread  (492, ... 1, ) == 0x0
 01817   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 57475072, 1048576, ) == 0x0
 01818   896   NtAllocateVirtualMemory  (-1, 58515456, 0, 8192, 4096, 4, ... 58515456, 8192, ) == 0x0
 01813   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01819  1328   NtTestAlert  (...
 01820   384   NtQuerySystemInformation  (Performance, 312, ...
 01819  1328   NtTestAlert  ... ) == 0x0
 01820   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01821  1328   NtContinue  (57474352, 1, ...
 01822   384   NtQuerySystemInformation  (Exception, 16, ...
 01823  1328   NtRegisterThreadTerminatePort  (24, ...
 01822   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01823  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 01824   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01825   896   NtProtectVirtualMemory  (-1, (0x37ce000), 4096, 260, ...
 01826  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01825   896   NtProtectVirtualMemory  ... (0x37ce000), 4096, 4, ) == 0x0
 01826  1328   NtDuplicateObject  ... 496, ) == 0x0
 01827   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01828  1328   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 01824   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01828  1328   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 01829   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01830  1328   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01829   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01831   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01832   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482764, 2, ) }, 0, 0x0, 0, ... -2147482764, 2, ) == 0x0
 01833   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\204Cyn&Q\222\305\367\\341\22\316\365\375\363\364Ya\251\340}\212:\204\307[$eJ\205\14p\30WWx\233_\311Y/g\362#\200\234l\330q\3\306;q\241\32\336q\207\13\25Js_\17\275\357\2\20AS\244\17x\21JMw\205", 80, ... ) , 0, 3,  (-2147482764, "Seed", 0, 3, "\204Cyn&Q\222\305\367\\341\22\316\365\375\363\364Ya\251\340}\212:\204\307[$eJ\205\14p\30WWx\233_\311Y/g\362#\200\234l\330q\3\306;q\241\32\336q\207\13\25Js_\17\275\357\2\20AS\244\17x\21JMw\205", 80, ... ) , 80, ... ) == 0x0
 01834   384   NtClose  (-2147482764, ... ) == 0x0
 01810   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\27\205R=\363V\226g\220\37\c\17L'\37tz\240\347;\201\211\267i\223\320\304J\37\214k\331\242:\311\33A\307\213\310\316V\265q\247\204\344\376z\20\227c\234<\236\33sy`K\256\255\271\375\331\200c\201\312g\37\\244,d\215\231:T\243:c\17\342\261\342m-\1\33\33614#Y\266\212\355\244s\6uc\233\377\352\376\334|\6\241\230@\34O\335Cp\371\256,\331xZ[\11Yp\252\214\275\211\311_\321|\6}\352\215\177[\210]\4\310\2255d\15\340\317\222\214\32\24\341\275D\30@\360\220\330\324\243\225\16\15\267]\361\322"%\306?\337yIW\203\316\36\237\36K\225\207\353R\256\265\244w\245\4\302\221\325\343d\204r_\24?j\21m\14\252\323\340\337\335\373\216\342\25\352\343\336z\214\217\4\313\216\6\375\15\254\350\270Tjt\10\334 \262306?\337yIW\203\316\36\237\36K\225\207\353R\256\265\244w\245\4\302\221\325\343d\204r_\24?j\21m\14\252\323\340\337\335\373\216\342\25\352\343\336z\214\217\4\313\216\6\375\15\254\350\270Tjt\10\334 \26216\271\354\6\211263", ) == 0x0
 01827   896   NtCreateThread  ... 500, {1252, 1636}, ) == 0x0
 01830  1328   NtWaitForSingleObject  ... ) == 0x102
 01835   896   NtQueryInformationThread  (500, Basic, 28, ...
 01836  1328   NtWaitForSingleObject  (132, 0, 0x0, ...
 01835   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 01837   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0d\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 01838   896   NtResumeThread  (500, ... 1, ) == 0x0
 01839   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 58523648, 1048576, ) == 0x0
 01840   896   NtAllocateVirtualMemory  (-1, 59564032, 0, 8192, 4096, 4, ... 59564032, 8192, ) == 0x0
 01841   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01842  1636   NtTestAlert  (...
 01841   384   NtCreateEvent  ... 504, ) == 0x0
 01842  1636   NtTestAlert  ... ) == 0x0
 01843   384   NtSetEventBoostPriority  (420, ...
 01844  1636   NtContinue  (58522928, 1, ...
 01635  2016   NtWaitForSingleObject  ... ) == 0x0
 01843   384   NtSetEventBoostPriority  ... ) == 0x0
 01845  2016   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 01846  1636   NtRegisterThreadTerminatePort  (24, ...
 01845  2016   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 01847   384   NtWaitForSingleObject  (280, 0, 0x0, ...
 01846  1636   NtRegisterThreadTerminatePort  ... ) == 0x0
 01848   896   NtProtectVirtualMemory  (-1, (0x38ce000), 4096, 260, ...
 01849  2016   NtSetEventBoostPriority  (280, ...
 01848   896   NtProtectVirtualMemory  ... (0x38ce000), 4096, 4, ) == 0x0
 01847   384   NtWaitForSingleObject  ... ) == 0x0
 01849  2016   NtSetEventBoostPriority  ... ) == 0x0
 01850   384   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15527276, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15527276, 188, ...
 01851   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01852  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01851   896   NtCreateThread  ... 508, {1252, 704}, ) == 0x0
 01852  2016   NtCreateEvent  ... 512, ) == 0x0
 01853   896   NtQueryInformationThread  (508, Basic, 28, ...
 01854  2016   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11072120, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11072120, 188, ...
 01853   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=704,}, 0x0, ) == 0x0
 01855  1636   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01850   384   NtConnectPort  ... 516, 0x0, 0x0, 0x0, 188, ) == 0x0
 01855  1636   NtDuplicateObject  ... 520, ) == 0x0
 01856   384   NtRequestWaitReplyPort  (516, {200, 224, new_msg, 0, 1380344, 12, 2, 1310721}  (516, {200, 224, new_msg, 0, 1380344, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\04d\333\26\256E\226e\10D\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\2300\25\0\223B\255\350x\1\24\0\0D\25\0h\1\24\0\0\0\0\0\0\0\0\0\0D\25\0P\0\0\0\10D\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\354\0\372\31\221|\200\363\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01857  1636   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01856   384   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 384, 81899, 0}  ... {200, 224, reply, 0, 1252, 384, 81899, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\04d\333\26\256E\226e\10D\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\2300\25\0\223B\255\350x\1\24\0\0D\25\0h\1\24\0\0\0\0\0\0\0\0\0\0D\25\0P\0\0\0\10D\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\354\0\372\31\221|\200\363\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01858   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\300\2\0\0" ...  ...
 01854  2016   NtConnectPort  ... 524, 0x0, 0x0, 0x0, 188, ) == 0x0
 01859   384   NtRequestWaitReplyPort  (516, {44, 68, new_msg, 0, 1252, 384, 81878, 0}  (516, {44, 68, new_msg, 0, 1252, 384, 81878, 0} "\1\0\0\0A\2\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 01858   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81900, 0}  ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\300\2\0\0" )  ) == 0x0
 01860  2016   NtRequestWaitReplyPort  (524, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2}  (524, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\240<\24\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0T\\246\4\222\374-aHG\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0 G\25\0\252\22\365\36x\1\24\0@G\25\0h\1\24\0\0\0\0\0\0\0\0\0@G\25\0P\0\0\0HG\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\250\0\372\31\221|\214\370\250\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 01861   896   NtResumeThread  (508, ... 1, ) == 0x0
 01862   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01860  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81902, 0}  ... {200, 224, reply, 0, 1252, 2016, 81902, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\240<\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0T\\246\4\222\374-aHG\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0 G\25\0\252\22\365\36x\1\24\0@G\25\0h\1\24\0\0\0\0\0\0\0\0\0@G\25\0P\0\0\0HG\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\250\0\372\31\221|\214\370\250\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 01857  1636   NtWaitForSingleObject  ... ) == 0x102
 01859   384   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 384, 81901, 0}  ... {40, 64, reply, 0, 1252, 384, 81901, 0} "\2\356Q\200\4\0\0\0@\14\250\201\0\320\372\177\220kt\367\370\37`\300lkt\367X\353Q\200\320\1\0\0X-\12\0" )  ) == 0x0
 01863   704   NtTestAlert  (...
 01864  2016   NtRequestWaitReplyPort  (524, {44, 68, new_msg, 56, 0, 0, 0, 0}  (524, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0XL\25\0\322\0\0\0" ...  ...
 01865  1636   NtWaitForSingleObject  (132, 0, 0x0, ...
 01866   384   NtRequestWaitReplyPort  (516, {64, 88, new_msg, 56, 1371880, 15527788, 15527888, 0}  (516, {64, 88, new_msg, 56, 1371880, 15527788, 15527888, 0} "\10\357\354\0@\0\24\0\346\277\347w\320\357\354\0l\357\354\0\20\0\0\0\250.\362v\\357\24\0\1\0\0\0PM\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0h\334\24\0" ...  ...
 01863   704   NtTestAlert  ... ) == 0x0
 01867   704   NtContinue  (59571504, 1, ...
 01868   704   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01869   704   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 528, ) == 0x0
 01870   704   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 01871   704   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01862   896   NtAllocateVirtualMemory  ... 59572224, 1048576, ) == 0x0
 01872   896   NtAllocateVirtualMemory  (-1, 60612608, 0, 8192, 4096, 4, ... 60612608, 8192, ) == 0x0
 01873   896   NtProtectVirtualMemory  (-1, (0x39ce000), 4096, 260, ... (0x39ce000), 4096, 4, ) == 0x0
 01874   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01864  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81903, 0}  ... {40, 64, reply, 0, 1252, 2016, 81903, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 01866   384   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 384, 81904, 0}  ... {64, 88, reply, 56, 1252, 384, 81904, 0} "\10\357\354\0@\0\24\0\346\277\347w\320\357\354\0l\357\354\0\20\0\0\0\250.\362v\\357\24\0\1\0\0\0PM\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0h\334\24\0" )  ) == 0x0
 01871   704   NtWaitForSingleObject  ... ) == 0x102
 01875  2016   NtRequestWaitReplyPort  (524, {64, 88, new_msg, 56, 1310720, 11071988, 1395792, 0}  (524, {64, 88, new_msg, 56, 1310720, 11071988, 1395792, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\320P\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01876   384   NtClose  (504, ...
 01877   704   NtWaitForSingleObject  (132, 0, 0x0, ...
 01876   384   NtClose  ... ) == 0x0
 01875  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81905, 0}  ... {64, 88, reply, 56, 1252, 2016, 81905, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\320P\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01874   896   NtCreateThread  ... 504, {1252, 1152}, ) == 0x0
 01878  2016   NtRequestWaitReplyPort  (524, {44, 68, new_msg, 56, 1252, 2016, 81903, 0}  (524, {44, 68, new_msg, 56, 1252, 2016, 81903, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0XL\25\0\322\0\0\0" ...  ...
 01879   896   NtQueryInformationThread  (504, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 01880   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\200\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 01881   384   NtClose  (516, ... ) == 0x0
 01882   384   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 516, 2, ) }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 516, 2, ) , 0, ... 516, 2, ) == 0x0
 01883   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 532, ) }, ... 532, ) == 0x0
 01884   896   NtResumeThread  (504, ...
 01878  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81906, 0}  ... {40, 64, reply, 0, 1252, 2016, 81906, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 01884   896   NtResumeThread  ... 1, ) == 0x0
 01885  2016   NtRequestWaitReplyPort  (524, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0}  (524, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\0<\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01886   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 60620800, 1048576, ) == 0x0
 01887   896   NtAllocateVirtualMemory  (-1, 61661184, 0, 8192, 4096, 4, ... 61661184, 8192, ) == 0x0
 01885  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81909, 0}  ... {64, 88, reply, 56, 1252, 2016, 81909, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0\0<\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01888   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01889  1152   NtTestAlert  (...
 01890  2016   NtRequestWaitReplyPort  (524, {44, 68, new_msg, 56, 1252, 2016, 81906, 0}  (524, {44, 68, new_msg, 56, 1252, 2016, 81906, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0XL\25\0\322\0\0\0" ...  ...
 01888   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01889  1152   NtTestAlert  ... ) == 0x0
 01891   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 01892  1152   NtContinue  (60620080, 1, ...
 01891   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01893  1152   NtRegisterThreadTerminatePort  (24, ...
 01894   384   NtQueryValueKey  (516,  (516, "Domain", Partial, 144, ... , Partial, 144, ...
 01893  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 01894   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01895   896   NtProtectVirtualMemory  (-1, (0x3ace000), 4096, 260, ...
 01890  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81910, 0}  ... {40, 64, reply, 0, 1252, 2016, 81910, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 01896  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01895   896   NtProtectVirtualMemory  ... (0x3ace000), 4096, 4, ) == 0x0
 01897  2016   NtRequestWaitReplyPort  (524, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0}  (524, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0@>\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01896  1152   NtDuplicateObject  ... 536, ) == 0x0
 01898   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01899  1152   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01898   896   NtCreateThread  ... 540, {1252, 1228}, ) == 0x0
 01897  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81911, 0}  ... {64, 88, reply, 56, 1252, 2016, 81911, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0@>\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01899  1152   NtWaitForSingleObject  ... ) == 0x102
 01900   896   NtQueryInformationThread  (540, Basic, 28, ...
 01901  2016   NtClose  (512, ...
 01902  1152   NtWaitForSingleObject  (132, 0, 0x0, ...
 01900   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 01901  2016   NtClose  ... ) == 0x0
 01903   384   NtQueryValueKey  (516,  (516, "Domain", Partial, 144, ... , Partial, 144, ...
 01904   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\314\4\0\0" ...  ...
 01903   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01904   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81912, 0}  ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 01905   384   NtClose  (516, ...
 01906   896   NtResumeThread  (540, ...
 01905   384   NtClose  ... ) == 0x0
 01906   896   NtResumeThread  ... 1, ) == 0x0
 01907   384   NtClose  (532, ...
 01908   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01907   384   NtClose  ... ) == 0x0
 01909  2016   NtClose  (524, ...
 01910  1228   NtTestAlert  (...
 01908   896   NtAllocateVirtualMemory  ... 61669376, 1048576, ) == 0x0
 01909  2016   NtClose  ... ) == 0x0
 01910  1228   NtTestAlert  ... ) == 0x0
 01911   896   NtAllocateVirtualMemory  (-1, 62709760, 0, 8192, 4096, 4, ...
 01912  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01913  1228   NtContinue  (61668656, 1, ...
 01911   896   NtAllocateVirtualMemory  ... 62709760, 8192, ) == 0x0
 01912  2016   NtCreateEvent  ... 524, ) == 0x0
 01914  1228   NtRegisterThreadTerminatePort  (24, ...
 01915   896   NtProtectVirtualMemory  (-1, (0x3bce000), 4096, 260, ...
 01916  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ...
 01914  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 01915   896   NtProtectVirtualMemory  ... (0x3bce000), 4096, 4, ) == 0x0
 01916  2016   NtOpenKey  ... 532, ) == 0x0
 01917   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 01918   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01919  1228   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01917   384   NtOpenKey  ... 516, ) == 0x0
 01920  2016   NtOpenKey  (0x20019, {24, 532, 0x40, 0, 0,  (0x20019, {24, 532, 0x40, 0, 0, "ActiveComputerName"}, ... }, ...
 01919  1228   NtDuplicateObject  ... 512, ) == 0x0
 01921   384   NtQueryValueKey  (516,  (516, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 01920  2016   NtOpenKey  ... 544, ) == 0x0
 01922  1228   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01921   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01923  2016   NtQueryValueKey  (544,  (544, "ComputerName", Full, 108, ... , Full, 108, ...
 01922  1228   NtWaitForSingleObject  ... ) == 0x102
 01924   384   NtClose  (516, ...
 01923  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01925  1228   NtWaitForSingleObject  (132, 0, 0x0, ...
 01924   384   NtClose  ... ) == 0x0
 01926  2016   NtClose  (544, ...
 01918   896   NtCreateThread  ... 516, {1252, 792}, ) == 0x0
 01926  2016   NtClose  ... ) == 0x0
 01927   896   NtQueryInformationThread  (516, Basic, 28, ...
 01928   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15526864, ... }, 15526864, ...
 01927   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 01928   384   NtQueryAttributesFile  ... ) == 0x0
 01929   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0\30\3\0\0" ...  ...
 01930   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 01929   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81914, 0}  ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 01930   384   NtOpenFile  ... 544, {status=0x0, info=1}, ) == 0x0
 01931  2016   NtClose  (532, ...
 01932   384   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 544, ...
 01931  2016   NtClose  ... ) == 0x0
 01932   384   NtCreateSection  ... 532, ) == 0x0
 01933  2016   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ...
 01934   896   NtResumeThread  (516, ...
 01933  2016   NtCreateIoCompletion  ... 548, ) == 0x0
 01934   896   NtResumeThread  ... 1, ) == 0x0
 01935  2016   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ...
 01936   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01935  2016   NtCreateIoCompletion  ... 552, ) == 0x0
 01936   896   NtAllocateVirtualMemory  ... 62717952, 1048576, ) == 0x0
 01937   384   NtClose  (544, ...
 01938   792   NtWaitForSingleObject  (92, 0, 0x0, ...
 01939   896   NtAllocateVirtualMemory  (-1, 63758336, 0, 8192, 4096, 4, ...
 01937   384   NtClose  ... ) == 0x0
 01939   896   NtAllocateVirtualMemory  ... 63758336, 8192, ) == 0x0
 01940   384   NtMapViewOfSection  (532, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01941  2016   NtDuplicateObject  (-1, 548, -1, 0x0, 0, 2, ...
 01940   384   NtMapViewOfSection  ... (0x860000), 0x0, 20480, ) == 0x0
 01941  2016   NtDuplicateObject  ... 544, ) == 0x0
 01942   384   NtClose  (532, ...
 01943  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01942   384   NtClose  ... ) == 0x0
 01943  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01944   896   NtProtectVirtualMemory  (-1, (0x3cce000), 4096, 260, ...
 01945  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01944   896   NtProtectVirtualMemory  ... (0x3cce000), 4096, 4, ) == 0x0
 01945  2016   NtCreateEvent  ... 532, ) == 0x0
 01946   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 556, {1252, 1484}, ) == 0x0
 01947   896   NtQueryInformationThread  (556, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 01948   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 01949   896   NtResumeThread  (556, ... 1, ) == 0x0
 01950   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01951  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01952   384   NtUnmapViewOfSection  (-1, 0x860000, ...
 01953  1484   NtWaitForSingleObject  (92, 0, 0x0, ...
 01951  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01952   384   NtUnmapViewOfSection  ... ) == 0x0
 01954  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 01955   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15527172, ... }, 15527172, ...
 01954  2016   NtSetInformationThread  ... ) == 0x0
 01955   384   NtQueryAttributesFile  ... ) == 0x0
 01956  2016   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11071680,  (0xc0100080, {24, 0, 0x40, 0, 11071680, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 01950   896   NtAllocateVirtualMemory  ... 63766528, 1048576, ) == 0x0
 01956  2016   NtCreateFile  ... 560, {status=0x0, info=1}, ) == 0x0
 01957   896   NtAllocateVirtualMemory  (-1, 64806912, 0, 8192, 4096, 4, ... 64806912, 8192, ) == 0x0
 01958   896   NtProtectVirtualMemory  (-1, (0x3dce000), 4096, 260, ... (0x3dce000), 4096, 4, ) == 0x0
 01959   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 564, {1252, 888}, ) == 0x0
 01960   896   NtQueryInformationThread  (564, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=888,}, 0x0, ) == 0x0
 01961   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0x\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0x\3\0\0" )  ) == 0x0
 01962  2016   NtSetInformationFile  (560, 11071736, 8, Pipe, ...
 01963   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 01962  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 01963   384   NtOpenFile  ... 568, {status=0x0, info=1}, ) == 0x0
 01964  2016   NtSetInformationFile  (560, 11071724, 8, Completion, ...
 01965   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 568, ...
 01964  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 01965   384   NtCreateSection  ... 572, ) == 0x0
 01966  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 01967   384   NtQuerySection  (572, Image, 48, ...
 01966  2016   NtSetInformationThread  ... ) == 0x0
 01967   384   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01968   896   NtResumeThread  (564, ...
 01969  2016   NtWriteFile  (560, 221, 0, 0,  (560, 221, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 01968   896   NtResumeThread  ... 1, ) == 0x0
 01969  2016   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 01970   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01971  2016   NtReadFile  (560, 221, 0, 0, 1024, {0, 0}, 0, ...
 01970   896   NtAllocateVirtualMemory  ... 64815104, 1048576, ) == 0x0
 01971  2016   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01972   896   NtAllocateVirtualMemory  (-1, 65855488, 0, 8192, 4096, 4, ...
 01973  2016   NtFsControlFile  (560, 221, 0x0, 0x0, 0x11c017,  (560, 221, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\250\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 01972   896   NtAllocateVirtualMemory  ... 65855488, 8192, ) == 0x0
 01973  2016   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01974   384   NtClose  (568, ...
 01975   888   NtWaitForSingleObject  (92, 0, 0x0, ...
 01976   896   NtProtectVirtualMemory  (-1, (0x3ece000), 4096, 260, ...
 01974   384   NtClose  ... ) == 0x0
 01976   896   NtProtectVirtualMemory  ... (0x3ece000), 4096, 4, ) == 0x0
 01977   384   NtMapViewOfSection  (572, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01978   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01977   384   NtMapViewOfSection  ... (0x76fb0000), 0x0, 32768, ) == 0x0
 01978   896   NtCreateThread  ... 568, {1252, 1120}, ) == 0x0
 01979   384   NtClose  (572, ...
 01980   896   NtQueryInformationThread  (568, Basic, 28, ...
 01979   384   NtClose  ... ) == 0x0
 01980   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 01981  2016   NtFsControlFile  (560, 221, 0x0, 0x0, 0x11c017,  (560, 221, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\1\0\0\0\1\0\0\0&\0(\0\30@\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 01982   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 01981  2016   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , ) == 0x103
 01982   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 01983  2016   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 01984   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 01985   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0`\4\0\0" ...  ...
 01984   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 01985   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81917, 0}  ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 01983  2016   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 01986   896   NtResumeThread  (568, ...
 01987  2016   NtFsControlFile  (560, 221, 0x0, 0x0, 0x11c017,  (560, 221, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... , 44, 1024, ...
 01986   896   NtResumeThread  ... 1, ) == 0x0
 01987  2016   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\200;\25\0\1\0\0\0\214;\25\0 \0\0\0\1\0\0\0\30\0\32\0\230;\25\0\264;\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\370_\25\0\1\0\0\0\5\0i\0\10`\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 01988   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01989  2016   NtClose  (532, ...
 01990   384   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 01991  1120   NtWaitForSingleObject  (92, 0, 0x0, ...
 01989  2016   NtClose  ... ) == 0x0
 01990   384   NtFlushInstructionCache  ... ) == 0x0
 01992  2016   NtClose  (560, ...
 01993   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 01988   896   NtAllocateVirtualMemory  ... 65863680, 1048576, ) == 0x0
 01993   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 01994   896   NtAllocateVirtualMemory  (-1, 66904064, 0, 8192, 4096, 4, ...
 01995   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 01994   896   NtAllocateVirtualMemory  ... 66904064, 8192, ) == 0x0
 01995   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 01996   896   NtProtectVirtualMemory  (-1, (0x3fce000), 4096, 260, ...
 01992  2016   NtClose  ... ) == 0x0
 01996   896   NtProtectVirtualMemory  ... (0x3fce000), 4096, 4, ) == 0x0
 01997  2016   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1380344, 0x0, 11073604, 188, ... , {12, 2, 1, 1}, 0x0, 1380344, 0x0, 11073604, 188, ...
 01998   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01997  2016   NtSecureConnectPort  ... 560, 0x0, 0x0, 0x0, 188, ) == 0x0
 01999   384   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02000  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01999   384   NtFlushInstructionCache  ... ) == 0x0
 02000  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02001   384   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... }, ...
 01998   896   NtCreateThread  ... 532, {1252, 840}, ) == 0x0
 02001   384   NtOpenSection  ... 572, ) == 0x0
 02002   896   NtQueryInformationThread  (532, Basic, 28, ...
 02003   384   NtMapViewOfSection  (572, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02002   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 02003   384   NtMapViewOfSection  ... (0x76f60000), 0x0, 180224, ) == 0x0
 02004   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0H\3\0\0" ...  ...
 02005  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02004   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 02005  2016   NtSetInformationThread  ... ) == 0x0
 02006   384   NtClose  (572, ...
 02007  2016   NtRequestWaitReplyPort  (560, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977}  (560, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\315\365F\265#!\372\274^\346\264\352he\220~\12\0\0\0jra\277\5\270\307\277\0\0\0\0\2300\25\0\15-m\217\310\217\233t(\0\0\0\37\217\0\337\0\0\24\0\240\366\250\0{\304\336\221\0\0\0\0HG\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\250\0\372\31\221|X\376\250\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02006   384   NtClose  ... ) == 0x0
 02008   384   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02007  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81920, 0}  ... {200, 224, reply, 0, 1252, 2016, 81920, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\315\365F\265#!\372\274^\346\264\352he\220~\12\0\0\0jra\277\5\270\307\277\0\0\0\0\2300\25\0\15-m\217\310\217\233t(\0\0\0\37\217\0\337\0\0\24\0\240\366\250\0{\304\336\221\0\0\0\0HG\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\250\0\372\31\221|X\376\250\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02009  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02010  2016   NtRequestWaitReplyPort  (560, {56, 80, new_msg, 0, 44, 3, 20, 0}  (560, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0gS\263F\252\227\2L\355h\28\1\0\0\0\0\0\0\0&\0(\0\220\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02011   896   NtResumeThread  (532, ... 1, ) == 0x0
 02012   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 66912256, 1048576, ) == 0x0
 02013   896   NtAllocateVirtualMemory  (-1, 67952640, 0, 8192, 4096, 4, ... 67952640, 8192, ) == 0x0
 02014   384   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 02015   840   NtWaitForSingleObject  (92, 0, 0x0, ...
 02014   384   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 02016   384   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02017   384   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02018   384   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02019   384   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02020   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02021   896   NtProtectVirtualMemory  (-1, (0x40ce000), 4096, 260, ... (0x40ce000), 4096, 4, ) == 0x0
 02022   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 572, {1252, 876}, ) == 0x0
 02023   896   NtQueryInformationThread  (572, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 02024   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0l\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 02025   896   NtResumeThread  (572, ... 1, ) == 0x0
 02026   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02027   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02028   876   NtWaitForSingleObject  (92, 0, 0x0, ...
 02027   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02029   384   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02026   896   NtAllocateVirtualMemory  ... 67960832, 1048576, ) == 0x0
 02030   896   NtAllocateVirtualMemory  (-1, 69001216, 0, 8192, 4096, 4, ... 69001216, 8192, ) == 0x0
 02031   896   NtProtectVirtualMemory  (-1, (0x41ce000), 4096, 260, ... (0x41ce000), 4096, 4, ) == 0x0
 02032   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 576, {1252, 1104}, ) == 0x0
 02033   896   NtQueryInformationThread  (576, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 02034   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0P\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 02035   896   NtResumeThread  (576, ... 1, ) == 0x0
 02036   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 69009408, 1048576, ) == 0x0
 02037   896   NtAllocateVirtualMemory  (-1, 70049792, 0, 8192, 4096, 4, ... 70049792, 8192, ) == 0x0
 02038  1104   NtWaitForSingleObject  (92, 0, 0x0, ...
 02039   896   NtProtectVirtualMemory  (-1, (0x42ce000), 4096, 260, ... (0x42ce000), 4096, 4, ) == 0x0
 02040   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 580, {1252, 860}, ) == 0x0
 02041   896   NtQueryInformationThread  (580, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02042   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02043   896   NtResumeThread  (580, ... 1, ) == 0x0
 02044   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02045   860   NtWaitForSingleObject  (92, 0, 0x0, ...
 02044   896   NtAllocateVirtualMemory  ... 70057984, 1048576, ) == 0x0
 02046   896   NtAllocateVirtualMemory  (-1, 71098368, 0, 8192, 4096, 4, ... 71098368, 8192, ) == 0x0
 02047   896   NtProtectVirtualMemory  (-1, (0x43ce000), 4096, 260, ... (0x43ce000), 4096, 4, ) == 0x0
 02048   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 584, {1252, 1516}, ) == 0x0
 02049   896   NtQueryInformationThread  (584, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 02050   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\354\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 02051   896   NtResumeThread  (584, ... 1, ) == 0x0
 02052   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 71106560, 1048576, ) == 0x0
 02053   896   NtAllocateVirtualMemory  (-1, 72146944, 0, 8192, 4096, 4, ... 72146944, 8192, ) == 0x0
 02054  1516   NtWaitForSingleObject  (92, 0, 0x0, ...
 02055   896   NtProtectVirtualMemory  (-1, (0x44ce000), 4096, 260, ... (0x44ce000), 4096, 4, ) == 0x0
 02056   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 588, {1252, 780}, ) == 0x0
 02057   896   NtQueryInformationThread  (588, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02058   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02059   896   NtResumeThread  (588, ... 1, ) == 0x0
 02060   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02061   780   NtWaitForSingleObject  (92, 0, 0x0, ...
 02060   896   NtAllocateVirtualMemory  ... 72155136, 1048576, ) == 0x0
 02062   896   NtAllocateVirtualMemory  (-1, 73195520, 0, 8192, 4096, 4, ... 73195520, 8192, ) == 0x0
 02063   896   NtProtectVirtualMemory  (-1, (0x45ce000), 4096, 260, ... (0x45ce000), 4096, 4, ) == 0x0
 02064   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 592, {1252, 940}, ) == 0x0
 02065   896   NtQueryInformationThread  (592, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 02066   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 02067   896   NtResumeThread  (592, ... 1, ) == 0x0
 02068   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 73203712, 1048576, ) == 0x0
 02069   896   NtAllocateVirtualMemory  (-1, 74244096, 0, 8192, 4096, 4, ... 74244096, 8192, ) == 0x0
 02070   940   NtWaitForSingleObject  (92, 0, 0x0, ...
 02071   896   NtProtectVirtualMemory  (-1, (0x46ce000), 4096, 260, ... (0x46ce000), 4096, 4, ) == 0x0
 02072   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 596, {1252, 1268}, ) == 0x0
 02073   896   NtQueryInformationThread  (596, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02074   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 02075   896   NtResumeThread  (596, ... 1, ) == 0x0
 02076   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02077  1268   NtWaitForSingleObject  (92, 0, 0x0, ...
 02076   896   NtAllocateVirtualMemory  ... 74252288, 1048576, ) == 0x0
 02078   896   NtAllocateVirtualMemory  (-1, 75292672, 0, 8192, 4096, 4, ... 75292672, 8192, ) == 0x0
 02079   896   NtProtectVirtualMemory  (-1, (0x47ce000), 4096, 260, ... (0x47ce000), 4096, 4, ) == 0x0
 02080   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 600, {1252, 644}, ) == 0x0
 02081   896   NtQueryInformationThread  (600, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 02082   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\204\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 02083   896   NtResumeThread  (600, ... 1, ) == 0x0
 02084   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 75300864, 1048576, ) == 0x0
 02085   896   NtAllocateVirtualMemory  (-1, 76341248, 0, 8192, 4096, 4, ... 76341248, 8192, ) == 0x0
 02086   644   NtWaitForSingleObject  (92, 0, 0x0, ...
 02087   896   NtProtectVirtualMemory  (-1, (0x48ce000), 4096, 260, ... (0x48ce000), 4096, 4, ) == 0x0
 02088   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 604, {1252, 1736}, ) == 0x0
 02089   896   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02090   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02091   896   NtResumeThread  (604, ... 1, ) == 0x0
 02092   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02093  1736   NtWaitForSingleObject  (92, 0, 0x0, ...
 02092   896   NtAllocateVirtualMemory  ... 76349440, 1048576, ) == 0x0
 02094   896   NtAllocateVirtualMemory  (-1, 77389824, 0, 8192, 4096, 4, ... 77389824, 8192, ) == 0x0
 02095   896   NtProtectVirtualMemory  (-1, (0x49ce000), 4096, 260, ... (0x49ce000), 4096, 4, ) == 0x0
 02096   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 608, {1252, 320}, ) == 0x0
 02097   896   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 02098   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 02099   896   NtResumeThread  (608, ... 1, ) == 0x0
 02100   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 77398016, 1048576, ) == 0x0
 02101   896   NtAllocateVirtualMemory  (-1, 78438400, 0, 8192, 4096, 4, ... 78438400, 8192, ) == 0x0
 02102   320   NtWaitForSingleObject  (92, 0, 0x0, ...
 02103   896   NtProtectVirtualMemory  (-1, (0x4ace000), 4096, 260, ... (0x4ace000), 4096, 4, ) == 0x0
 02104   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 612, {1252, 380}, ) == 0x0
 02105   896   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 02106   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 02107   896   NtResumeThread  (612, ... 1, ) == 0x0
 02108   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02109   380   NtWaitForSingleObject  (92, 0, 0x0, ...
 02108   896   NtAllocateVirtualMemory  ... 78446592, 1048576, ) == 0x0
 02110   896   NtAllocateVirtualMemory  (-1, 79486976, 0, 8192, 4096, 4, ... 79486976, 8192, ) == 0x0
 02111   896   NtProtectVirtualMemory  (-1, (0x4bce000), 4096, 260, ... (0x4bce000), 4096, 4, ) == 0x0
 02112   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 616, {1252, 1332}, ) == 0x0
 02113   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 02114   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 02115   896   NtResumeThread  (616, ... 1, ) == 0x0
 02116   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 79495168, 1048576, ) == 0x0
 02117   896   NtAllocateVirtualMemory  (-1, 80535552, 0, 8192, 4096, 4, ... 80535552, 8192, ) == 0x0
 02118  1332   NtWaitForSingleObject  (92, 0, 0x0, ...
 02119   896   NtProtectVirtualMemory  (-1, (0x4cce000), 4096, 260, ... (0x4cce000), 4096, 4, ) == 0x0
 02120   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 1336}, ) == 0x0
 02121   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02122   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02123   896   NtResumeThread  (620, ... 1, ) == 0x0
 02124   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02125  1336   NtWaitForSingleObject  (92, 0, 0x0, ...
 02124   896   NtAllocateVirtualMemory  ... 80543744, 1048576, ) == 0x0
 02126   896   NtAllocateVirtualMemory  (-1, 81584128, 0, 8192, 4096, 4, ... 81584128, 8192, ) == 0x0
 02127   896   NtProtectVirtualMemory  (-1, (0x4dce000), 4096, 260, ... (0x4dce000), 4096, 4, ) == 0x0
 02128   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 1808}, ) == 0x0
 02129   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 02130   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\20\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 02131   896   NtResumeThread  (624, ... 1, ) == 0x0
 02132   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 81592320, 1048576, ) == 0x0
 02133   896   NtAllocateVirtualMemory  (-1, 82632704, 0, 8192, 4096, 4, ... 82632704, 8192, ) == 0x0
 02134  1808   NtWaitForSingleObject  (92, 0, 0x0, ...
 02135   896   NtProtectVirtualMemory  (-1, (0x4ece000), 4096, 260, ... (0x4ece000), 4096, 4, ) == 0x0
 02136   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 628, {1252, 468}, ) == 0x0
 02137   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 02138   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 02139   896   NtResumeThread  (628, ... 1, ) == 0x0
 02140   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02141   468   NtWaitForSingleObject  (92, 0, 0x0, ...
 02140   896   NtAllocateVirtualMemory  ... 82640896, 1048576, ) == 0x0
 02142   896   NtAllocateVirtualMemory  (-1, 83681280, 0, 8192, 4096, 4, ... 83681280, 8192, ) == 0x0
 02143   896   NtProtectVirtualMemory  (-1, (0x4fce000), 4096, 260, ... (0x4fce000), 4096, 4, ) == 0x0
 02144   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 752}, ) == 0x0
 02145   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02146   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02147   896   NtResumeThread  (632, ... 1, ) == 0x0
 02148   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 83689472, 1048576, ) == 0x0
 02149   896   NtAllocateVirtualMemory  (-1, 84729856, 0, 8192, 4096, 4, ... 84729856, 8192, ) == 0x0
 02150   752   NtWaitForSingleObject  (92, 0, 0x0, ...
 02151   896   NtProtectVirtualMemory  (-1, (0x50ce000), 4096, 260, ... (0x50ce000), 4096, 4, ) == 0x0
 02152   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1252, 1512}, ) == 0x0
 02153   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 02154   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 02155   896   NtResumeThread  (636, ... 1, ) == 0x0
 02156   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02157  1512   NtWaitForSingleObject  (92, 0, 0x0, ...
 02156   896   NtAllocateVirtualMemory  ... 84738048, 1048576, ) == 0x0
 02158   896   NtAllocateVirtualMemory  (-1, 85778432, 0, 8192, 4096, 4, ... 85778432, 8192, ) == 0x0
 02159   896   NtProtectVirtualMemory  (-1, (0x51ce000), 4096, 260, ... (0x51ce000), 4096, 4, ) == 0x0
 02160   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 1380}, ) == 0x0
 02161   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02162   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02163   896   NtResumeThread  (640, ... 1, ) == 0x0
 02164   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 85786624, 1048576, ) == 0x0
 02165   896   NtAllocateVirtualMemory  (-1, 86827008, 0, 8192, 4096, 4, ... 86827008, 8192, ) == 0x0
 02166  1380   NtWaitForSingleObject  (92, 0, 0x0, ...
 02167   896   NtProtectVirtualMemory  (-1, (0x52ce000), 4096, 260, ... (0x52ce000), 4096, 4, ) == 0x0
 02168   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 1564}, ) == 0x0
 02169   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 02170   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 02171   896   NtResumeThread  (644, ... 1, ) == 0x0
 02172   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 86835200, 1048576, ) == 0x0
 02173   896   NtAllocateVirtualMemory  (-1, 87875584, 0, 8192, 4096, 4, ... 87875584, 8192, ) == 0x0
 02174  1564   NtWaitForSingleObject  (92, 0, 0x0, ...
 02175   896   NtProtectVirtualMemory  (-1, (0x53ce000), 4096, 260, ... (0x53ce000), 4096, 4, ) == 0x0
 02176   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 648, {1252, 164}, ) == 0x0
 02177   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 02178   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 02179   896   NtResumeThread  (648, ... 1, ) == 0x0
 02180   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02181   164   NtWaitForSingleObject  (92, 0, 0x0, ...
 02180   896   NtAllocateVirtualMemory  ... 87883776, 1048576, ) == 0x0
 02182   896   NtAllocateVirtualMemory  (-1, 88924160, 0, 8192, 4096, 4, ... 88924160, 8192, ) == 0x0
 02183   896   NtProtectVirtualMemory  (-1, (0x54ce000), 4096, 260, ... (0x54ce000), 4096, 4, ) == 0x0
 02184   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 312}, ) == 0x0
 02185   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 02186   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\08\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 02187   896   NtResumeThread  (652, ... 1, ) == 0x0
 02188   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 88932352, 1048576, ) == 0x0
 02189   896   NtAllocateVirtualMemory  (-1, 89972736, 0, 8192, 4096, 4, ... 89972736, 8192, ) == 0x0
 02190   312   NtWaitForSingleObject  (92, 0, 0x0, ...
 02191   896   NtProtectVirtualMemory  (-1, (0x55ce000), 4096, 260, ... (0x55ce000), 4096, 4, ) == 0x0
 02192   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1252, 1964}, ) == 0x0
 02193   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 02194   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\254\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 02195   896   NtResumeThread  (656, ... 1, ) == 0x0
 02196   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02197  1964   NtWaitForSingleObject  (92, 0, 0x0, ...
 02196   896   NtAllocateVirtualMemory  ... 89980928, 1048576, ) == 0x0
 02198   896   NtAllocateVirtualMemory  (-1, 91021312, 0, 8192, 4096, 4, ... 91021312, 8192, ) == 0x0
 02199   896   NtProtectVirtualMemory  (-1, (0x56ce000), 4096, 260, ... (0x56ce000), 4096, 4, ) == 0x0
 02200   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 660, {1252, 1568}, ) == 0x0
 02201   896   NtQueryInformationThread  (660, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 02202   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0 \6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 02203   896   NtResumeThread  (660, ... 1, ) == 0x0
 02204   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 91029504, 1048576, ) == 0x0
 02205   896   NtAllocateVirtualMemory  (-1, 92069888, 0, 8192, 4096, 4, ... 92069888, 8192, ) == 0x0
 02206  1568   NtWaitForSingleObject  (92, 0, 0x0, ...
 02207   896   NtProtectVirtualMemory  (-1, (0x57ce000), 4096, 260, ... (0x57ce000), 4096, 4, ) == 0x0
 02208   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 1624}, ) == 0x0
 02209   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1624,}, 0x0, ) == 0x0
 02210   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0X\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0X\6\0\0" )  ) == 0x0
 02211   896   NtResumeThread  (664, ... 1, ) == 0x0
 02212   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02213  1624   NtWaitForSingleObject  (92, 0, 0x0, ...
 02212   896   NtAllocateVirtualMemory  ... 92078080, 1048576, ) == 0x0
 02214   896   NtAllocateVirtualMemory  (-1, 93118464, 0, 8192, 4096, 4, ... 93118464, 8192, ) == 0x0
 02215   896   NtProtectVirtualMemory  (-1, (0x58ce000), 4096, 260, ... (0x58ce000), 4096, 4, ) == 0x0
 02216   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1252, 1716}, ) == 0x0
 02217   896   NtQueryInformationThread  (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 02218   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\264\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 02219   896   NtResumeThread  (668, ... 1, ) == 0x0
 02220   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 93126656, 1048576, ) == 0x0
 02221   896   NtAllocateVirtualMemory  (-1, 94167040, 0, 8192, 4096, 4, ... 94167040, 8192, ) == 0x0
 02222  1716   NtWaitForSingleObject  (92, 0, 0x0, ...
 02223   896   NtProtectVirtualMemory  (-1, (0x59ce000), 4096, 260, ... (0x59ce000), 4096, 4, ) == 0x0
 02224   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 672, {1252, 1440}, ) == 0x0
 02225   896   NtQueryInformationThread  (672, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 02226   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\240\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 02227   896   NtResumeThread  (672, ... 1, ) == 0x0
 02228   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02229  1440   NtWaitForSingleObject  (92, 0, 0x0, ...
 02228   896   NtAllocateVirtualMemory  ... 94175232, 1048576, ) == 0x0
 02230   896   NtAllocateVirtualMemory  (-1, 95215616, 0, 8192, 4096, 4, ... 95215616, 8192, ) == 0x0
 02231   896   NtProtectVirtualMemory  (-1, (0x5ace000), 4096, 260, ... (0x5ace000), 4096, 4, ) == 0x0
 02232   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1252, 1664}, ) == 0x0
 02233   896   NtQueryInformationThread  (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 02234   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\200\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 02235   896   NtResumeThread  (676, ... 1, ) == 0x0
 02236   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 95223808, 1048576, ) == 0x0
 02237   896   NtAllocateVirtualMemory  (-1, 96264192, 0, 8192, 4096, 4, ... 96264192, 8192, ) == 0x0
 02238  1664   NtWaitForSingleObject  (92, 0, 0x0, ...
 02239   896   NtProtectVirtualMemory  (-1, (0x5bce000), 4096, 260, ... (0x5bce000), 4096, 4, ) == 0x0
 02240   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 680, {1252, 1972}, ) == 0x0
 02241   896   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 02242   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\264\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 02243   896   NtResumeThread  (680, ... 1, ) == 0x0
 02244   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02245  1972   NtWaitForSingleObject  (92, 0, 0x0, ...
 02244   896   NtAllocateVirtualMemory  ... 96272384, 1048576, ) == 0x0
 02246   896   NtAllocateVirtualMemory  (-1, 97312768, 0, 8192, 4096, 4, ... 97312768, 8192, ) == 0x0
 02247   896   NtProtectVirtualMemory  (-1, (0x5cce000), 4096, 260, ... (0x5cce000), 4096, 4, ) == 0x0
 02248   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 684, {1252, 1036}, ) == 0x0
 02249   896   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 02250   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\14\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 02251   896   NtResumeThread  (684, ... 1, ) == 0x0
 02252   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 97320960, 1048576, ) == 0x0
 02253   896   NtAllocateVirtualMemory  (-1, 98361344, 0, 8192, 4096, 4, ... 98361344, 8192, ) == 0x0
 02254  1036   NtWaitForSingleObject  (92, 0, 0x0, ...
 02255   896   NtProtectVirtualMemory  (-1, (0x5dce000), 4096, 260, ... (0x5dce000), 4096, 4, ) == 0x0
 02256   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1252, 1248}, ) == 0x0
 02257   896   NtQueryInformationThread  (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 02258   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\340\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 02259   896   NtResumeThread  (688, ... 1, ) == 0x0
 02260   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02261  1248   NtWaitForSingleObject  (92, 0, 0x0, ...
 02260   896   NtAllocateVirtualMemory  ... 98369536, 1048576, ) == 0x0
 02262   896   NtAllocateVirtualMemory  (-1, 99409920, 0, 8192, 4096, 4, ... 99409920, 8192, ) == 0x0
 02263   896   NtProtectVirtualMemory  (-1, (0x5ece000), 4096, 260, ... (0x5ece000), 4096, 4, ) == 0x0
 02264   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1252, 1656}, ) == 0x0
 02265   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 02266   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0x\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0x\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0x\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 02267   896   NtResumeThread  (692, ... 1, ) == 0x0
 02268   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 99418112, 1048576, ) == 0x0
 02269   896   NtAllocateVirtualMemory  (-1, 100458496, 0, 8192, 4096, 4, ... 100458496, 8192, ) == 0x0
 02270  1656   NtWaitForSingleObject  (92, 0, 0x0, ...
 02271   896   NtProtectVirtualMemory  (-1, (0x5fce000), 4096, 260, ... (0x5fce000), 4096, 4, ) == 0x0
 02272   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 696, {1252, 760}, ) == 0x0
 02273   896   NtQueryInformationThread  (696, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 02274   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\370\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 02275   896   NtResumeThread  (696, ... 1, ) == 0x0
 02276   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02277   760   NtWaitForSingleObject  (92, 0, 0x0, ...
 02276   896   NtAllocateVirtualMemory  ... 100466688, 1048576, ) == 0x0
 02278   896   NtAllocateVirtualMemory  (-1, 101507072, 0, 8192, 4096, 4, ... 101507072, 8192, ) == 0x0
 02279   896   NtProtectVirtualMemory  (-1, (0x60ce000), 4096, 260, ... (0x60ce000), 4096, 4, ) == 0x0
 02280   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 700, {1252, 484}, ) == 0x0
 02281   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=484,}, 0x0, ) == 0x0
 02282   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\344\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\344\1\0\0" )  ) == 0x0
 02283   896   NtResumeThread  (700, ... 1, ) == 0x0
 02284   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 101515264, 1048576, ) == 0x0
 02285   896   NtAllocateVirtualMemory  (-1, 102555648, 0, 8192, 4096, 4, ... 102555648, 8192, ) == 0x0
 02286   484   NtWaitForSingleObject  (92, 0, 0x0, ...
 02287   896   NtProtectVirtualMemory  (-1, (0x61ce000), 4096, 260, ... (0x61ce000), 4096, 4, ) == 0x0
 02288   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 1580}, ) == 0x0
 02289   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 02290   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0,\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 02291   896   NtResumeThread  (704, ... 1, ) == 0x0
 02292   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02293  1580   NtWaitForSingleObject  (92, 0, 0x0, ...
 02292   896   NtAllocateVirtualMemory  ... 102563840, 1048576, ) == 0x0
 02294   896   NtAllocateVirtualMemory  (-1, 103604224, 0, 8192, 4096, 4, ... 103604224, 8192, ) == 0x0
 02295   896   NtProtectVirtualMemory  (-1, (0x62ce000), 4096, 260, ... (0x62ce000), 4096, 4, ) == 0x0
 02296   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 708, {1252, 1756}, ) == 0x0
 02297   896   NtQueryInformationThread  (708, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 02298   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\334\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 02299   896   NtResumeThread  (708, ... 1, ) == 0x0
 02300   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 103612416, 1048576, ) == 0x0
 02301   896   NtAllocateVirtualMemory  (-1, 104652800, 0, 8192, 4096, 4, ... 104652800, 8192, ) == 0x0
 02302  1756   NtWaitForSingleObject  (92, 0, 0x0, ...
 02303   896   NtProtectVirtualMemory  (-1, (0x63ce000), 4096, 260, ... (0x63ce000), 4096, 4, ) == 0x0
 02304   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 712, {1252, 1304}, ) == 0x0
 02305   896   NtQueryInformationThread  (712, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 02306   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\30\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 02307   896   NtResumeThread  (712, ... 1, ) == 0x0
 02308   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02309  1304   NtWaitForSingleObject  (92, 0, 0x0, ...
 02308   896   NtAllocateVirtualMemory  ... 104660992, 1048576, ) == 0x0
 02310   896   NtAllocateVirtualMemory  (-1, 105701376, 0, 8192, 4096, 4, ... 105701376, 8192, ) == 0x0
 02311   896   NtProtectVirtualMemory  (-1, (0x64ce000), 4096, 260, ... (0x64ce000), 4096, 4, ) == 0x0
 02312   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 716, {1252, 2052}, ) == 0x0
 02313   896   NtQueryInformationThread  (716, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=2052,}, 0x0, ) == 0x0
 02314   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\4\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\4\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\4\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\4\10\0\0" )  ) == 0x0
 02315   896   NtResumeThread  (716, ... 1, ) == 0x0
 02316   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 105709568, 1048576, ) == 0x0
 02317   896   NtAllocateVirtualMemory  (-1, 106749952, 0, 8192, 4096, 4, ... 106749952, 8192, ) == 0x0
 02318  2052   NtWaitForSingleObject  (92, 0, 0x0, ...
 02319   896   NtProtectVirtualMemory  (-1, (0x65ce000), 4096, 260, ... (0x65ce000), 4096, 4, ) == 0x0
 02320   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 720, {1252, 2056}, ) == 0x0
 02321   896   NtQueryInformationThread  (720, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=2056,}, 0x0, ) == 0x0
 02322   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\10\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\10\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\10\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\10\10\0\0" )  ) == 0x0
 02323   896   NtResumeThread  (720, ... 1, ) == 0x0
 02324   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02325  2056   NtWaitForSingleObject  (92, 0, 0x0, ...
 02324   896   NtAllocateVirtualMemory  ... 106758144, 1048576, ) == 0x0
 02326   896   NtAllocateVirtualMemory  (-1, 107798528, 0, 8192, 4096, 4, ... 107798528, 8192, ) == 0x0
 02327   896   NtProtectVirtualMemory  (-1, (0x66ce000), 4096, 260, ... (0x66ce000), 4096, 4, ) == 0x0
 02328   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 724, {1252, 2060}, ) == 0x0
 02329   896   NtQueryInformationThread  (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=2060,}, 0x0, ) == 0x0
 02330   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\14\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\14\10\0\0" )  ) == 0x0
 02331   896   NtResumeThread  (724, ... 1, ) == 0x0
 02332   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 107806720, 1048576, ) == 0x0
 02333   896   NtAllocateVirtualMemory  (-1, 108847104, 0, 8192, 4096, 4, ... 108847104, 8192, ) == 0x0
 02334  2060   NtWaitForSingleObject  (92, 0, 0x0, ...
 02335   896   NtProtectVirtualMemory  (-1, (0x67ce000), 4096, 260, ... (0x67ce000), 4096, 4, ) == 0x0
 02336   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 728, {1252, 2064}, ) == 0x0
 02337   896   NtQueryInformationThread  (728, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 02338   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\20\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\20\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\20\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 02339   896   NtResumeThread  (728, ... 1, ) == 0x0
 02340   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02341  2064   NtWaitForSingleObject  (92, 0, 0x0, ...
 02340   896   NtAllocateVirtualMemory  ... 108855296, 1048576, ) == 0x0
 02342   896   NtAllocateVirtualMemory  (-1, 109895680, 0, 8192, 4096, 4, ... 109895680, 8192, ) == 0x0
 02343   896   NtProtectVirtualMemory  (-1, (0x68ce000), 4096, 260, ... (0x68ce000), 4096, 4, ) == 0x0
 02344   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 732, {1252, 2068}, ) == 0x0
 02345   896   NtQueryInformationThread  (732, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5b000,Pid=1252,Tid=2068,}, 0x0, ) == 0x0
 02346   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\24\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\24\10\0\0" )  ) == 0x0
 02347   896   NtResumeThread  (732, ... 1, ) == 0x0
 02348   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 109903872, 1048576, ) == 0x0
 02349   896   NtAllocateVirtualMemory  (-1, 110944256, 0, 8192, 4096, 4, ... 110944256, 8192, ) == 0x0
 02350  2068   NtWaitForSingleObject  (92, 0, 0x0, ...
 02351   896   NtProtectVirtualMemory  (-1, (0x69ce000), 4096, 260, ... (0x69ce000), 4096, 4, ) == 0x0
 02352   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 736, {1252, 2072}, ) == 0x0
 02353   896   NtQueryInformationThread  (736, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5a000,Pid=1252,Tid=2072,}, 0x0, ) == 0x0
 02354   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\30\10\0\0" )  ) == 0x0
 02355   896   NtResumeThread  (736, ... 1, ) == 0x0
 02356   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02357  2072   NtWaitForSingleObject  (92, 0, 0x0, ...
 02356   896   NtAllocateVirtualMemory  ... 110952448, 1048576, ) == 0x0
 02358   896   NtAllocateVirtualMemory  (-1, 111992832, 0, 8192, 4096, 4, ... 111992832, 8192, ) == 0x0
 02359   896   NtProtectVirtualMemory  (-1, (0x6ace000), 4096, 260, ... (0x6ace000), 4096, 4, ) == 0x0
 02360   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 740, {1252, 2076}, ) == 0x0
 02361   896   NtQueryInformationThread  (740, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff59000,Pid=1252,Tid=2076,}, 0x0, ) == 0x0
 02362   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\34\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\34\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\34\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\34\10\0\0" )  ) == 0x0
 02363   896   NtResumeThread  (740, ... 1, ) == 0x0
 02364   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 112001024, 1048576, ) == 0x0
 02365   896   NtAllocateVirtualMemory  (-1, 113041408, 0, 8192, 4096, 4, ... 113041408, 8192, ) == 0x0
 02366  2076   NtWaitForSingleObject  (92, 0, 0x0, ...
 02367   896   NtProtectVirtualMemory  (-1, (0x6bce000), 4096, 260, ... (0x6bce000), 4096, 4, ) == 0x0
 02368   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 744, {1252, 2080}, ) == 0x0
 02369   896   NtQueryInformationThread  (744, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff58000,Pid=1252,Tid=2080,}, 0x0, ) == 0x0
 02370   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0 \10\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0 \10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0 \10\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0 \10\0\0" )  ) == 0x0
 02371   896   NtResumeThread  (744, ... 1, ) == 0x0
 02372   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02373  2080   NtWaitForSingleObject  (92, 0, 0x0, ...
 02372   896   NtAllocateVirtualMemory  ... 113049600, 1048576, ) == 0x0
 02374   896   NtAllocateVirtualMemory  (-1, 114089984, 0, 8192, 4096, 4, ... 114089984, 8192, ) == 0x0
 02375   896   NtProtectVirtualMemory  (-1, (0x6cce000), 4096, 260, ... (0x6cce000), 4096, 4, ) == 0x0
 02376   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 748, {1252, 2084}, ) == 0x0
 02377   896   NtQueryInformationThread  (748, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff57000,Pid=1252,Tid=2084,}, 0x0, ) == 0x0
 02378   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0$\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0$\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0$\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0$\10\0\0" )  ) == 0x0
 02379   896   NtResumeThread  (748, ... 1, ) == 0x0
 02380   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02381  2084   NtWaitForSingleObject  (92, 0, 0x0, ...
 02380   896   NtAllocateVirtualMemory  ... 114098176, 1048576, ) == 0x0
 02382   896   NtAllocateVirtualMemory  (-1, 115138560, 0, 8192, 4096, 4, ... 115138560, 8192, ) == 0x0
 02383   896   NtProtectVirtualMemory  (-1, (0x6dce000), 4096, 260, ... (0x6dce000), 4096, 4, ) == 0x0
 02384   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 752, {1252, 2088}, ) == 0x0
 02385   896   NtQueryInformationThread  (752, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff56000,Pid=1252,Tid=2088,}, 0x0, ) == 0x0
 02386   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0(\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0(\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0(\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0(\10\0\0" )  ) == 0x0
 02387   896   NtResumeThread  (752, ... 1, ) == 0x0
 02388   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 115146752, 1048576, ) == 0x0
 02389   896   NtAllocateVirtualMemory  (-1, 116187136, 0, 8192, 4096, 4, ... 116187136, 8192, ) == 0x0
 02390  2088   NtWaitForSingleObject  (92, 0, 0x0, ...
 02391   896   NtProtectVirtualMemory  (-1, (0x6ece000), 4096, 260, ... (0x6ece000), 4096, 4, ) == 0x0
 02392   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 756, {1252, 2092}, ) == 0x0
 02393   896   NtQueryInformationThread  (756, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff55000,Pid=1252,Tid=2092,}, 0x0, ) == 0x0
 02394   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0,\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0,\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0,\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0,\10\0\0" )  ) == 0x0
 02395   896   NtResumeThread  (756, ... 1, ) == 0x0
 02396   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02397  2092   NtWaitForSingleObject  (92, 0, 0x0, ...
 02396   896   NtAllocateVirtualMemory  ... 116195328, 1048576, ) == 0x0
 02398   896   NtAllocateVirtualMemory  (-1, 117235712, 0, 8192, 4096, 4, ... 117235712, 8192, ) == 0x0
 02399   896   NtProtectVirtualMemory  (-1, (0x6fce000), 4096, 260, ... (0x6fce000), 4096, 4, ) == 0x0
 02400   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 760, {1252, 2096}, ) == 0x0
 02401   896   NtQueryInformationThread  (760, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff54000,Pid=1252,Tid=2096,}, 0x0, ) == 0x0
 02402   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\00\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\00\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\00\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\2\0\0\344\4\0\00\10\0\0" )  ) == 0x0
 02403   896   NtResumeThread  (760, ... 1, ) == 0x0
 02404   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 117243904, 1048576, ) == 0x0
 02405   896   NtAllocateVirtualMemory  (-1, 118284288, 0, 8192, 4096, 4, ... 118284288, 8192, ) == 0x0
 02406  2096   NtWaitForSingleObject  (92, 0, 0x0, ...
 02407   896   NtProtectVirtualMemory  (-1, (0x70ce000), 4096, 260, ... (0x70ce000), 4096, 4, ) == 0x0
 02408   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 764, {1252, 2100}, ) == 0x0
 02409   896   NtQueryInformationThread  (764, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff53000,Pid=1252,Tid=2100,}, 0x0, ) == 0x0
 02410   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\04\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\04\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\04\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\2\0\0\344\4\0\04\10\0\0" )  ) == 0x0
 02411   896   NtResumeThread  (764, ... 1, ) == 0x0
 02412   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02413  2100   NtWaitForSingleObject  (92, 0, 0x0, ...
 02412   896   NtAllocateVirtualMemory  ... 118292480, 1048576, ) == 0x0
 02414   896   NtAllocateVirtualMemory  (-1, 119332864, 0, 8192, 4096, 4, ... 119332864, 8192, ) == 0x0
 02415   896   NtProtectVirtualMemory  (-1, (0x71ce000), 4096, 260, ... (0x71ce000), 4096, 4, ) == 0x0
 02416   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 768, {1252, 2104}, ) == 0x0
 02417   896   NtQueryInformationThread  (768, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff52000,Pid=1252,Tid=2104,}, 0x0, ) == 0x0
 02418   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\08\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\08\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\08\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\3\0\0\344\4\0\08\10\0\0" )  ) == 0x0
 02419   896   NtResumeThread  (768, ... 1, ) == 0x0
 02420   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 119341056, 1048576, ) == 0x0
 02421   896   NtAllocateVirtualMemory  (-1, 120381440, 0, 8192, 4096, 4, ... 120381440, 8192, ) == 0x0
 02422  2104   NtWaitForSingleObject  (92, 0, 0x0, ...
 02423   896   NtProtectVirtualMemory  (-1, (0x72ce000), 4096, 260, ... (0x72ce000), 4096, 4, ) == 0x0
 02424   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 772, {1252, 2108}, ) == 0x0
 02425   896   NtQueryInformationThread  (772, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff51000,Pid=1252,Tid=2108,}, 0x0, ) == 0x0
 02426   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0<\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0<\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0<\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0\344\4\0\0<\10\0\0" )  ) == 0x0
 02427   896   NtResumeThread  (772, ... 1, ) == 0x0
 02428   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02429  2108   NtWaitForSingleObject  (92, 0, 0x0, ...
 02428   896   NtAllocateVirtualMemory  ... 120389632, 1048576, ) == 0x0
 02430   896   NtAllocateVirtualMemory  (-1, 121430016, 0, 8192, 4096, 4, ... 121430016, 8192, ) == 0x0
 02431   896   NtProtectVirtualMemory  (-1, (0x73ce000), 4096, 260, ... (0x73ce000), 4096, 4, ) == 0x0
 02432   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 776, {1252, 2112}, ) == 0x0
 02433   896   NtQueryInformationThread  (776, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff50000,Pid=1252,Tid=2112,}, 0x0, ) == 0x0
 02434   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0@\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0@\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0@\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0@\10\0\0" )  ) == 0x0
 02435   896   NtResumeThread  (776, ... 1, ) == 0x0
 02436   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 121438208, 1048576, ) == 0x0
 02437   896   NtAllocateVirtualMemory  (-1, 122478592, 0, 8192, 4096, 4, ... 122478592, 8192, ) == 0x0
 02438  2112   NtWaitForSingleObject  (92, 0, 0x0, ...
 02439   896   NtProtectVirtualMemory  (-1, (0x74ce000), 4096, 260, ... (0x74ce000), 4096, 4, ) == 0x0
 02440   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 780, {1252, 2116}, ) == 0x0
 02441   896   NtQueryInformationThread  (780, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4f000,Pid=1252,Tid=2116,}, 0x0, ) == 0x0
 02442   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0D\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0D\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0D\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0D\10\0\0" )  ) == 0x0
 02443   896   NtResumeThread  (780, ... 1, ) == 0x0
 02444   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02445  2116   NtWaitForSingleObject  (92, 0, 0x0, ...
 02444   896   NtAllocateVirtualMemory  ... 122486784, 1048576, ) == 0x0
 02446   896   NtAllocateVirtualMemory  (-1, 123527168, 0, 8192, 4096, 4, ... 123527168, 8192, ) == 0x0
 02447   896   NtProtectVirtualMemory  (-1, (0x75ce000), 4096, 260, ... (0x75ce000), 4096, 4, ) == 0x0
 02448   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 784, {1252, 2120}, ) == 0x0
 02449   896   NtQueryInformationThread  (784, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4e000,Pid=1252,Tid=2120,}, 0x0, ) == 0x0
 02450   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0H\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0H\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0H\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0H\10\0\0" )  ) == 0x0
 02451   896   NtResumeThread  (784, ... 1, ) == 0x0
 02452   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 123535360, 1048576, ) == 0x0
 02453   896   NtAllocateVirtualMemory  (-1, 124575744, 0, 8192, 4096, 4, ... 124575744, 8192, ) == 0x0
 02454  2120   NtWaitForSingleObject  (92, 0, 0x0, ...
 02455   896   NtProtectVirtualMemory  (-1, (0x76ce000), 4096, 260, ... (0x76ce000), 4096, 4, ) == 0x0
 02456   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02457   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02458   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 788, ) == 0x0
 02459   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 792, ) }, ... 792, ) == 0x0
 02456   896   NtCreateThread  ... 796, {1252, 2124}, ) == 0x0
 02460   896   NtQueryInformationThread  (796, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4d000,Pid=1252,Tid=2124,}, 0x0, ) == 0x0
 02461   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0L\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0L\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0L\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\3\0\0\344\4\0\0L\10\0\0" )  ) == 0x0
 02462   896   NtResumeThread  (796, ... 1, ) == 0x0
 02463   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02464   384   NtQueryValueKey  (792,  (792, "LdapClientIntegrity", Partial, 144, ... , Partial, 144, ...
 02465  2124   NtWaitForSingleObject  (92, 0, 0x0, ...
 02464   384   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02466   384   NtClose  (792, ... ) == 0x0
 02467   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02463   896   NtAllocateVirtualMemory  ... 124583936, 1048576, ) == 0x0
 02468   896   NtAllocateVirtualMemory  (-1, 125624320, 0, 8192, 4096, 4, ... 125624320, 8192, ) == 0x0
 02469   896   NtProtectVirtualMemory  (-1, (0x77ce000), 4096, 260, ... (0x77ce000), 4096, 4, ) == 0x0
 02470   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 792, {1252, 2128}, ) == 0x0
 02471   896   NtQueryInformationThread  (792, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4c000,Pid=1252,Tid=2128,}, 0x0, ) == 0x0
 02472   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\0P\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\0P\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\0P\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0\344\4\0\0P\10\0\0" )  ) == 0x0
 02473   896   NtResumeThread  (792, ... 1, ) == 0x0
 02474   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 125632512, 1048576, ) == 0x0
 02475   896   NtAllocateVirtualMemory  (-1, 126672896, 0, 8192, 4096, 4, ... 126672896, 8192, ) == 0x0
 02476  2128   NtWaitForSingleObject  (92, 0, 0x0, ...
 02477   896   NtProtectVirtualMemory  (-1, (0x78ce000), 4096, 260, ... (0x78ce000), 4096, 4, ) == 0x0
 02478   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 800, {1252, 2132}, ) == 0x0
 02479   896   NtQueryInformationThread  (800, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4b000,Pid=1252,Tid=2132,}, 0x0, ) == 0x0
 02480   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0T\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0T\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81978, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0T\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0T\10\0\0" )  ) == 0x0
 02481   896   NtResumeThread  (800, ... 1, ) == 0x0
 02482   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02483  2132   NtWaitForSingleObject  (92, 0, 0x0, ...
 02482   896   NtAllocateVirtualMemory  ... 126681088, 1048576, ) == 0x0
 02484   896   NtAllocateVirtualMemory  (-1, 127721472, 0, 8192, 4096, 4, ... 127721472, 8192, ) == 0x0
 02485   896   NtProtectVirtualMemory  (-1, (0x79ce000), 4096, 260, ... (0x79ce000), 4096, 4, ) == 0x0
 02486   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 804, {1252, 2136}, ) == 0x0
 02487   896   NtQueryInformationThread  (804, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4a000,Pid=1252,Tid=2136,}, 0x0, ) == 0x0
 02488   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0X\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0X\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81979, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0X\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0X\10\0\0" )  ) == 0x0
 02489   896   NtResumeThread  (804, ... 1, ) == 0x0
 02490   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 127729664, 1048576, ) == 0x0
 02491   896   NtAllocateVirtualMemory  (-1, 128770048, 0, 8192, 4096, 4, ... 128770048, 8192, ) == 0x0
 02492  2136   NtWaitForSingleObject  (92, 0, 0x0, ...
 02493   896   NtProtectVirtualMemory  (-1, (0x7ace000), 4096, 260, ... (0x7ace000), 4096, 4, ) == 0x0
 02494   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 808, {1252, 2140}, ) == 0x0
 02495   896   NtQueryInformationThread  (808, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff49000,Pid=1252,Tid=2140,}, 0x0, ) == 0x0
 02496   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0\\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0\\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0\\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\3\0\0\344\4\0\0\\10\0\0" )  ) == 0x0
 02497   896   NtResumeThread  (808, ... 1, ) == 0x0
 02498   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02499  2140   NtWaitForSingleObject  (92, 0, 0x0, ...
 02498   896   NtAllocateVirtualMemory  ... 128778240, 1048576, ) == 0x0
 02500   896   NtAllocateVirtualMemory  (-1, 129818624, 0, 8192, 4096, 4, ... 129818624, 8192, ) == 0x0
 02501   896   NtProtectVirtualMemory  (-1, (0x7bce000), 4096, 260, ... (0x7bce000), 4096, 4, ) == 0x0
 02502   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 812, {1252, 2144}, ) == 0x0
 02503   896   NtQueryInformationThread  (812, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff48000,Pid=1252,Tid=2144,}, 0x0, ) == 0x0
 02504   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0`\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0`\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0`\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\3\0\0\344\4\0\0`\10\0\0" )  ) == 0x0
 02505   896   NtResumeThread  (812, ... 1, ) == 0x0
 02506   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 129826816, 1048576, ) == 0x0
 02507   896   NtAllocateVirtualMemory  (-1, 130867200, 0, 8192, 4096, 4, ... 130867200, 8192, ) == 0x0
 02508  2144   NtWaitForSingleObject  (92, 0, 0x0, ...
 02509   896   NtProtectVirtualMemory  (-1, (0x7cce000), 4096, 260, ... (0x7cce000), 4096, 4, ) == 0x0
 02510   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 816, {1252, 2148}, ) == 0x0
 02511   896   NtQueryInformationThread  (816, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff47000,Pid=1252,Tid=2148,}, 0x0, ) == 0x0
 02512   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0d\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0d\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0d\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0d\10\0\0" )  ) == 0x0
 02513   896   NtResumeThread  (816, ... 1, ) == 0x0
 02514   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02515  2148   NtWaitForSingleObject  (92, 0, 0x0, ...
 02514   896   NtAllocateVirtualMemory  ... 130875392, 1048576, ) == 0x0
 02516   896   NtAllocateVirtualMemory  (-1, 131915776, 0, 8192, 4096, 4, ... 131915776, 8192, ) == 0x0
 02517   896   NtProtectVirtualMemory  (-1, (0x7dce000), 4096, 260, ... (0x7dce000), 4096, 4, ) == 0x0
 02518   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 820, {1252, 2152}, ) == 0x0
 02519   896   NtQueryInformationThread  (820, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff46000,Pid=1252,Tid=2152,}, 0x0, ) == 0x0
 02520   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0h\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0h\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0h\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0h\10\0\0" )  ) == 0x0
 02521   896   NtResumeThread  (820, ... 1, ) == 0x0
 02522   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 131923968, 1048576, ) == 0x0
 02523   896   NtAllocateVirtualMemory  (-1, 132964352, 0, 8192, 4096, 4, ... 132964352, 8192, ) == 0x0
 02524  2152   NtWaitForSingleObject  (92, 0, 0x0, ...
 02525   896   NtProtectVirtualMemory  (-1, (0x7ece000), 4096, 260, ... (0x7ece000), 4096, 4, ) == 0x0
 02526   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 824, {1252, 2156}, ) == 0x0
 02527   896   NtQueryInformationThread  (824, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff45000,Pid=1252,Tid=2156,}, 0x0, ) == 0x0
 02528   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0l\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0l\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0l\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0l\10\0\0" )  ) == 0x0
 02529   896   NtResumeThread  (824, ... 1, ) == 0x0
 02530   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02531  2156   NtWaitForSingleObject  (92, 0, 0x0, ...
 02530   896   NtAllocateVirtualMemory  ... 132972544, 1048576, ) == 0x0
 02532   896   NtAllocateVirtualMemory  (-1, 134012928, 0, 8192, 4096, 4, ... 134012928, 8192, ) == 0x0
 02533   896   NtProtectVirtualMemory  (-1, (0x7fce000), 4096, 260, ... (0x7fce000), 4096, 4, ) == 0x0
 02534   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 828, {1252, 2160}, ) == 0x0
 02535   896   NtQueryInformationThread  (828, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff44000,Pid=1252,Tid=2160,}, 0x0, ) == 0x0
 02536   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0p\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0p\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0p\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0p\10\0\0" )  ) == 0x0
 02537   896   NtResumeThread  (828, ... 1, ) == 0x0
 02538   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 134021120, 1048576, ) == 0x0
 02539   896   NtAllocateVirtualMemory  (-1, 135061504, 0, 8192, 4096, 4, ... 135061504, 8192, ) == 0x0
 02540  2160   NtWaitForSingleObject  (92, 0, 0x0, ...
 02541   896   NtProtectVirtualMemory  (-1, (0x80ce000), 4096, 260, ... (0x80ce000), 4096, 4, ) == 0x0
 02542   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 832, {1252, 2164}, ) == 0x0
 02543   896   NtQueryInformationThread  (832, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff43000,Pid=1252,Tid=2164,}, 0x0, ) == 0x0
 02544   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0t\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0t\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0t\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\3\0\0\344\4\0\0t\10\0\0" )  ) == 0x0
 02545   896   NtResumeThread  (832, ... 1, ) == 0x0
 02546   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02547  2164   NtWaitForSingleObject  (92, 0, 0x0, ...
 02546   896   NtAllocateVirtualMemory  ... 135069696, 1048576, ) == 0x0
 02548   896   NtAllocateVirtualMemory  (-1, 136110080, 0, 8192, 4096, 4, ... 136110080, 8192, ) == 0x0
 02549   896   NtProtectVirtualMemory  (-1, (0x81ce000), 4096, 260, ... (0x81ce000), 4096, 4, ) == 0x0
 02550   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 836, {1252, 2168}, ) == 0x0
 02551   896   NtQueryInformationThread  (836, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff42000,Pid=1252,Tid=2168,}, 0x0, ) == 0x0
 02552   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0x\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0x\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0x\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0x\10\0\0" )  ) == 0x0
 02553   896   NtResumeThread  (836, ... 1, ) == 0x0
 02554   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 136118272, 1048576, ) == 0x0
 02555   896   NtAllocateVirtualMemory  (-1, 137158656, 0, 8192, 4096, 4, ... 137158656, 8192, ) == 0x0
 02556  2168   NtWaitForSingleObject  (92, 0, 0x0, ...
 02557   896   NtProtectVirtualMemory  (-1, (0x82ce000), 4096, 260, ... (0x82ce000), 4096, 4, ) == 0x0
 02558   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 840, {1252, 2172}, ) == 0x0
 02559   896   NtQueryInformationThread  (840, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff41000,Pid=1252,Tid=2172,}, 0x0, ) == 0x0
 02010  2016   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 2016, 81921, 0}  ... {44, 68, reply, 0, 1252, 2016, 81921, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02560   384   NtQueryPerformanceCounter  (...
 02561  2016   NtRaiseException  (11074064, 11073324, 1, ...
 02560   384   NtQueryPerformanceCounter  ... {-1438896707, 16}, {3579545, 0}, ) == 0x0
 02562  2016   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 02563   384   NtSetEventBoostPriority  (92, ...
 02564   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0|\10\0\0" ...  ...
 01938   792   NtWaitForSingleObject  ... ) == 0x0
 02563   384   NtSetEventBoostPriority  ... ) == 0x0
 02565   792   NtSetEventBoostPriority  (92, ...
 02564   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81988, 0}  ... {28, 56, reply, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0|\10\0\0" )  ) == 0x0
 02562  2016   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 01953  1484   NtWaitForSingleObject  ... ) == 0x0
 02565   792   NtSetEventBoostPriority  ... ) == 0x0
 02566   896   NtResumeThread  (840, ...
 02567  1484   NtAllocateVirtualMemory  (-1, 8871936, 0, 4096, 4096, 4, ...
 02568  2016   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 02569   384   NtWaitForSingleObject  (92, 0, 0x0, ...
 02567  1484   NtAllocateVirtualMemory  ... 8871936, 4096, ) == 0x0
 02566   896   NtResumeThread  ... 1, ) == 0x0
 02568  2016   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02570   792   NtTestAlert  (...
 02571  2172   NtWaitForSingleObject  (92, 0, 0x0, ...
 02572   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02573  2016   NtContinue  (11072292, 0, ...
 02570   792   NtTestAlert  ... ) == 0x0
 02574  1484   NtSetEventBoostPriority  (92, ...
 02575  2016   NtDeviceIoControlFile  (400, 108, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 02576   792   NtContinue  (62717232, 1, ...
 01975   888   NtWaitForSingleObject  ... ) == 0x0
 02574  1484   NtSetEventBoostPriority  ... ) == 0x0
 02575  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 02577   888   NtSetEventBoostPriority  (92, ...
 02578   792   NtRegisterThreadTerminatePort  (24, ...
 02579  1484   NtTestAlert  (...
 02572   896   NtAllocateVirtualMemory  ... 137166848, 1048576, ) == 0x0
 01991  1120   NtWaitForSingleObject  ... ) == 0x0
 02577   888   NtSetEventBoostPriority  ... ) == 0x0
 02578   792   NtRegisterThreadTerminatePort  ... ) == 0x0
 02579  1484   NtTestAlert  ... ) == 0x0
 02580  1120   NtSetEventBoostPriority  (92, ...
 02581   896   NtAllocateVirtualMemory  (-1, 138207232, 0, 8192, 4096, 4, ...
 02582  2016   NtWaitForSingleObject  (108, 1, {-5000000, -1}, ...
 02583   792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02015   840   NtWaitForSingleObject  ... ) == 0x0
 02580  1120   NtSetEventBoostPriority  ... ) == 0x0
 02584  1484   NtContinue  (63765808, 1, ...
 02581   896   NtAllocateVirtualMemory  ... 138207232, 8192, ) == 0x0
 02585   888   NtTestAlert  (...
 02586   840   NtSetEventBoostPriority  (92, ...
 02583   792   NtDuplicateObject  ... 844, ) == 0x0
 02587  1484   NtRegisterThreadTerminatePort  (24, ...
 02588   896   NtProtectVirtualMemory  (-1, (0x83ce000), 4096, 260, ...
 02028   876   NtWaitForSingleObject  ... ) == 0x0
 02586   840   NtSetEventBoostPriority  ... ) == 0x0
 02585   888   NtTestAlert  ... ) == 0x0
 02589   792   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02590  1120   NtTestAlert  (...
 02591   876   NtSetEventBoostPriority  (92, ...
 02588   896   NtProtectVirtualMemory  ... (0x83ce000), 4096, 4, ) == 0x0
 02587  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 02592   888   NtContinue  (64814384, 1, ...
 02589   792   NtWaitForSingleObject  ... ) == 0x102
 02038  1104   NtWaitForSingleObject  ... ) == 0x0
 02591   876   NtSetEventBoostPriority  ... ) == 0x0
 02590  1120   NtTestAlert  ... ) == 0x0
 02593   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02594  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02595   888   NtRegisterThreadTerminatePort  (24, ...
 02596  1104   NtSetEventBoostPriority  (92, ...
 02597   792   NtWaitForSingleObject  (132, 0, 0x0, ...
 02598   840   NtTestAlert  (...
 02599  1120   NtContinue  (65862960, 1, ...
 02600   876   NtTestAlert  (...
 02594  1484   NtDuplicateObject  ... 848, ) == 0x0
 02045   860   NtWaitForSingleObject  ... ) == 0x0
 02596  1104   NtSetEventBoostPriority  ... ) == 0x0
 02595   888   NtRegisterThreadTerminatePort  ... ) == 0x0
 02598   840   NtTestAlert  ... ) == 0x0
 02601  1120   NtRegisterThreadTerminatePort  (24, ...
 02600   876   NtTestAlert  ... ) == 0x0
 02602   860   NtSetEventBoostPriority  (92, ...
 02603  1484   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02593   896   NtCreateThread  ... 852, {1252, 2176}, ) == 0x0
 02604   888   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02605   840   NtContinue  (66911536, 1, ...
 02601  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 02054  1516   NtWaitForSingleObject  ... ) == 0x0
 02602   860   NtSetEventBoostPriority  ... ) == 0x0
 02606   876   NtContinue  (67960112, 1, ...
 02603  1484   NtWaitForSingleObject  ... ) == 0x102
 02607   896   NtQueryInformationThread  (852, Basic, 28, ...
 02608  1104   NtTestAlert  (...
 02609   840   NtRegisterThreadTerminatePort  (24, ...
 02610  1516   NtSetEventBoostPriority  (92, ...
 02611  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02604   888   NtDuplicateObject  ... 856, ) == 0x0
 02612   876   NtRegisterThreadTerminatePort  (24, ...
 02613   860   NtTestAlert  (...
 02607   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff40000,Pid=1252,Tid=2176,}, 0x0, ) == 0x0
 02608  1104   NtTestAlert  ... ) == 0x0
 02061   780   NtWaitForSingleObject  ... ) == 0x0
 02610  1516   NtSetEventBoostPriority  ... ) == 0x0
 02609   840   NtRegisterThreadTerminatePort  ... ) == 0x0
 02614  1484   NtWaitForSingleObject  (132, 0, 0x0, ...
 02615   888   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02612   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 02613   860   NtTestAlert  ... ) == 0x0
 02616   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0\200\10\0\0" ...  ...
 02617   780   NtSetEventBoostPriority  (92, ...
 02618  1104   NtContinue  (69008688, 1, ...
 02611  1120   NtDuplicateObject  ... 860, ) == 0x0
 02619   840   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02615   888   NtWaitForSingleObject  ... ) == 0x102
 02620   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02621   860   NtContinue  (70057264, 1, ...
 02070   940   NtWaitForSingleObject  ... ) == 0x0
 02617   780   NtSetEventBoostPriority  ... ) == 0x0
 02616   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81989, 0}  ... {28, 56, reply, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0\200\10\0\0" )  ) == 0x0
 02622  1104   NtRegisterThreadTerminatePort  (24, ...
 02623  1120   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02624  1516   NtTestAlert  (...
 02625   888   NtWaitForSingleObject  (132, 0, 0x0, ...
 02619   840   NtDuplicateObject  ... 864, ) == 0x0
 02626   940   NtSetEventBoostPriority  (92, ...
 02627   860   NtRegisterThreadTerminatePort  (24, ...
 02620   876   NtDuplicateObject  ... 868, ) == 0x0
 02628   780   NtTestAlert  (...
 02622  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 02623  1120   NtWaitForSingleObject  ... ) == 0x102
 02624  1516   NtTestAlert  ... ) == 0x0
 02077  1268   NtWaitForSingleObject  ... ) == 0x0
 02626   940   NtSetEventBoostPriority  ... ) == 0x0
 02629   840   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02627   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 02630   876   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02628   780   NtTestAlert  ... ) == 0x0
 02631  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02632  1120   NtWaitForSingleObject  (132, 0, 0x0, ...
 02633  1268   NtSetEventBoostPriority  (92, ...
 02634  1516   NtContinue  (71105840, 1, ...
 02635   896   NtResumeThread  (852, ...
 02629   840   NtWaitForSingleObject  ... ) == 0x102
 02636   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02630   876   NtWaitForSingleObject  ... ) == 0x102
 02637   780   NtContinue  (72154416, 1, ...
 02638   940   NtTestAlert  (...
 02086   644   NtWaitForSingleObject  ... ) == 0x0
 02633  1268   NtSetEventBoostPriority  ... ) == 0x0
 02639  1516   NtRegisterThreadTerminatePort  (24, ...
 02635   896   NtResumeThread  ... 1, ) == 0x0
 02640   840   NtWaitForSingleObject  (132, 0, 0x0, ...
 02631  1104   NtDuplicateObject  ... 872, ) == 0x0
 02641  2176   NtWaitForSingleObject  (92, 0, 0x0, ...
 02642   876   NtWaitForSingleObject  (132, 0, 0x0, ...
 02643   780   NtRegisterThreadTerminatePort  (24, ...
 02644   644   NtSetEventBoostPriority  (92, ...
 02638   940   NtTestAlert  ... ) == 0x0
 02636   860   NtDuplicateObject  ... 876, ) == 0x0
 02639  1516   NtRegisterThreadTerminatePort  ... ) == 0x0
 02645   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02646  1104   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02093  1736   NtWaitForSingleObject  ... ) == 0x0
 02644   644   NtSetEventBoostPriority  ... ) == 0x0
 02643   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 02647   940   NtContinue  (73202992, 1, ...
 02648   860   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02649  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02645   896   NtAllocateVirtualMemory  ... 138215424, 1048576, ) == 0x0
 02650  1736   NtSetEventBoostPriority  (92, ...
 02646  1104   NtWaitForSingleObject  ... ) == 0x102
 02651  1268   NtTestAlert  (...
 02652   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02653   940   NtRegisterThreadTerminatePort  (24, ...
 02648   860   NtWaitForSingleObject  ... ) == 0x102
 02654   644   NtTestAlert  (...
 02102   320   NtWaitForSingleObject  ... ) == 0x0
 02650  1736   NtSetEventBoostPriority  ... ) == 0x0
 02655   896   NtAllocateVirtualMemory  (-1, 139255808, 0, 8192, 4096, 4, ...
 02656  1104   NtWaitForSingleObject  (132, 0, 0x0, ...
 02651  1268   NtTestAlert  ... ) == 0x0
 02649  1516   NtDuplicateObject  ... 880, ) == 0x0
 02653   940   NtRegisterThreadTerminatePort  ... ) == 0x0
 02657   860   NtWaitForSingleObject  (132, 0, 0x0, ...
 02658   320   NtSetEventBoostPriority  (92, ...
 02654   644   NtTestAlert  ... ) == 0x0
 02652   780   NtDuplicateObject  ... 884, ) == 0x0
 02655   896   NtAllocateVirtualMemory  ... 139255808, 8192, ) == 0x0
 02659  1268   NtContinue  (74251568, 1, ...
 02660  1516   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ...
 02661   940   NtWaitForSingleObject  (280, 0, 0x0, ...
 02109   380   NtWaitForSingleObject  ... ) == 0x0
 02658   320   NtSetEventBoostPriority  ... ) == 0x0
 02662   644   NtContinue  (75300144, 1, ...
 02663   780   NtWaitForSingleObject  (280, 0, 0x0, ...
 02664  1736   NtTestAlert  (...
 02665  1268   NtRegisterThreadTerminatePort  (24, ...
 02660  1516   NtAllocateVirtualMemory  ... 1404928, 4096, ) == 0x0
 02666   896   NtProtectVirtualMemory  (-1, (0x84ce000), 4096, 260, ...
 02667   380   NtWaitForSingleObject  (280, 0, 0x0, ...
 02668   644   NtRegisterThreadTerminatePort  (24, ...
 02664  1736   NtTestAlert  ... ) == 0x0
 02665  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 02669  1516   NtSetEventBoostPriority  (280, ...
 02666   896   NtProtectVirtualMemory  ... (0x84ce000), 4096, 4, ) == 0x0
 02668   644   NtRegisterThreadTerminatePort  ... ) == 0x0
 02670  1736   NtContinue  (76348720, 1, ...
 02671  1268   NtWaitForSingleObject  (280, 0, 0x0, ...
 02661   940   NtWaitForSingleObject  ... ) == 0x0
 02669  1516   NtSetEventBoostPriority  ... ) == 0x0
 02672   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02673   644   NtWaitForSingleObject  (280, 0, 0x0, ...
 02674  1736   NtRegisterThreadTerminatePort  (24, ...
 02675   320   NtTestAlert  (...
 02676   940   NtSetEventBoostPriority  (280, ...
 02677  1516   NtWaitForSingleObject  (280, 0, 0x0, ...
 02672   896   NtCreateThread  ... 888, {1252, 2180}, ) == 0x0
 02674  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 02663   780   NtWaitForSingleObject  ... ) == 0x0
 02675   320   NtTestAlert  ... ) == 0x0
 02676   940   NtSetEventBoostPriority  ... ) == 0x0
 02678   896   NtQueryInformationThread  (888, Basic, 28, ...
 02679  1736   NtWaitForSingleObject  (280, 0, 0x0, ...
 02680   780   NtSetEventBoostPriority  (280, ...
 02681   320   NtContinue  (77397296, 1, ...
 02682   940   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02678   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff3f000,Pid=1252,Tid=2180,}, 0x0, ) == 0x0
 02667   380   NtWaitForSingleObject  ... ) == 0x0
 02680   780   NtSetEventBoostPriority  ... ) == 0x0
 02683   320   NtRegisterThreadTerminatePort  (24, ...
 02682   940   NtDuplicateObject  ... 892, ) == 0x0
 02684   380   NtSetEventBoostPriority  (280, ...
 02685   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\204\10\0\0" ...  ...
 02683   320   NtRegisterThreadTerminatePort  ... ) == 0x0
 02686   780   NtWaitForSingleObject  (280, 0, 0x0, ...
 02671  1268   NtWaitForSingleObject  ... ) == 0x0
 02684   380   NtSetEventBoostPriority  ... ) == 0x0
 02685   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81990, 0}  ... {28, 56, reply, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\204\10\0\0" )  ) == 0x0
 02687   320   NtWaitForSingleObject  (280, 0, 0x0, ...
 02688  1268   NtSetEventBoostPriority  (280, ...
 02689   940   NtWaitForSingleObject  (280, 0, 0x0, ...
 02690   896   NtResumeThread  (888, ...
 02691   380   NtSetEventBoostPriority  (92, ...
 02673   644   NtWaitForSingleObject  ... ) == 0x0
 02690   896   NtResumeThread  ... 1, ) == 0x0
 02118  1332   NtWaitForSingleObject  ... ) == 0x0
 02691   380   NtSetEventBoostPriority  ... ) == 0x0
 02692   644   NtSetEventBoostPriority  (280, ...
 02693  1332   NtWaitForSingleObject  (280, 0, 0x0, ...
 02694   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02695   380   NtTestAlert  (...
 02677  1516   NtWaitForSingleObject  ... ) == 0x0
 02692   644   NtSetEventBoostPriority  ... ) == 0x0
 02688  1268   NtSetEventBoostPriority  ... ) == 0x0
 02696  2180   NtWaitForSingleObject  (92, 0, 0x0, ...
 02695   380   NtTestAlert  ... ) == 0x0
 02697  1516   NtSetEventBoostPriority  (280, ...
 02698   644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02699  1268   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02700   380   NtContinue  (78445872, 1, ...
 02679  1736   NtWaitForSingleObject  ... ) == 0x0
 02698   644   NtDuplicateObject  ... 896, ) == 0x0
 02699  1268   NtDuplicateObject  ... 900, ) == 0x0
 02701   380   NtRegisterThreadTerminatePort  (24, ...
 02702  1736   NtSetEventBoostPriority  (280, ...
 02697  1516   NtSetEventBoostPriority  ... ) == 0x0
 02694   896   NtAllocateVirtualMemory  ... 139264000, 1048576, ) == 0x0
 02703   644   NtWaitForSingleObject  (280, 0, 0x0, ...
 02704  1268   NtWaitForSingleObject  (280, 0, 0x0, ...
 02686   780   NtWaitForSingleObject  ... ) == 0x0
 02705  1516   NtWaitForSingleObject  (280, 0, 0x0, ...
 02706   896   NtAllocateVirtualMemory  (-1, 140304384, 0, 8192, 4096, 4, ...
 02707   780   NtSetEventBoostPriority  (280, ...
 02706   896   NtAllocateVirtualMemory  ... 140304384, 8192, ) == 0x0
 02689   940   NtWaitForSingleObject  ... ) == 0x0
 02707   780   NtSetEventBoostPriority  ... ) == 0x0
 02708   940   NtSetEventBoostPriority  (280, ...
 02709   896   NtProtectVirtualMemory  (-1, (0x85ce000), 4096, 260, ...
 02693  1332   NtWaitForSingleObject  ... ) == 0x0
 02708   940   NtSetEventBoostPriority  ... ) == 0x0
 02710   780   NtWaitForSingleObject  (280, 0, 0x0, ...
 02711  1332   NtSetEventBoostPriority  (280, ...
 02709   896   NtProtectVirtualMemory  ... (0x85ce000), 4096, 4, ) == 0x0
 02712   940   NtWaitForSingleObject  (280, 0, 0x0, ...
 02702  1736   NtSetEventBoostPriority  ... ) == 0x0
 02701   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 02687   320   NtWaitForSingleObject  ... ) == 0x0
 02711  1332   NtSetEventBoostPriority  ... ) == 0x0
 02713   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02714  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02715   320   NtSetEventBoostPriority  (280, ...
 02716   380   NtWaitForSingleObject  (280, 0, 0x0, ...
 02717  1332   NtSetEventBoostPriority  (92, ...
 02703   644   NtWaitForSingleObject  ... ) == 0x0
 02714  1736   NtDuplicateObject  ... 904, ) == 0x0
 02125  1336   NtWaitForSingleObject  ... ) == 0x0
 02717  1332   NtSetEventBoostPriority  ... ) == 0x0
 02718   644   NtSetEventBoostPriority  (280, ...
 02715   320   NtSetEventBoostPriority  ... ) == 0x0
 02713   896   NtCreateThread  ... 908, {1252, 2184}, ) == 0x0
 02719  1336   NtWaitForSingleObject  (280, 0, 0x0, ...
 02720  1332   NtTestAlert  (...
 02704  1268   NtWaitForSingleObject  ... ) == 0x0
 02718   644   NtSetEventBoostPriority  ... ) == 0x0
 02721   320   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02722   896   NtQueryInformationThread  (908, Basic, 28, ...
 02723  1268   NtSetEventBoostPriority  (280, ...
 02720  1332   NtTestAlert  ... ) == 0x0
 02724   644   NtWaitForSingleObject  (280, 0, 0x0, ...
 02721   320   NtDuplicateObject  ... 912, ) == 0x0
 02705  1516   NtWaitForSingleObject  ... ) == 0x0
 02723  1268   NtSetEventBoostPriority  ... ) == 0x0
 02722   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff3e000,Pid=1252,Tid=2184,}, 0x0, ) == 0x0
 02725  1332   NtContinue  (79494448, 1, ...
 02726  1736   NtWaitForSingleObject  (280, 0, 0x0, ...
 02727  1516   NtSetEventBoostPriority  (280, ...
 02728  1268   NtWaitForSingleObject  (280, 0, 0x0, ...
 02729   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\3\0\0\344\4\0\0\210\10\0\0" ...  ...
 02730  1332   NtRegisterThreadTerminatePort  (24, ...
 02710   780   NtWaitForSingleObject  ... ) == 0x0
 02727  1516   NtSetEventBoostPriority  ... ) == 0x0
 02731   320   NtWaitForSingleObject  (280, 0, 0x0, ...
 02729   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81991, 0}  ... {28, 56, reply, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\3\0\0\344\4\0\0\210\10\0\0" )  ) == 0x0
 02732   780   NtSetEventBoostPriority  (280, ...
 02730  1332   NtRegisterThreadTerminatePort  ... ) == 0x0
 02733  1516   NtWaitForSingleObject  (280, 0, 0x0, ...
 02712   940   NtWaitForSingleObject  ... ) == 0x0
 02734  1332   NtWaitForSingleObject  (280, 0, 0x0, ...
 02735   940   NtSetEventBoostPriority  (280, ...
 02716   380   NtWaitForSingleObject  ... ) == 0x0
 02736   380   NtSetEventBoostPriority  (280, ...
 02719  1336   NtWaitForSingleObject  ... ) == 0x0
 02737  1336   NtSetEventBoostPriority  (280, ...
 02724   644   NtWaitForSingleObject  ... ) == 0x0
 02738   644   NtSetEventBoostPriority  (280, ...
 02726  1736   NtWaitForSingleObject  ... ) == 0x0
 02739  1736   NtSetEventBoostPriority  (280, ...
 02728  1268   NtWaitForSingleObject  ... ) == 0x0
 02740  1268   NtSetEventBoostPriority  (280, ...
 02731   320   NtWaitForSingleObject  ... ) == 0x0
 02741   320   NtSetEventBoostPriority  (280, ...
 02733  1516   NtWaitForSingleObject  ... ) == 0x0
 02742  1516   NtSetEventBoostPriority  (280, ...
 02734  1332   NtWaitForSingleObject  ... ) == 0x0
 02743  1332   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 916, ) == 0x0
 02742  1516   NtSetEventBoostPriority  ... ) == 0x0
 02741   320   NtSetEventBoostPriority  ... ) == 0x0
 02739  1736   NtSetEventBoostPriority  ... ) == 0x0
 02737  1336   NtSetEventBoostPriority  ... ) == 0x0
 02736   380   NtSetEventBoostPriority  ... ) == 0x0
 02740  1268   NtSetEventBoostPriority  ... ) == 0x0
 02738   644   NtSetEventBoostPriority  ... ) == 0x0
 02735   940   NtSetEventBoostPriority  ... ) == 0x0
 02732   780   NtSetEventBoostPriority  ... ) == 0x0
 02744   896   NtResumeThread  (908, ...
 02745  1516   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02746   320   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02747  1736   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02748  1332   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02749  1336   NtSetEventBoostPriority  (92, ...
 02750  1268   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02751   644   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02752   940   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02753   780   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02744   896   NtResumeThread  ... 1, ) == 0x0
 02754   380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02745  1516   NtWaitForSingleObject  ... ) == 0x102
 02755  2184   NtWaitForSingleObject  (92, 0, 0x0, ...
 02746   320   NtWaitForSingleObject  ... ) == 0x102
 02748  1332   NtWaitForSingleObject  ... ) == 0x102
 02134  1808   NtWaitForSingleObject  ... ) == 0x0
 02749  1336   NtSetEventBoostPriority  ... ) == 0x0
 02756   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02754   380   NtDuplicateObject  ... 920, ) == 0x0
 02757  1516   NtWaitForSingleObject  (132, 0, 0x0, ...
 02758   320   NtWaitForSingleObject  (132, 0, 0x0, ...
 02759  1808   NtSetEventBoostPriority  (92, ...
 02760  1332   NtWaitForSingleObject  (132, 0, 0x0, ...
 02761  1336   NtTestAlert  (...
 02756   896   NtAllocateVirtualMemory  ... 140312576, 1048576, ) == 0x0
 02762   380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02141   468   NtWaitForSingleObject  ... ) == 0x0
 02759  1808   NtSetEventBoostPriority  ... ) == 0x0
 02761  1336   NtTestAlert  ... ) == 0x0
 02763   896   NtAllocateVirtualMemory  (-1, 141352960, 0, 8192, 4096, 4, ...
 02764   468   NtSetEventBoostPriority  (92, ...
 02762   380   NtWaitForSingleObject  ... ) == 0x102
 02747  1736   NtWaitForSingleObject  ... ) == 0x102
 02750  1268   NtWaitForSingleObject  ... ) == 0x102
 02751   644   NtWaitForSingleObject  ... ) == 0x102
 02752   940   NtWaitForSingleObject  ... ) == 0x102
 02753   780   NtWaitForSingleObject  ... ) == 0x102
 02765  1336   NtContinue  (80543024, 1, ...
 02150   752   NtWaitForSingleObject  ... ) == 0x0
 02764   468   NtSetEventBoostPriority  ... ) == 0x0
 02763   896   NtAllocateVirtualMemory  ... 141352960, 8192, ) == 0x0
 02766   380   NtWaitForSingleObject  (132, 0, 0x0, ...
 02767  1736   NtWaitForSingleObject  (132, 0, 0x0, ...
 02768  1268   NtWaitForSingleObject  (132, 0, 0x0, ...
 02769   644   NtWaitForSingleObject  (132, 0, 0x0, ...
 02770   940   NtWaitForSingleObject  (132, 0, 0x0, ...
 02771   780   NtWaitForSingleObject  (132, 0, 0x0, ...
 02772   752   NtSetEventBoostPriority  (92, ...
 02773  1336   NtRegisterThreadTerminatePort  (24, ...
 02774  1808   NtTestAlert  (...
 02775   468   NtTestAlert  (...
 02776   896   NtProtectVirtualMemory  (-1, (0x86ce000), 4096, 260, ...
 02157  1512   NtWaitForSingleObject  ... ) == 0x0
 02772   752   NtSetEventBoostPriority  ... ) == 0x0
 02774  1808   NtTestAlert  ... ) == 0x0
 02775   468   NtTestAlert  ... ) == 0x0
 02777  1512   NtSetEventBoostPriority  (92, ...
 02776   896   NtProtectVirtualMemory  ... (0x86ce000), 4096, 4, ) == 0x0
 02773  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 02778  1808   NtContinue  (81591600, 1, ...
 02166  1380   NtWaitForSingleObject  ... ) == 0x0
 02777  1512   NtSetEventBoostPriority  ... ) == 0x0
 02779   468   NtContinue  (82640176, 1, ...
 02780   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02781  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02782  1380   NtSetEventBoostPriority  (92, ...
 02783  1808   NtRegisterThreadTerminatePort  (24, ...
 02784   752   NtTestAlert  (...
 02785   468   NtRegisterThreadTerminatePort  (24, ...
 02780   896   NtCreateThread  ... 924, {1252, 2188}, ) == 0x0
 02174  1564   NtWaitForSingleObject  ... ) == 0x0
 02782  1380   NtSetEventBoostPriority  ... ) == 0x0
 02781  1336   NtDuplicateObject  ... 928, ) == 0x0
 02783  1808   NtRegisterThreadTerminatePort  ... ) == 0x0
 02784   752   NtTestAlert  ... ) == 0x0
 02785   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 02786  1564   NtSetEventBoostPriority  (92, ...
 02787   896   NtQueryInformationThread  (924, Basic, 28, ...
 02788  1512   NtTestAlert  (...
 02789  1336   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ...
 02790  1808   NtWaitForSingleObject  (280, 0, 0x0, ...
 02791   752   NtContinue  (83688752, 1, ...
 02181   164   NtWaitForSingleObject  ... ) == 0x0
 02786  1564   NtSetEventBoostPriority  ... ) == 0x0
 02792   468   NtWaitForSingleObject  (280, 0, 0x0, ...
 02787   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff3d000,Pid=1252,Tid=2188,}, 0x0, ) == 0x0
 02788  1512   NtTestAlert  ... ) == 0x0
 02789  1336   NtAllocateVirtualMemory  ... 1409024, 4096, ) == 0x0
 02793  1380   NtTestAlert  (...
 02794   164   NtWaitForSingleObject  (280, 0, 0x0, ...
 02795   752   NtRegisterThreadTerminatePort  (24, ...
 02796  1564   NtTestAlert  (...
 02797  1512   NtContinue  (84737328, 1, ...
 02798  1336   NtSetEventBoostPriority  (280, ...
 02793  1380   NtTestAlert  ... ) == 0x0
 02795   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 02796  1564   NtTestAlert  ... ) == 0x0
 02799  1512   NtRegisterThreadTerminatePort  (24, ...
 02800   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\214\10\0\0" ...  ...
 02801  1380   NtContinue  (85785904, 1, ...
 02802   752   NtWaitForSingleObject  (280, 0, 0x0, ...
 02803  1564   NtContinue  (86834480, 1, ...
 02799  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 02800   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81992, 0}  ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\214\10\0\0" )  ) == 0x0
 02804  1380   NtRegisterThreadTerminatePort  (24, ...
 02790  1808   NtWaitForSingleObject  ... ) == 0x0
 02798  1336   NtSetEventBoostPriority  ... ) == 0x0
 02805  1564   NtRegisterThreadTerminatePort  (24, ...
 02806  1512   NtWaitForSingleObject  (280, 0, 0x0, ...
 02807   896   NtResumeThread  (924, ...
 02804  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 02808  1808   NtSetEventBoostPriority  (280, ...
 02809  1336   NtWaitForSingleObject  (280, 0, 0x0, ...
 02805  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 02807   896   NtResumeThread  ... 1, ) == 0x0
 02810  1380   NtWaitForSingleObject  (280, 0, 0x0, ...
 02792   468   NtWaitForSingleObject  ... ) == 0x0
 02811  1564   NtWaitForSingleObject  (280, 0, 0x0, ...
 02812   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02808  1808   NtSetEventBoostPriority  ... ) == 0x0
 02813  2188   NtWaitForSingleObject  (92, 0, 0x0, ...
 02814   468   NtSetEventBoostPriority  (280, ...
 02815  1808   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02794   164   NtWaitForSingleObject  ... ) == 0x0
 02816   164   NtSetEventBoostPriority  (280, ...
 02802   752   NtWaitForSingleObject  ... ) == 0x0
 02817   752   NtSetEventBoostPriority  (280, ...
 02809  1336   NtWaitForSingleObject  ... ) == 0x0
 02818  1336   NtSetEventBoostPriority  (280, ...
 02806  1512   NtWaitForSingleObject  ... ) == 0x0
 02819  1512   NtSetEventBoostPriority  (280, ...
 02810  1380   NtWaitForSingleObject  ... ) == 0x0
 02820  1380   NtSetEventBoostPriority  (280, ...
 02811  1564   NtWaitForSingleObject  ... ) == 0x0
 02821  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 932, ) == 0x0
 02822  1564   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02818  1336   NtSetEventBoostPriority  ... ) == 0x0
 02816   164   NtSetEventBoostPriority  ... ) == 0x0
 02815  1808   NtDuplicateObject  ... 936, ) == 0x0
 02820  1380   NtSetEventBoostPriority  ... ) == 0x0
 02819  1512   NtSetEventBoostPriority  ... ) == 0x0
 02817   752   NtSetEventBoostPriority  ... ) == 0x0
 02814   468   NtSetEventBoostPriority  ... ) == 0x0
 02812   896   NtAllocateVirtualMemory  ... 141361152, 1048576, ) == 0x0
 02822  1564   NtWaitForSingleObject  ... ) == 0x102
 02823  1336   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02824   164   NtSetEventBoostPriority  (92, ...
 02825  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02826  1512   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02827   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02828   468   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02829   896   NtAllocateVirtualMemory  (-1, 142401536, 0, 8192, 4096, 4, ...
 02830  1564   NtWaitForSingleObject  (132, 0, 0x0, ...
 02823  1336   NtWaitForSingleObject  ... ) == 0x102
 02190   312   NtWaitForSingleObject  ... ) == 0x0
 02824   164   NtSetEventBoostPriority  ... ) == 0x0
 02825  1380   NtDuplicateObject  ... 940, ) == 0x0
 02826  1512   NtDuplicateObject  ... 944, ) == 0x0
 02827   752   NtDuplicateObject  ... 948, ) == 0x0
 02828   468   NtDuplicateObject  ... 952, ) == 0x0
 02829   896   NtAllocateVirtualMemory  ... 142401536, 8192, ) == 0x0
 02831   312   NtSetEventBoostPriority  (92, ...
 02832  1336   NtWaitForSingleObject  (132, 0, 0x0, ...
 02833   164   NtTestAlert  (...
 02834  1808   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02835  1380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02836  1512   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02837   752   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02197  1964   NtWaitForSingleObject  ... ) == 0x0
 02831   312   NtSetEventBoostPriority  ... ) == 0x0
 02838   896   NtProtectVirtualMemory  (-1, (0x87ce000), 4096, 260, ...
 02833   164   NtTestAlert  ... ) == 0x0
 02834  1808   NtWaitForSingleObject  ... ) == 0x102
 02835  1380   NtWaitForSingleObject  ... ) == 0x102
 02836  1512   NtWaitForSingleObject  ... ) == 0x102
 02839  1964   NtSetEventBoostPriority  (92, ...
 02837   752   NtWaitForSingleObject  ... ) == 0x102
 02840   468   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02838   896   NtProtectVirtualMemory  ... (0x87ce000), 4096, 4, ) == 0x0
 02841   164   NtContinue  (87883056, 1, ...
 02842  1808   NtWaitForSingleObject  (132, 0, 0x0, ...
 02843  1380   NtWaitForSingleObject  (132, 0, 0x0, ...
 02206  1568   NtWaitForSingleObject  ... ) == 0x0
 02839  1964   NtSetEventBoostPriority  ... ) == 0x0
 02844  1512   NtWaitForSingleObject  (132, 0, 0x0, ...
 02845   752   NtWaitForSingleObject  (132, 0, 0x0, ...
 02840   468   NtWaitForSingleObject  ... ) == 0x102
 02846   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02847   164   NtRegisterThreadTerminatePort  (24, ...
 02848  1568   NtSetEventBoostPriority  (92, ...
 02849   312   NtTestAlert  (...
 02850   468   NtWaitForSingleObject  (132, 0, 0x0, ...
 02851  1964   NtTestAlert  (...
 02846   896   NtCreateThread  ... 956, {1252, 2192}, ) == 0x0
 02213  1624   NtWaitForSingleObject  ... ) == 0x0
 02848  1568   NtSetEventBoostPriority  ... ) == 0x0
 02849   312   NtTestAlert  ... ) == 0x0
 02851  1964   NtTestAlert  ... ) == 0x0
 02852  1624   NtSetEventBoostPriority  (92, ...
 02853   896   NtQueryInformationThread  (956, Basic, 28, ...
 02847   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 02854   312   NtContinue  (88931632, 1, ...
 02222  1716   NtWaitForSingleObject  ... ) == 0x0
 02852  1624   NtSetEventBoostPriority  ... ) == 0x0
 02855  1964   NtContinue  (89980208, 1, ...
 02853   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff3c000,Pid=1252,Tid=2192,}, 0x0, ) == 0x0
 02856   164   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02857  1716   NtSetEventBoostPriority  (92, ...
 02858   312   NtRegisterThreadTerminatePort  (24, ...
 02859  1568   NtTestAlert  (...
 02860  1964   NtRegisterThreadTerminatePort  (24, ...
 02861   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\3\0\0\344\4\0\0\220\10\0\0" ...  ...
 02229  1440   NtWaitForSingleObject  ... ) == 0x0
 02857  1716   NtSetEventBoostPriority  ... ) == 0x0
 02856   164   NtDuplicateObject  ... 960, ) == 0x0
 02858   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 02859  1568   NtTestAlert  ... ) == 0x0
 02860  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 02862  1440   NtAllocateVirtualMemory  (-1, 8876032, 0, 4096, 4096, 4, ...
 02861   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81993, 0}  ... {28, 56, reply, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\3\0\0\344\4\0\0\220\10\0\0" )  ) == 0x0
 02863  1624   NtTestAlert  (...
 02864   164   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02865   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02866  1568   NtContinue  (91028784, 1, ...
 02862  1440   NtAllocateVirtualMemory  ... 8876032, 4096, ) == 0x0
 02867  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02868  1716   NtTestAlert  (...
 02863  1624   NtTestAlert  ... ) == 0x0
 02864   164   NtWaitForSingleObject  ... ) == 0x102
 02869   896   NtResumeThread  (956, ...
 02870  1568   NtRegisterThreadTerminatePort  (24, ...
 02865   312   NtDuplicateObject  ... 964, ) == 0x0
 02871  1440   NtSetEventBoostPriority  (92, ...
 02868  1716   NtTestAlert  ... ) == 0x0
 02872  1624   NtContinue  (92077360, 1, ...
 02867  1964   NtDuplicateObject  ... 968, ) == 0x0
 02869   896   NtResumeThread  ... 1, ) == 0x0
 02870  1568   NtRegisterThreadTerminatePort  ... ) == 0x0
 02873   312   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02238  1664   NtWaitForSingleObject  ... ) == 0x0
 02871  1440   NtSetEventBoostPriority  ... ) == 0x0
 02874  1716   NtContinue  (93125936, 1, ...
 02875  1624   NtRegisterThreadTerminatePort  (24, ...
 02876  1964   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 02877   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02878  1568   NtWaitForSingleObject  (280, 0, 0x0, ...
 02879  1664   NtWaitForSingleObject  (280, 0, 0x0, ...
 02873   312   NtWaitForSingleObject  ... ) == 0x102
 02880  1440   NtTestAlert  (...
 02881  1716   NtRegisterThreadTerminatePort  (24, ...
 02875  1624   NtRegisterThreadTerminatePort  ... ) == 0x0
 02876  1964   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 02877   896   NtAllocateVirtualMemory  ... 142409728, 1048576, ) == 0x0
 02882   164   NtWaitForSingleObject  (132, 0, 0x0, ...
 02883  2192   NtWaitForSingleObject  (92, 0, 0x0, ...
 02884   312   NtWaitForSingleObject  (280, 0, 0x0, ...
 02880  1440   NtTestAlert  ... ) == 0x0
 02881  1716   NtRegisterThreadTerminatePort  ... ) == 0x0
 02885  1624   NtWaitForSingleObject  (280, 0, 0x0, ...
 02886  1964   NtSetEventBoostPriority  (280, ...
 02887   896   NtAllocateVirtualMemory  (-1, 143450112, 0, 8192, 4096, 4, ...
 02888  1440   NtContinue  (94174512, 1, ...
 02889  1716   NtWaitForSingleObject  (280, 0, 0x0, ...
 02879  1664   NtWaitForSingleObject  ... ) == 0x0
 02886  1964   NtSetEventBoostPriority  ... ) == 0x0
 02887   896   NtAllocateVirtualMemory  ... 143450112, 8192, ) == 0x0
 02890  1440   NtRegisterThreadTerminatePort  (24, ...
 02891  1664   NtSetEventBoostPriority  (280, ...
 02892  1964   NtWaitForSingleObject  (280, 0, 0x0, ...
 02893   896   NtProtectVirtualMemory  (-1, (0x88ce000), 4096, 260, ...
 02884   312   NtWaitForSingleObject  ... ) == 0x0
 02891  1664   NtSetEventBoostPriority  ... ) == 0x0
 02890  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 02894   312   NtSetEventBoostPriority  (280, ...
 02893   896   NtProtectVirtualMemory  ... (0x88ce000), 4096, 4, ) == 0x0
 02878  1568   NtWaitForSingleObject  ... ) == 0x0
 02894   312   NtSetEventBoostPriority  ... ) == 0x0
 02895  1440   NtWaitForSingleObject  (280, 0, 0x0, ...
 02896  1568   NtSetEventBoostPriority  (280, ...
 02897   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02898  1664   NtSetEventBoostPriority  (92, ...
 02885  1624   NtWaitForSingleObject  ... ) == 0x0
 02897   896   NtCreateThread  ... 972, {1252, 2196}, ) == 0x0
 02245  1972   NtWaitForSingleObject  ... ) == 0x0
 02898  1664   NtSetEventBoostPriority  ... ) == 0x0
 02899  1624   NtSetEventBoostPriority  (280, ...
 02900  1972   NtWaitForSingleObject  (280, 0, 0x0, ...
 02901   896   NtQueryInformationThread  (972, Basic, 28, ...
 02902  1664   NtTestAlert  (...
 02889  1716   NtWaitForSingleObject  ... ) == 0x0
 02901   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff3b000,Pid=1252,Tid=2196,}, 0x0, ) == 0x0
 02902  1664   NtTestAlert  ... ) == 0x0
 02903  1716   NtSetEventBoostPriority  (280, ...
 02899  1624   NtSetEventBoostPriority  ... ) == 0x0
 02896  1568   NtSetEventBoostPriority  ... ) == 0x0
 02904   312   NtWaitForSingleObject  (132, 0, 0x0, ...
 02905  1664   NtContinue  (95223088, 1, ...
 02892  1964   NtWaitForSingleObject  ... ) == 0x0
 02906  1624   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02907  1568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02908  1664   NtRegisterThreadTerminatePort  (24, ...
 02909  1964   NtSetEventBoostPriority  (280, ...
 02906  1624   NtDuplicateObject  ... 976, ) == 0x0
 02907  1568   NtDuplicateObject  ... 980, ) == 0x0
 02903  1716   NtSetEventBoostPriority  ... ) == 0x0
 02910   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81993, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\224\10\0\0" ...  ...
 02895  1440   NtWaitForSingleObject  ... ) == 0x0
 02909  1964   NtSetEventBoostPriority  ... ) == 0x0
 02908  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 02911  1624   NtWaitForSingleObject  (280, 0, 0x0, ...
 02912  1716   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02910   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81994, 0}  ... {28, 56, reply, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\224\10\0\0" )  ) == 0x0
 02913  1440   NtSetEventBoostPriority  (280, ...
 02914  1964   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02915  1664   NtWaitForSingleObject  (280, 0, 0x0, ...
 02912  1716   NtDuplicateObject  ... 984, ) == 0x0
 02916   896   NtResumeThread  (972, ...
 02900  1972   NtWaitForSingleObject  ... ) == 0x0
 02913  1440   NtSetEventBoostPriority  ... ) == 0x0
 02917  1568   NtWaitForSingleObject  (280, 0, 0x0, ...
 02914  1964   NtWaitForSingleObject  ... ) == 0x102
 02918  1972   NtSetEventBoostPriority  (280, ...
 02916   896   NtResumeThread  ... 1, ) == 0x0
 02919  1716   NtWaitForSingleObject  (280, 0, 0x0, ...
 02911  1624   NtWaitForSingleObject  ... ) == 0x0
 02918  1972   NtSetEventBoostPriority  ... ) == 0x0
 02920  1964   NtWaitForSingleObject  (280, 0, 0x0, ...
 02921   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02922  1624   NtSetEventBoostPriority  (280, ...
 02923  1440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02924  2196   NtWaitForSingleObject  (92, 0, 0x0, ...
 02925  1972   NtSetEventBoostPriority  (92, ...
 02915  1664   NtWaitForSingleObject  ... ) == 0x0
 02922  1624   NtSetEventBoostPriority  ... ) == 0x0
 02923  1440   NtDuplicateObject  ... 988, ) == 0x0
 02926  1664   NtSetEventBoostPriority  (280, ...
 02254  1036   NtWaitForSingleObject  ... ) == 0x0
 02925  1972   NtSetEventBoostPriority  ... ) == 0x0
 02927  1624   NtWaitForSingleObject  (280, 0, 0x0, ...
 02917  1568   NtWaitForSingleObject  ... ) == 0x0
 02928  1036   NtWaitForSingleObject  (280, 0, 0x0, ...
 02926  1664   NtSetEventBoostPriority  ... ) == 0x0
 02929  1440   NtWaitForSingleObject  (280, 0, 0x0, ...
 02930  1972   NtTestAlert  (...
 02921   896   NtAllocateVirtualMemory  ... 143458304, 1048576, ) == 0x0
 02931  1568   NtSetEventBoostPriority  (280, ...
 02930  1972   NtTestAlert  ... ) == 0x0
 02919  1716   NtWaitForSingleObject  ... ) == 0x0
 02931  1568   NtSetEventBoostPriority  ... ) == 0x0
 02932   896   NtAllocateVirtualMemory  (-1, 144498688, 0, 8192, 4096, 4, ...
 02933  1716   NtSetEventBoostPriority  (280, ...
 02934  1972   NtContinue  (96271664, 1, ...
 02935  1568   NtWaitForSingleObject  (280, 0, 0x0, ...
 02920  1964   NtWaitForSingleObject  ... ) == 0x0
 02933  1716   NtSetEventBoostPriority  ... ) == 0x0
 02932   896   NtAllocateVirtualMemory  ... 144498688, 8192, ) == 0x0
 02936  1972   NtRegisterThreadTerminatePort  (24, ...
 02937  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02938  1964   NtSetEventBoostPriority  (280, ...
 02939  1716   NtWaitForSingleObject  (280, 0, 0x0, ...
 02940   896   NtProtectVirtualMemory  (-1, (0x89ce000), 4096, 260, ...
 02928  1036   NtWaitForSingleObject  ... ) == 0x0
 02938  1964   NtSetEventBoostPriority  ... ) == 0x0
 02937  1664   NtDuplicateObject  ... 992, ) == 0x0
 02936  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 02941  1036   NtSetEventBoostPriority  (280, ...
 02940   896   NtProtectVirtualMemory  ... (0x89ce000), 4096, 4, ) == 0x0
 02942  1664   NtWaitForSingleObject  (280, 0, 0x0, ...
 02927  1624   NtWaitForSingleObject  ... ) == 0x0
 02941  1036   NtSetEventBoostPriority  ... ) == 0x0
 02943  1972   NtWaitForSingleObject  (280, 0, 0x0, ...
 02944   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02945  1624   NtSetEventBoostPriority  (280, ...
 02946  1964   NtWaitForSingleObject  (132, 0, 0x0, ...
 02947  1036   NtSetEventBoostPriority  (92, ...
 02929  1440   NtWaitForSingleObject  ... ) == 0x0
 02261  1248   NtWaitForSingleObject  ... ) == 0x0
 02947  1036   NtSetEventBoostPriority  ... ) == 0x0
 02948  1248   NtWaitForSingleObject  (280, 0, 0x0, ...
 02949  1440   NtSetEventBoostPriority  (280, ...
 02950  1036   NtTestAlert  (...
 02935  1568   NtWaitForSingleObject  ... ) == 0x0
 02949  1440   NtSetEventBoostPriority  ... ) == 0x0
 02951  1568   NtSetEventBoostPriority  (280, ...
 02950  1036   NtTestAlert  ... ) == 0x0
 02945  1624   NtSetEventBoostPriority  ... ) == 0x0
 02944   896   NtCreateThread  ... 996, {1252, 2200}, ) == 0x0
 02939  1716   NtWaitForSingleObject  ... ) == 0x0
 02952  1036   NtContinue  (97320240, 1, ...
 02953  1624   NtWaitForSingleObject  (280, 0, 0x0, ...
 02954   896   NtQueryInformationThread  (996, Basic, 28, ...
 02955  1716   NtSetEventBoostPriority  (280, ...
 02956  1036   NtRegisterThreadTerminatePort  (24, ...
 02954   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff3a000,Pid=1252,Tid=2200,}, 0x0, ) == 0x0
 02942  1664   NtWaitForSingleObject  ... ) == 0x0
 02955  1716   NtSetEventBoostPriority  ... ) == 0x0
 02951  1568   NtSetEventBoostPriority  ... ) == 0x0
 02957  1440   NtWaitForSingleObject  (280, 0, 0x0, ...
 02958   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81994, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\230\10\0\0" ...  ...
 02959  1664   NtSetEventBoostPriority  (280, ...
 02960  1716   NtWaitForSingleObject  (280, 0, 0x0, ...
 02961  1568   NtWaitForSingleObject  (280, 0, 0x0, ...
 02958   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81995, 0}  ... {28, 56, reply, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\230\10\0\0" )  ) == 0x0
 02943  1972   NtWaitForSingleObject  ... ) == 0x0
 02959  1664   NtSetEventBoostPriority  ... ) == 0x0
 02956  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 02962  1972   NtSetEventBoostPriority  (280, ...
 02963   896   NtResumeThread  (996, ...
 02948  1248   NtWaitForSingleObject  ... ) == 0x0
 02962  1972   NtSetEventBoostPriority  ... ) == 0x0
 02964  1036   NtWaitForSingleObject  (280, 0, 0x0, ...
 02965  1248   NtSetEventBoostPriority  (280, ...
 02963   896   NtResumeThread  ... 1, ) == 0x0
 02966  1664   NtWaitForSingleObject  (280, 0, 0x0, ...
 02953  1624   NtWaitForSingleObject  ... ) == 0x0
 02965  1248   NtSetEventBoostPriority  ... ) == 0x0
 02967   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02968  1624   NtSetEventBoostPriority  (280, ...
 02969  1972   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02970  2200   NtWaitForSingleObject  (92, 0, 0x0, ...
 02957  1440   NtWaitForSingleObject  ... ) == 0x0
 02968  1624   NtSetEventBoostPriority  ... ) == 0x0
 02967   896   NtAllocateVirtualMemory  ... 144506880, 1048576, ) == 0x0
 02969  1972   NtDuplicateObject  ... 1000, ) == 0x0
 02971  1440   NtSetEventBoostPriority  (280, ...
 02972  1248   NtSetEventBoostPriority  (92, ...
 02973   896   NtAllocateVirtualMemory  (-1, 145547264, 0, 8192, 4096, 4, ...
 02960  1716   NtWaitForSingleObject  ... ) == 0x0
 02971  1440   NtSetEventBoostPriority  ... ) == 0x0
 02974  1972   NtWaitForSingleObject  (280, 0, 0x0, ...
 02270  1656   NtWaitForSingleObject  ... ) == 0x0
 02972  1248   NtSetEventBoostPriority  ... ) == 0x0
 02975  1716   NtSetEventBoostPriority  (280, ...
 02973   896   NtAllocateVirtualMemory  ... 145547264, 8192, ) == 0x0
 02976  1440   NtWaitForSingleObject  (280, 0, 0x0, ...
 02977  1656   NtWaitForSingleObject  (280, 0, 0x0, ...
 02961  1568   NtWaitForSingleObject  ... ) == 0x0
 02975  1716   NtSetEventBoostPriority  ... ) == 0x0
 02978  1248   NtTestAlert  (...
 02979  1624   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02980   896   NtProtectVirtualMemory  (-1, (0x8ace000), 4096, 260, ...
 02981  1568   NtSetEventBoostPriority  (280, ...
 02978  1248   NtTestAlert  ... ) == 0x0
 02979  1624   NtCreateEvent  ... 1004, ) == 0x0
 02964  1036   NtWaitForSingleObject  ... ) == 0x0
 02981  1568   NtSetEventBoostPriority  ... ) == 0x0
 02980   896   NtProtectVirtualMemory  ... (0x8ace000), 4096, 4, ) == 0x0
 02982  1248   NtContinue  (98368816, 1, ...
 02983  1036   NtSetEventBoostPriority  (280, ...
 02984  1624   NtWaitForSingleObject  (1004, 0, 0x0, ...
 02985  1716   NtWaitForSingleObject  (1004, 0, 0x0, ...
 02986   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02966  1664   NtWaitForSingleObject  ... ) == 0x0
 02983  1036   NtSetEventBoostPriority  ... ) == 0x0
 02987  1248   NtRegisterThreadTerminatePort  (24, ...
 02988  1664   NtSetEventBoostPriority  (280, ...
 02986   896   NtCreateThread  ... 1008, {1252, 2204}, ) == 0x0
 02989  1568   NtWaitForSingleObject  (1004, 0, 0x0, ...
 02990  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02974  1972   NtWaitForSingleObject  ... ) == 0x0
 02988  1664   NtSetEventBoostPriority  ... ) == 0x0
 02991   896   NtQueryInformationThread  (1008, Basic, 28, ...
 02992  1972   NtSetEventBoostPriority  (280, ...
 02990  1036   NtDuplicateObject  ... 1012, ) == 0x0
 02993  1664   NtWaitForSingleObject  (1004, 0, 0x0, ...
 02977  1656   NtWaitForSingleObject  ... ) == 0x0
 02992  1972   NtSetEventBoostPriority  ... ) == 0x0
 02991   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff39000,Pid=1252,Tid=2204,}, 0x0, ) == 0x0
 02994  1036   NtWaitForSingleObject  (280, 0, 0x0, ...
 02987  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 02995  1656   NtSetEventBoostPriority  (280, ...
 02996  1972   NtWaitForSingleObject  (1004, 0, 0x0, ...
 02976  1440   NtWaitForSingleObject  ... ) == 0x0
 02995  1656   NtSetEventBoostPriority  ... ) == 0x0
 02997  1248   NtWaitForSingleObject  (280, 0, 0x0, ...
 02998  1440   NtSetEventBoostPriority  (280, ...
 02999   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81995, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\3\0\0\344\4\0\0\234\10\0\0" ...  ...
 02994  1036   NtWaitForSingleObject  ... ) == 0x0
 02999   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81996, 0}  ... {28, 56, reply, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\3\0\0\344\4\0\0\234\10\0\0" )  ) == 0x0
 03000  1036   NtSetEventBoostPriority  (280, ...
 03001   896   NtResumeThread  (1008, ...
 02997  1248   NtWaitForSingleObject  ... ) == 0x0
 03000  1036   NtSetEventBoostPriority  ... ) == 0x0
 03002  1248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03001   896   NtResumeThread  ... 1, ) == 0x0
 02998  1440   NtSetEventBoostPriority  ... ) == 0x0
 03003  1656   NtSetEventBoostPriority  (92, ...
 03002  1248   NtDuplicateObject  ... 1016, ) == 0x0
 03004   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03005  1440   NtSetEventBoostPriority  (1004, ...
 02277   760   NtWaitForSingleObject  ... ) == 0x0
 03003  1656   NtSetEventBoostPriority  ... ) == 0x0
 03006  1036   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03007  2204   NtWaitForSingleObject  (92, 0, 0x0, ...
 03008  1248   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03009   760   NtSetEventBoostPriority  (92, ...
 02984  1624   NtWaitForSingleObject  ... ) == 0x0
 03005  1440   NtSetEventBoostPriority  ... ) == 0x0
 03010  1656   NtTestAlert  (...
 02286   484   NtWaitForSingleObject  ... ) == 0x0
 03011  1624   NtSetEventBoostPriority  (1004, ...
 03009   760   NtSetEventBoostPriority  ... ) == 0x0
 03004   896   NtAllocateVirtualMemory  ... 145555456, 1048576, ) == 0x0
 03012   484   NtSetEventBoostPriority  (92, ...
 02985  1716   NtWaitForSingleObject  ... ) == 0x0
 03011  1624   NtSetEventBoostPriority  ... ) == 0x0
 03010  1656   NtTestAlert  ... ) == 0x0
 03013  1440   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02293  1580   NtWaitForSingleObject  ... ) == 0x0
 03014  1716   NtSetEventBoostPriority  (1004, ...
 03012   484   NtSetEventBoostPriority  ... ) == 0x0
 03015   896   NtAllocateVirtualMemory  (-1, 146595840, 0, 8192, 4096, 4, ...
 03016   760   NtTestAlert  (...
 03017  1656   NtContinue  (99417392, 1, ...
 03018  1580   NtSetEventBoostPriority  (92, ...
 02989  1568   NtWaitForSingleObject  ... ) == 0x0
 03014  1716   NtSetEventBoostPriority  ... ) == 0x0
 03013  1440   NtWaitForSingleObject  ... ) == 0x102
 03019  1624   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03015   896   NtAllocateVirtualMemory  ... 146595840, 8192, ) == 0x0
 03016   760   NtTestAlert  ... ) == 0x0
 02302  1756   NtWaitForSingleObject  ... ) == 0x0
 03020  1568   NtSetEventBoostPriority  (1004, ...
 03018  1580   NtSetEventBoostPriority  ... ) == 0x0
 03021  1656   NtRegisterThreadTerminatePort  (24, ...
 03022  1716   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03023  1440   NtWaitForSingleObject  (132, 0, 0x0, ...
 03019  1624   NtWaitForSingleObject  ... ) == 0x102
 03024   896   NtProtectVirtualMemory  (-1, (0x8bce000), 4096, 260, ...
 03025  1756   NtSetEventBoostPriority  (92, ...
 02993  1664   NtWaitForSingleObject  ... ) == 0x0
 03020  1568   NtSetEventBoostPriority  ... ) == 0x0
 03026   760   NtContinue  (100465968, 1, ...
 03027   484   NtTestAlert  (...
 03028  1580   NtTestAlert  (...
 03021  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 03029  1624   NtWaitForSingleObject  (132, 0, 0x0, ...
 02309  1304   NtWaitForSingleObject  ... ) == 0x0
 03030  1664   NtSetEventBoostPriority  (1004, ...
 03025  1756   NtSetEventBoostPriority  ... ) == 0x0
 03024   896   NtProtectVirtualMemory  ... (0x8bce000), 4096, 4, ) == 0x0
 03031  1568   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03032   760   NtRegisterThreadTerminatePort  (24, ...
 03027   484   NtTestAlert  ... ) == 0x0
 03028  1580   NtTestAlert  ... ) == 0x0
 03033  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03034  1304   NtSetEventBoostPriority  (92, ...
 02996  1972   NtWaitForSingleObject  ... ) == 0x0
 03030  1664   NtSetEventBoostPriority  ... ) == 0x0
 03022  1716   NtWaitForSingleObject  ... ) == 0x102
 03035   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03036  1756   NtTestAlert  (...
 03032   760   NtRegisterThreadTerminatePort  ... ) == 0x0
 03037   484   NtContinue  (101514544, 1, ...
 03038  1580   NtContinue  (102563120, 1, ...
 02318  2052   NtWaitForSingleObject  ... ) == 0x0
 03034  1304   NtSetEventBoostPriority  ... ) == 0x0
 03033  1656   NtDuplicateObject  ... 1020, ) == 0x0
 03039  1972   NtSetEventBoostPriority  (1004, ...
 03040  1664   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03041  1716   NtWaitForSingleObject  (132, 0, 0x0, ...
 03031  1568   NtWaitForSingleObject  ... ) == 0x102
 03036  1756   NtTestAlert  ... ) == 0x0
 03042   760   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03043   484   NtRegisterThreadTerminatePort  (24, ...
 03044  2052   NtSetEventBoostPriority  (92, ...
 03045  1580   NtRegisterThreadTerminatePort  (24, ...
 03035   896   NtCreateThread  ... 1024, {1252, 2208}, ) == 0x0
 03046  1656   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03006  1036   NtWaitForSingleObject  ... ) == 0x0
 03039  1972   NtSetEventBoostPriority  ... ) == 0x0
 03047  1568   NtWaitForSingleObject  (132, 0, 0x0, ...
 03048  1756   NtContinue  (103611696, 1, ...
 03049  1304   NtTestAlert  (...
 03040  1664   NtWaitForSingleObject  ... ) == 0x102
 02325  2056   NtWaitForSingleObject  ... ) == 0x0
 03044  2052   NtSetEventBoostPriority  ... ) == 0x0
 03043   484   NtRegisterThreadTerminatePort  ... ) == 0x0
 03045  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 03050   896   NtQueryInformationThread  (1024, Basic, 28, ...
 03051  1036   NtSetEventBoostPriority  (1004, ...
 03052  1972   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03053  1756   NtRegisterThreadTerminatePort  (24, ...
 03049  1304   NtTestAlert  ... ) == 0x0
 03054  2056   NtSetEventBoostPriority  (92, ...
 03055  1664   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 03042   760   NtDuplicateObject  ... 1028, ) == 0x0
 03056   484   NtWaitForSingleObject  (280, 0, 0x0, ...
 03057  1580   NtWaitForSingleObject  (280, 0, 0x0, ...
 03008  1248   NtWaitForSingleObject  ... ) == 0x0
 03051  1036   NtSetEventBoostPriority  ... ) == 0x0
 03050   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff38000,Pid=1252,Tid=2208,}, 0x0, ) == 0x0
 03058  2052   NtTestAlert  (...
 03053  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 02334  2060   NtWaitForSingleObject  ... ) == 0x0
 03054  2056   NtSetEventBoostPriority  ... ) == 0x0
 03059  1304   NtContinue  (104660272, 1, ...
 03055  1664   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 03060   760   NtWaitForSingleObject  (280, 0, 0x0, ...
 03052  1972   NtWaitForSingleObject  ... ) == 0x102
 03061  1248   NtWaitForSingleObject  (280, 0, 0x0, ...
 03062  1036   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03063   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\4\0\0\344\4\0\0\240\10\0\0" ...  ...
 03058  2052   NtTestAlert  ... ) == 0x0
 03064  2060   NtWaitForSingleObject  (280, 0, 0x0, ...
 03065  1756   NtWaitForSingleObject  (280, 0, 0x0, ...
 03066  1304   NtRegisterThreadTerminatePort  (24, ...
 03067  1664   NtSetEventBoostPriority  (280, ...
 03068  1972   NtWaitForSingleObject  (280, 0, 0x0, ...
 03069  2056   NtTestAlert  (...
 03063   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81997, 0}  ... {28, 56, reply, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\4\0\0\344\4\0\0\240\10\0\0" )  ) == 0x0
 03070  2052   NtContinue  (105708848, 1, ...
 03062  1036   NtWaitForSingleObject  ... ) == 0x102
 03066  1304   NtRegisterThreadTerminatePort  ... ) == 0x0
 03056   484   NtWaitForSingleObject  ... ) == 0x0
 03067  1664   NtSetEventBoostPriority  ... ) == 0x0
 03069  2056   NtTestAlert  ... ) == 0x0
 03071  2052   NtRegisterThreadTerminatePort  (24, ...
 03072  1036   NtWaitForSingleObject  (280, 0, 0x0, ...
 03073   484   NtSetEventBoostPriority  (280, ...
 03074  1304   NtWaitForSingleObject  (280, 0, 0x0, ...
 03075  1664   NtWaitForSingleObject  (132, 0, 0x0, ...
 03076  2056   NtContinue  (106757424, 1, ...
 03071  2052   NtRegisterThreadTerminatePort  ... ) == 0x0
 03057  1580   NtWaitForSingleObject  ... ) == 0x0
 03073   484   NtSetEventBoostPriority  ... ) == 0x0
 03077   896   NtResumeThread  (1024, ...
 03078  2056   NtRegisterThreadTerminatePort  (24, ...
 03079  2052   NtWaitForSingleObject  (280, 0, 0x0, ...
 03080  1580   NtSetEventBoostPriority  (280, ...
 03081   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03077   896   NtResumeThread  ... 1, ) == 0x0
 03078  2056   NtRegisterThreadTerminatePort  ... ) == 0x0
 03082  2208   NtWaitForSingleObject  (92, 0, 0x0, ...
 03060   760   NtWaitForSingleObject  ... ) == 0x0
 03081   484   NtDuplicateObject  ... 1032, ) == 0x0
 03083   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03084  2056   NtWaitForSingleObject  (280, 0, 0x0, ...
 03085   760   NtSetEventBoostPriority  (280, ...
 03080  1580   NtSetEventBoostPriority  ... ) == 0x0
 03083   896   NtAllocateVirtualMemory  ... 146604032, 1048576, ) == 0x0
 03086   484   NtWaitForSingleObject  (280, 0, 0x0, ...
 03061  1248   NtWaitForSingleObject  ... ) == 0x0
 03085   760   NtSetEventBoostPriority  ... ) == 0x0
 03087  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03088   896   NtAllocateVirtualMemory  (-1, 147644416, 0, 8192, 4096, 4, ...
 03089  1248   NtSetEventBoostPriority  (280, ...
 03087  1580   NtDuplicateObject  ... 1036, ) == 0x0
 03064  2060   NtWaitForSingleObject  ... ) == 0x0
 03089  1248   NtSetEventBoostPriority  ... ) == 0x0
 03088   896   NtAllocateVirtualMemory  ... 147644416, 8192, ) == 0x0
 03090   760   NtWaitForSingleObject  (280, 0, 0x0, ...
 03091  2060   NtSetEventBoostPriority  (280, ...
 03092  1580   NtWaitForSingleObject  (280, 0, 0x0, ...
 03093  1248   NtSetEventBoostPriority  (1004, ...
 03068  1972   NtWaitForSingleObject  ... ) == 0x0
 03091  2060   NtSetEventBoostPriority  ... ) == 0x0
 03094  1972   NtSetEventBoostPriority  (280, ...
 03046  1656   NtWaitForSingleObject  ... ) == 0x0
 03093  1248   NtSetEventBoostPriority  ... ) == 0x0
 03095   896   NtProtectVirtualMemory  (-1, (0x8cce000), 4096, 260, ...
 03065  1756   NtWaitForSingleObject  ... ) == 0x0
 03096  1656   NtWaitForSingleObject  (280, 0, 0x0, ...
 03094  1972   NtSetEventBoostPriority  ... ) == 0x0
 03097  1248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03098  1756   NtSetEventBoostPriority  (280, ...
 03095   896   NtProtectVirtualMemory  ... (0x8cce000), 4096, 4, ) == 0x0
 03099  2060   NtSetEventBoostPriority  (92, ...
 03072  1036   NtWaitForSingleObject  ... ) == 0x0
 03100   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02341  2064   NtWaitForSingleObject  ... ) == 0x0
 03099  2060   NtSetEventBoostPriority  ... ) == 0x0
 03101  1036   NtSetEventBoostPriority  (280, ...
 03102  2064   NtWaitForSingleObject  (280, 0, 0x0, ...
 03100   896   NtCreateThread  ... 1040, {1252, 2212}, ) == 0x0
 03103  2060   NtTestAlert  (...
 03074  1304   NtWaitForSingleObject  ... ) == 0x0
 03101  1036   NtSetEventBoostPriority  ... ) == 0x0
 03104   896   NtQueryInformationThread  (1040, Basic, 28, ...
 03105  1304   NtSetEventBoostPriority  (280, ...
 03103  2060   NtTestAlert  ... ) == 0x0
 03098  1756   NtSetEventBoostPriority  ... ) == 0x0
 03106  1972   NtWaitForSingleObject  (132, 0, 0x0, ...
 03097  1248   NtWaitForSingleObject  ... ) == 0x102
 03079  2052   NtWaitForSingleObject  ... ) == 0x0
 03104   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff37000,Pid=1252,Tid=2212,}, 0x0, ) == 0x0
 03107  2060   NtContinue  (107806000, 1, ...
 03108  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03109  1248   NtWaitForSingleObject  (280, 0, 0x0, ...
 03110  2052   NtSetEventBoostPriority  (280, ...
 03105  1304   NtSetEventBoostPriority  ... ) == 0x0
 03111  1036   NtWaitForSingleObject  (132, 0, 0x0, ...
 03112  2060   NtRegisterThreadTerminatePort  (24, ...
 03108  1756   NtDuplicateObject  ... 1044, ) == 0x0
 03086   484   NtWaitForSingleObject  ... ) == 0x0
 03113  1304   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03110  2052   NtSetEventBoostPriority  ... ) == 0x0
 03114   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81997, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\4\0\0\344\4\0\0\244\10\0\0" ...  ...
 03112  2060   NtRegisterThreadTerminatePort  ... ) == 0x0
 03115   484   NtSetEventBoostPriority  (280, ...
 03113  1304   NtDuplicateObject  ... 1048, ) == 0x0
 03116  2052   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03114   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81998, 0}  ... {28, 56, reply, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\4\0\0\344\4\0\0\244\10\0\0" )  ) == 0x0
 03117  2060   NtWaitForSingleObject  (280, 0, 0x0, ...
 03084  2056   NtWaitForSingleObject  ... ) == 0x0
 03115   484   NtSetEventBoostPriority  ... ) == 0x0
 03118  1756   NtWaitForSingleObject  (280, 0, 0x0, ...
 03116  2052   NtDuplicateObject  ... 1052, ) == 0x0
 03119   896   NtResumeThread  (1040, ...
 03120  2056   NtSetEventBoostPriority  (280, ...
 03121   484   NtWaitForSingleObject  (280, 0, 0x0, ...
 03122  1304   NtWaitForSingleObject  (280, 0, 0x0, ...
 03090   760   NtWaitForSingleObject  ... ) == 0x0
 03119   896   NtResumeThread  ... 1, ) == 0x0
 03120  2056   NtSetEventBoostPriority  ... ) == 0x0
 03123  2052   NtWaitForSingleObject  (280, 0, 0x0, ...
 03124   760   NtSetEventBoostPriority  (280, ...
 03125   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03126  2056   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03092  1580   NtWaitForSingleObject  ... ) == 0x0
 03124   760   NtSetEventBoostPriority  ... ) == 0x0
 03127  2212   NtWaitForSingleObject  (92, 0, 0x0, ...
 03128  1580   NtSetEventBoostPriority  (280, ...
 03126  2056   NtDuplicateObject  ... 1056, ) == 0x0
 03129   760   NtWaitForSingleObject  (280, 0, 0x0, ...
 03096  1656   NtWaitForSingleObject  ... ) == 0x0
 03128  1580   NtSetEventBoostPriority  ... ) == 0x0
 03125   896   NtAllocateVirtualMemory  ... 147652608, 1048576, ) == 0x0
 03130  2056   NtWaitForSingleObject  (280, 0, 0x0, ...
 03131  1656   NtSetEventBoostPriority  (280, ...
 03132  1580   NtWaitForSingleObject  (280, 0, 0x0, ...
 03133   896   NtAllocateVirtualMemory  (-1, 148692992, 0, 8192, 4096, 4, ...
 03102  2064   NtWaitForSingleObject  ... ) == 0x0
 03131  1656   NtSetEventBoostPriority  ... ) == 0x0
 03134  2064   NtSetEventBoostPriority  (280, ...
 03133   896   NtAllocateVirtualMemory  ... 148692992, 8192, ) == 0x0
 03109  1248   NtWaitForSingleObject  ... ) == 0x0
 03134  2064   NtSetEventBoostPriority  ... ) == 0x0
 03135  1248   NtSetEventBoostPriority  (280, ...
 03136   896   NtProtectVirtualMemory  (-1, (0x8dce000), 4096, 260, ...
 03137  1656   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03117  2060   NtWaitForSingleObject  ... ) == 0x0
 03135  1248   NtSetEventBoostPriority  ... ) == 0x0
 03136   896   NtProtectVirtualMemory  ... (0x8dce000), 4096, 4, ) == 0x0
 03138  2060   NtSetEventBoostPriority  (280, ...
 03137  1656   NtWaitForSingleObject  ... ) == 0x102
 03139  2064   NtSetEventBoostPriority  (92, ...
 03118  1756   NtWaitForSingleObject  ... ) == 0x0
 03138  2060   NtSetEventBoostPriority  ... ) == 0x0
 03140   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03141  1656   NtWaitForSingleObject  (280, 0, 0x0, ...
 03142  1756   NtSetEventBoostPriority  (280, ...
 02350  2068   NtWaitForSingleObject  ... ) == 0x0
 03139  2064   NtSetEventBoostPriority  ... ) == 0x0
 03143  1248   NtWaitForSingleObject  (132, 0, 0x0, ...
 03144  2060   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03122  1304   NtWaitForSingleObject  ... ) == 0x0
 03145  2068   NtWaitForSingleObject  (280, 0, 0x0, ...
 03142  1756   NtSetEventBoostPriority  ... ) == 0x0
 03146  2064   NtTestAlert  (...
 03147  1304   NtSetEventBoostPriority  (280, ...
 03144  2060   NtDuplicateObject  ... 1060, ) == 0x0
 03148  1756   NtWaitForSingleObject  (280, 0, 0x0, ...
 03123  2052   NtWaitForSingleObject  ... ) == 0x0
 03147  1304   NtSetEventBoostPriority  ... ) == 0x0
 03146  2064   NtTestAlert  ... ) == 0x0
 03149  2060   NtWaitForSingleObject  (280, 0, 0x0, ...
 03140   896   NtCreateThread  ... 1064, {1252, 2216}, ) == 0x0
 03150  2052   NtSetEventBoostPriority  (280, ...
 03151  1304   NtWaitForSingleObject  (280, 0, 0x0, ...
 03152  2064   NtContinue  (108854576, 1, ...
 03121   484   NtWaitForSingleObject  ... ) == 0x0
 03150  2052   NtSetEventBoostPriority  ... ) == 0x0
 03153   896   NtQueryInformationThread  (1064, Basic, 28, ...
 03154   484   NtSetEventBoostPriority  (280, ...
 03155  2064   NtRegisterThreadTerminatePort  (24, ...
 03156  2052   NtWaitForSingleObject  (280, 0, 0x0, ...
 03130  2056   NtWaitForSingleObject  ... ) == 0x0
 03153   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff36000,Pid=1252,Tid=2216,}, 0x0, ) == 0x0
 03154   484   NtSetEventBoostPriority  ... ) == 0x0
 03155  2064   NtRegisterThreadTerminatePort  ... ) == 0x0
 03157  2056   NtSetEventBoostPriority  (280, ...
 03158   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81998, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\4\0\0\344\4\0\0\250\10\0\0" ...  ...
 03159   484   NtWaitForSingleObject  (280, 0, 0x0, ...
 03160  2064   NtWaitForSingleObject  (280, 0, 0x0, ...
 03129   760   NtWaitForSingleObject  ... ) == 0x0
 03157  2056   NtSetEventBoostPriority  ... ) == 0x0
 03158   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81999, 0}  ... {28, 56, reply, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\4\0\0\344\4\0\0\250\10\0\0" )  ) == 0x0
 03161   760   NtSetEventBoostPriority  (280, ...
 03162  2056   NtWaitForSingleObject  (280, 0, 0x0, ...
 03132  1580   NtWaitForSingleObject  ... ) == 0x0
 03161   760   NtSetEventBoostPriority  ... ) == 0x0
 03163   896   NtResumeThread  (1064, ...
 03164  1580   NtSetEventBoostPriority  (280, ...
 03165   760   NtWaitForSingleObject  (280, 0, 0x0, ...
 03163   896   NtResumeThread  ... 1, ) == 0x0
 03141  1656   NtWaitForSingleObject  ... ) == 0x0
 03166   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03167  1656   NtSetEventBoostPriority  (280, ...
 03166   896   NtAllocateVirtualMemory  ... 148701184, 1048576, ) == 0x0
 03145  2068   NtWaitForSingleObject  ... ) == 0x0
 03167  1656   NtSetEventBoostPriority  ... ) == 0x0
 03168  2068   NtSetEventBoostPriority  (280, ...
 03169   896   NtAllocateVirtualMemory  (-1, 149741568, 0, 8192, 4096, 4, ...
 03164  1580   NtSetEventBoostPriority  ... ) == 0x0
 03170  2216   NtWaitForSingleObject  (92, 0, 0x0, ...
 03149  2060   NtWaitForSingleObject  ... ) == 0x0
 03168  2068   NtSetEventBoostPriority  ... ) == 0x0
 03169   896   NtAllocateVirtualMemory  ... 149741568, 8192, ) == 0x0
 03171  1580   NtWaitForSingleObject  (280, 0, 0x0, ...
 03172  2060   NtSetEventBoostPriority  (280, ...
 03173  1656   NtWaitForSingleObject  (132, 0, 0x0, ...
 03174  2068   NtSetEventBoostPriority  (92, ...
 03148  1756   NtWaitForSingleObject  ... ) == 0x0
 03172  2060   NtSetEventBoostPriority  ... ) == 0x0
 03175  1756   NtSetEventBoostPriority  (280, ...
 02357  2072   NtWaitForSingleObject  ... ) == 0x0
 03174  2068   NtSetEventBoostPriority  ... ) == 0x0
 03176   896   NtProtectVirtualMemory  (-1, (0x8ece000), 4096, 260, ...
 03151  1304   NtWaitForSingleObject  ... ) == 0x0
 03177  2072   NtWaitForSingleObject  (280, 0, 0x0, ...
 03178  2068   NtTestAlert  (...
 03176   896   NtProtectVirtualMemory  ... (0x8ece000), 4096, 4, ) == 0x0
 03179  1304   NtSetEventBoostPriority  (280, ...
 03178  2068   NtTestAlert  ... ) == 0x0
 03180   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03159   484   NtWaitForSingleObject  ... ) == 0x0
 03181  2068   NtContinue  (109903152, 1, ...
 03180   896   NtCreateThread  ... 1068, {1252, 2220}, ) == 0x0
 03182   484   NtSetEventBoostPriority  (280, ...
 03183  2068   NtRegisterThreadTerminatePort  (24, ...
 03184   896   NtQueryInformationThread  (1068, Basic, 28, ...
 03160  2064   NtWaitForSingleObject  ... ) == 0x0
 03182   484   NtSetEventBoostPriority  ... ) == 0x0
 03179  1304   NtSetEventBoostPriority  ... ) == 0x0
 03175  1756   NtSetEventBoostPriority  ... ) == 0x0
 03185  2060   NtWaitForSingleObject  (280, 0, 0x0, ...
 03186  2064   NtSetEventBoostPriority  (280, ...
 03184   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff35000,Pid=1252,Tid=2220,}, 0x0, ) == 0x0
 03183  2068   NtRegisterThreadTerminatePort  ... ) == 0x0
 03187  1304   NtWaitForSingleObject  (280, 0, 0x0, ...
 03188  1756   NtWaitForSingleObject  (280, 0, 0x0, ...
 03156  2052   NtWaitForSingleObject  ... ) == 0x0
 03186  2064   NtSetEventBoostPriority  ... ) == 0x0
 03189   484   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03190  2068   NtWaitForSingleObject  (280, 0, 0x0, ...
 03191  2052   NtSetEventBoostPriority  (280, ...
 03192   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81999, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\4\0\0\344\4\0\0\254\10\0\0" ...  ...
 03165   760   NtWaitForSingleObject  ... ) == 0x0
 03192   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82000, 0}  ... {28, 56, reply, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\4\0\0\344\4\0\0\254\10\0\0" )  ) == 0x0
 03193   760   NtSetEventBoostPriority  (280, ...
 03194   896   NtResumeThread  (1068, ...
 03162  2056   NtWaitForSingleObject  ... ) == 0x0
 03193   760   NtSetEventBoostPriority  ... ) == 0x0
 03195  2056   NtSetEventBoostPriority  (280, ...
 03194   896   NtResumeThread  ... 1, ) == 0x0
 03191  2052   NtSetEventBoostPriority  ... ) == 0x0
 03196  2064   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03171  1580   NtWaitForSingleObject  ... ) == 0x0
 03197   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03198  2052   NtWaitForSingleObject  (280, 0, 0x0, ...
 03196  2064   NtDuplicateObject  ... 1072, ) == 0x0
 03199  1580   NtSetEventBoostPriority  (280, ...
 03195  2056   NtSetEventBoostPriority  ... ) == 0x0
 03200   760   NtSetEventBoostPriority  (1004, ...
 03201  2220   NtWaitForSingleObject  (92, 0, 0x0, ...
 03202  2064   NtWaitForSingleObject  (280, 0, 0x0, ...
 03177  2072   NtWaitForSingleObject  ... ) == 0x0
 03199  1580   NtSetEventBoostPriority  ... ) == 0x0
 03203  2056   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03189   484   NtWaitForSingleObject  ... ) == 0x0
 03200   760   NtSetEventBoostPriority  ... ) == 0x0
 03204  2072   NtSetEventBoostPriority  (280, ...
 03197   896   NtAllocateVirtualMemory  ... 149749760, 1048576, ) == 0x0
 03205   484   NtWaitForSingleObject  (280, 0, 0x0, ...
 03185  2060   NtWaitForSingleObject  ... ) == 0x0
 03204  2072   NtSetEventBoostPriority  ... ) == 0x0
 03206   760   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03207  2060   NtSetEventBoostPriority  (280, ...
 03208   896   NtAllocateVirtualMemory  (-1, 150790144, 0, 8192, 4096, 4, ...
 03209  1580   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03187  1304   NtWaitForSingleObject  ... ) == 0x0
 03207  2060   NtSetEventBoostPriority  ... ) == 0x0
 03206   760   NtWaitForSingleObject  ... ) == 0x102
 03208   896   NtAllocateVirtualMemory  ... 150790144, 8192, ) == 0x0
 03210  1304   NtSetEventBoostPriority  (280, ...
 03211  2060   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03212   760   NtWaitForSingleObject  (132, 0, 0x0, ...
 03188  1756   NtWaitForSingleObject  ... ) == 0x0
 03210  1304   NtSetEventBoostPriority  ... ) == 0x0
 03213   896   NtProtectVirtualMemory  (-1, (0x8fce000), 4096, 260, ...
 03214  2072   NtSetEventBoostPriority  (92, ...
 03215  1756   NtSetEventBoostPriority  (280, ...
 03213   896   NtProtectVirtualMemory  ... (0x8fce000), 4096, 4, ) == 0x0
 03190  2068   NtWaitForSingleObject  ... ) == 0x0
 03215  1756   NtSetEventBoostPriority  ... ) == 0x0
 02366  2076   NtWaitForSingleObject  ... ) == 0x0
 03214  2072   NtSetEventBoostPriority  ... ) == 0x0
 03216  2068   NtSetEventBoostPriority  (280, ...
 03217   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03218  1304   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03219  2076   NtWaitForSingleObject  (280, 0, 0x0, ...
 03198  2052   NtWaitForSingleObject  ... ) == 0x0
 03216  2068   NtSetEventBoostPriority  ... ) == 0x0
 03220  2072   NtTestAlert  (...
 03221  1756   NtWaitForSingleObject  (280, 0, 0x0, ...
 03222  2052   NtSetEventBoostPriority  (280, ...
 03217   896   NtCreateThread  ... 1076, {1252, 2224}, ) == 0x0
 03220  2072   NtTestAlert  ... ) == 0x0
 03202  2064   NtWaitForSingleObject  ... ) == 0x0
 03222  2052   NtSetEventBoostPriority  ... ) == 0x0
 03223   896   NtQueryInformationThread  (1076, Basic, 28, ...
 03224  2064   NtSetEventBoostPriority  (280, ...
 03225  2072   NtContinue  (110951728, 1, ...
 03226  2068   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03205   484   NtWaitForSingleObject  ... ) == 0x0
 03224  2064   NtSetEventBoostPriority  ... ) == 0x0
 03223   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff34000,Pid=1252,Tid=2224,}, 0x0, ) == 0x0
 03227  2072   NtRegisterThreadTerminatePort  (24, ...
 03228   484   NtSetEventBoostPriority  (280, ...
 03226  2068   NtDuplicateObject  ... 1080, ) == 0x0
 03229  2052   NtWaitForSingleObject  (280, 0, 0x0, ...
 03230   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82000, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\4\0\0\344\4\0\0\260\10\0\0" ...  ...
 03231  2064   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03219  2076   NtWaitForSingleObject  ... ) == 0x0
 03228   484   NtSetEventBoostPriority  ... ) == 0x0
 03232  2068   NtWaitForSingleObject  (280, 0, 0x0, ...
 03230   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82001, 0}  ... {28, 56, reply, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\4\0\0\344\4\0\0\260\10\0\0" )  ) == 0x0
 03233  2076   NtSetEventBoostPriority  (280, ...
 03227  2072   NtRegisterThreadTerminatePort  ... ) == 0x0
 03234   484   NtSetEventBoostPriority  (1004, ...
 03221  1756   NtWaitForSingleObject  ... ) == 0x0
 03233  2076   NtSetEventBoostPriority  ... ) == 0x0
 03235  2072   NtWaitForSingleObject  (280, 0, 0x0, ...
 03236  1756   NtSetEventBoostPriority  (280, ...
 03203  2056   NtWaitForSingleObject  ... ) == 0x0
 03234   484   NtSetEventBoostPriority  ... ) == 0x0
 03237   896   NtResumeThread  (1076, ...
 03229  2052   NtWaitForSingleObject  ... ) == 0x0
 03238  2056   NtWaitForSingleObject  (280, 0, 0x0, ...
 03236  1756   NtSetEventBoostPriority  ... ) == 0x0
 03239   484   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03240  2052   NtSetEventBoostPriority  (280, ...
 03237   896   NtResumeThread  ... 1, ) == 0x0
 03241  1756   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03232  2068   NtWaitForSingleObject  ... ) == 0x0
 03240  2052   NtSetEventBoostPriority  ... ) == 0x0
 03239   484   NtWaitForSingleObject  ... ) == 0x102
 03242   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03243  2076   NtSetEventBoostPriority  (92, ...
 03244  2224   NtWaitForSingleObject  (92, 0, 0x0, ...
 03245  2068   NtSetEventBoostPriority  (280, ...
 03246  2052   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03247   484   NtWaitForSingleObject  (132, 0, 0x0, ...
 03242   896   NtAllocateVirtualMemory  ... 150798336, 1048576, ) == 0x0
 02373  2080   NtWaitForSingleObject  ... ) == 0x0
 03243  2076   NtSetEventBoostPriority  ... ) == 0x0
 03235  2072   NtWaitForSingleObject  ... ) == 0x0
 03245  2068   NtSetEventBoostPriority  ... ) == 0x0
 03248  2080   NtWaitForSingleObject  (280, 0, 0x0, ...
 03249   896   NtAllocateVirtualMemory  (-1, 151838720, 0, 8192, 4096, 4, ...
 03250  2072   NtSetEventBoostPriority  (280, ...
 03251  2076   NtTestAlert  (...
 03238  2056   NtWaitForSingleObject  ... ) == 0x0
 03250  2072   NtSetEventBoostPriority  ... ) == 0x0
 03249   896   NtAllocateVirtualMemory  ... 151838720, 8192, ) == 0x0
 03252  2056   NtSetEventBoostPriority  (280, ...
 03251  2076   NtTestAlert  ... ) == 0x0
 03253  2068   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03254  2072   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03248  2080   NtWaitForSingleObject  ... ) == 0x0
 03252  2056   NtSetEventBoostPriority  ... ) == 0x0
 03255  2076   NtContinue  (112000304, 1, ...
 03256  2080   NtSetEventBoostPriority  (92, ...
 03254  2072   NtDuplicateObject  ... 1084, ) == 0x0
 03257   896   NtProtectVirtualMemory  (-1, (0x90ce000), 4096, 260, ...
 02381  2084   NtWaitForSingleObject  ... ) == 0x0
 03256  2080   NtSetEventBoostPriority  ... ) == 0x0
 03258  2076   NtRegisterThreadTerminatePort  (24, ...
 03259  2072   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ...
 03260  2084   NtWaitForSingleObject  (280, 0, 0x0, ...
 03257   896   NtProtectVirtualMemory  ... (0x90ce000), 4096, 4, ) == 0x0
 03261  2056   NtSetEventBoostPriority  (1004, ...
 03262  2080   NtTestAlert  (...
 03259  2072   NtAllocateVirtualMemory  ... 1421312, 4096, ) == 0x0
 03263   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03209  1580   NtWaitForSingleObject  ... ) == 0x0
 03261  2056   NtSetEventBoostPriority  ... ) == 0x0
 03262  2080   NtTestAlert  ... ) == 0x0
 03264  2072   NtSetEventBoostPriority  (280, ...
 03265  1580   NtWaitForSingleObject  (280, 0, 0x0, ...
 03263   896   NtCreateThread  ... 1088, {1252, 2228}, ) == 0x0
 03266  2056   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03267  2080   NtContinue  (113048880, 1, ...
 03260  2084   NtWaitForSingleObject  ... ) == 0x0
 03264  2072   NtSetEventBoostPriority  ... ) == 0x0
 03268   896   NtQueryInformationThread  (1088, Basic, 28, ...
 03266  2056   NtWaitForSingleObject  ... ) == 0x102
 03269  2084   NtSetEventBoostPriority  (280, ...
 03270  2080   NtRegisterThreadTerminatePort  (24, ...
 03258  2076   NtRegisterThreadTerminatePort  ... ) == 0x0
 03268   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff33000,Pid=1252,Tid=2228,}, 0x0, ) == 0x0
 03265  1580   NtWaitForSingleObject  ... ) == 0x0
 03269  2084   NtSetEventBoostPriority  ... ) == 0x0
 03271  2056   NtWaitForSingleObject  (280, 0, 0x0, ...
 03270  2080   NtRegisterThreadTerminatePort  ... ) == 0x0
 03272  2076   NtWaitForSingleObject  (280, 0, 0x0, ...
 03273  2072   NtWaitForSingleObject  (280, 0, 0x0, ...
 03274  1580   NtSetEventBoostPriority  (280, ...
 03275   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82001, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\4\0\0\344\4\0\0\264\10\0\0" ...  ...
 03276  2084   NtSetEventBoostPriority  (92, ...
 03277  2080   NtWaitForSingleObject  (280, 0, 0x0, ...
 03272  2076   NtWaitForSingleObject  ... ) == 0x0
 03274  1580   NtSetEventBoostPriority  ... ) == 0x0
 03275   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82002, 0}  ... {28, 56, reply, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\4\0\0\344\4\0\0\264\10\0\0" )  ) == 0x0
 02390  2088   NtWaitForSingleObject  ... ) == 0x0
 03276  2084   NtSetEventBoostPriority  ... ) == 0x0
 03278  2076   NtSetEventBoostPriority  (280, ...
 03279  2088   NtWaitForSingleObject  (280, 0, 0x0, ...
 03280   896   NtResumeThread  (1088, ...
 03273  2072   NtWaitForSingleObject  ... ) == 0x0
 03278  2076   NtSetEventBoostPriority  ... ) == 0x0
 03281  2084   NtTestAlert  (...
 03282  2072   NtSetEventBoostPriority  (280, ...
 03280   896   NtResumeThread  ... 1, ) == 0x0
 03283  1580   NtSetEventBoostPriority  (1004, ...
 03271  2056   NtWaitForSingleObject  ... ) == 0x0
 03282  2072   NtSetEventBoostPriority  ... ) == 0x0
 03281  2084   NtTestAlert  ... ) == 0x0
 03284   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03285  2056   NtSetEventBoostPriority  (280, ...
 03211  2060   NtWaitForSingleObject  ... ) == 0x0
 03283  1580   NtSetEventBoostPriority  ... ) == 0x0
 03286  2072   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03287  2084   NtContinue  (114097456, 1, ...
 03288  2076   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03289  2228   NtWaitForSingleObject  (92, 0, 0x0, ...
 03277  2080   NtWaitForSingleObject  ... ) == 0x0
 03290  2060   NtWaitForSingleObject  (280, 0, 0x0, ...
 03291  1580   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03285  2056   NtSetEventBoostPriority  ... ) == 0x0
 03284   896   NtAllocateVirtualMemory  ... 151846912, 1048576, ) == 0x0
 03292  2084   NtRegisterThreadTerminatePort  (24, ...
 03288  2076   NtDuplicateObject  ... 1092, ) == 0x0
 03293  2080   NtSetEventBoostPriority  (280, ...
 03291  1580   NtWaitForSingleObject  ... ) == 0x102
 03294  2056   NtWaitForSingleObject  (132, 0, 0x0, ...
 03295   896   NtAllocateVirtualMemory  (-1, 152887296, 0, 8192, 4096, 4, ...
 03296  2076   NtWaitForSingleObject  (280, 0, 0x0, ...
 03279  2088   NtWaitForSingleObject  ... ) == 0x0
 03297  1580   NtWaitForSingleObject  (280, 0, 0x0, ...
 03295   896   NtAllocateVirtualMemory  ... 152887296, 8192, ) == 0x0
 03298  2088   NtSetEventBoostPriority  (280, ...
 03293  2080   NtSetEventBoostPriority  ... ) == 0x0
 03292  2084   NtRegisterThreadTerminatePort  ... ) == 0x0
 03290  2060   NtWaitForSingleObject  ... ) == 0x0
 03298  2088   NtSetEventBoostPriority  ... ) == 0x0
 03299   896   NtProtectVirtualMemory  (-1, (0x91ce000), 4096, 260, ...
 03300  2080   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03301  2060   NtSetEventBoostPriority  (280, ...
 03302  2084   NtWaitForSingleObject  (280, 0, 0x0, ...
 03299   896   NtProtectVirtualMemory  ... (0x91ce000), 4096, 4, ) == 0x0
 03296  2076   NtWaitForSingleObject  ... ) == 0x0
 03300  2080   NtDuplicateObject  ... 1096, ) == 0x0
 03303   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03304  2076   NtSetEventBoostPriority  (280, ...
 03301  2060   NtSetEventBoostPriority  ... ) == 0x0
 03305  2088   NtSetEventBoostPriority  (92, ...
 03306  2080   NtWaitForSingleObject  (280, 0, 0x0, ...
 03297  1580   NtWaitForSingleObject  ... ) == 0x0
 03304  2076   NtSetEventBoostPriority  ... ) == 0x0
 03303   896   NtCreateThread  ... 1100, {1252, 2232}, ) == 0x0
 02397  2092   NtWaitForSingleObject  ... ) == 0x0
 03305  2088   NtSetEventBoostPriority  ... ) == 0x0
 03307  1580   NtSetEventBoostPriority  (280, ...
 03308  2060   NtSetEventBoostPriority  (1004, ...
 03309  2092   NtWaitForSingleObject  (280, 0, 0x0, ...
 03310   896   NtQueryInformationThread  (1100, Basic, 28, ...
 03302  2084   NtWaitForSingleObject  ... ) == 0x0
 03311  2088   NtTestAlert  (...
 03218  1304   NtWaitForSingleObject  ... ) == 0x0
 03308  2060   NtSetEventBoostPriority  ... ) == 0x0
 03310   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff32000,Pid=1252,Tid=2232,}, 0x0, ) == 0x0
 03312  2084   NtSetEventBoostPriority  (280, ...
 03313  1304   NtWaitForSingleObject  (280, 0, 0x0, ...
 03311  2088   NtTestAlert  ... ) == 0x0
 03314  2060   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03315   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82002, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\4\0\0\344\4\0\0\270\10\0\0" ...  ...
 03306  2080   NtWaitForSingleObject  ... ) == 0x0
 03312  2084   NtSetEventBoostPriority  ... ) == 0x0
 03316  2088   NtContinue  (115146032, 1, ...
 03314  2060   NtWaitForSingleObject  ... ) == 0x102
 03317  2080   NtSetEventBoostPriority  (280, ...
 03315   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82003, 0}  ... {28, 56, reply, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\4\0\0\344\4\0\0\270\10\0\0" )  ) == 0x0
 03307  1580   NtSetEventBoostPriority  ... ) == 0x0
 03318  2076   NtWaitForSingleObject  (280, 0, 0x0, ...
 03319  2088   NtRegisterThreadTerminatePort  (24, ...
 03309  2092   NtWaitForSingleObject  ... ) == 0x0
 03317  2080   NtSetEventBoostPriority  ... ) == 0x0
 03320  2060   NtWaitForSingleObject  (132, 0, 0x0, ...
 03321  2084   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03322  1580   NtWaitForSingleObject  (132, 0, 0x0, ...
 03323   896   NtResumeThread  (1100, ...
 03324  2092   NtSetEventBoostPriority  (280, ...
 03325  2080   NtWaitForSingleObject  (280, 0, 0x0, ...
 03319  2088   NtRegisterThreadTerminatePort  ... ) == 0x0
 03321  2084   NtDuplicateObject  ... 1104, ) == 0x0
 03313  1304   NtWaitForSingleObject  ... ) == 0x0
 03324  2092   NtSetEventBoostPriority  ... ) == 0x0
 03323   896   NtResumeThread  ... 1, ) == 0x0
 03326  2088   NtWaitForSingleObject  (280, 0, 0x0, ...
 03327  1304   NtSetEventBoostPriority  (280, ...
 03328  2084   NtWaitForSingleObject  (280, 0, 0x0, ...
 03329  2232   NtWaitForSingleObject  (92, 0, 0x0, ...
 03330   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03318  2076   NtWaitForSingleObject  ... ) == 0x0
 03327  1304   NtSetEventBoostPriority  ... ) == 0x0
 03331  2076   NtSetEventBoostPriority  (280, ...
 03330   896   NtAllocateVirtualMemory  ... 152895488, 1048576, ) == 0x0
 03332  2092   NtSetEventBoostPriority  (92, ...
 03325  2080   NtWaitForSingleObject  ... ) == 0x0
 03331  2076   NtSetEventBoostPriority  ... ) == 0x0
 03333   896   NtAllocateVirtualMemory  (-1, 153935872, 0, 8192, 4096, 4, ...
 03334  2080   NtSetEventBoostPriority  (280, ...
 02406  2096   NtWaitForSingleObject  ... ) == 0x0
 03332  2092   NtSetEventBoostPriority  ... ) == 0x0
 03335  2076   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03326  2088   NtWaitForSingleObject  ... ) == 0x0
 03336  2096   NtWaitForSingleObject  (280, 0, 0x0, ...
 03333   896   NtAllocateVirtualMemory  ... 153935872, 8192, ) == 0x0
 03337  2092   NtTestAlert  (...
 03334  2080   NtSetEventBoostPriority  ... ) == 0x0
 03338  1304   NtSetEventBoostPriority  (1004, ...
 03339  2088   NtSetEventBoostPriority  (280, ...
 03337  2092   NtTestAlert  ... ) == 0x0
 03340  2080   NtWaitForSingleObject  (280, 0, 0x0, ...
 03231  2064   NtWaitForSingleObject  ... ) == 0x0
 03338  1304   NtSetEventBoostPriority  ... ) == 0x0
 03328  2084   NtWaitForSingleObject  ... ) == 0x0
 03339  2088   NtSetEventBoostPriority  ... ) == 0x0
 03341  2092   NtContinue  (116194608, 1, ...
 03342  2064   NtWaitForSingleObject  (280, 0, 0x0, ...
 03343  2084   NtSetEventBoostPriority  (280, ...
 03344  1304   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03345   896   NtProtectVirtualMemory  (-1, (0x92ce000), 4096, 260, ...
 03336  2096   NtWaitForSingleObject  ... ) == 0x0
 03343  2084   NtSetEventBoostPriority  ... ) == 0x0
 03346  2092   NtRegisterThreadTerminatePort  (24, ...
 03344  1304   NtWaitForSingleObject  ... ) == 0x102
 03347  2096   NtSetEventBoostPriority  (280, ...
 03345   896   NtProtectVirtualMemory  ... (0x92ce000), 4096, 4, ) == 0x0
 03348  2088   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03349  2084   NtWaitForSingleObject  (280, 0, 0x0, ...
 03340  2080   NtWaitForSingleObject  ... ) == 0x0
 03347  2096   NtSetEventBoostPriority  ... ) == 0x0
 03350  1304   NtWaitForSingleObject  (132, 0, 0x0, ...
 03351   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03348  2088   NtDuplicateObject  ... 1108, ) == 0x0
 03352  2080   NtSetEventBoostPriority  (280, ...
 03346  2092   NtRegisterThreadTerminatePort  ... ) == 0x0
 03353  2096   NtSetEventBoostPriority  (92, ...
 03351   896   NtCreateThread  ... 1112, {1252, 2236}, ) == 0x0
 03342  2064   NtWaitForSingleObject  ... ) == 0x0
 03352  2080   NtSetEventBoostPriority  ... ) == 0x0
 03354  2088   NtWaitForSingleObject  (280, 0, 0x0, ...
 03355  2092   NtWaitForSingleObject  (280, 0, 0x0, ...
 02413  2100   NtWaitForSingleObject  ... ) == 0x0
 03353  2096   NtSetEventBoostPriority  ... ) == 0x0
 03356  2064   NtSetEventBoostPriority  (280, ...
 03357   896   NtQueryInformationThread  (1112, Basic, 28, ...
 03358  2100   NtWaitForSingleObject  (280, 0, 0x0, ...
 03349  2084   NtWaitForSingleObject  ... ) == 0x0
 03356  2064   NtSetEventBoostPriority  ... ) == 0x0
 03359  2096   NtTestAlert  (...
 03360  2084   NtSetEventBoostPriority  (280, ...
 03357   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff31000,Pid=1252,Tid=2236,}, 0x0, ) == 0x0
 03361  2080   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03354  2088   NtWaitForSingleObject  ... ) == 0x0
 03360  2084   NtSetEventBoostPriority  ... ) == 0x0
 03359  2096   NtTestAlert  ... ) == 0x0
 03362  2064   NtSetEventBoostPriority  (1004, ...
 03363  2088   NtSetEventBoostPriority  (280, ...
 03364  2084   NtWaitForSingleObject  (1004, 0, 0x0, ...
 03365  2096   NtContinue  (117243184, 1, ...
 03355  2092   NtWaitForSingleObject  ... ) == 0x0
 03363  2088   NtSetEventBoostPriority  ... ) == 0x0
 03241  1756   NtWaitForSingleObject  ... ) == 0x0
 03362  2064   NtSetEventBoostPriority  ... ) == 0x0
 03366   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 82003, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\4\0\0\344\4\0\0\274\10\0\0" ...  ...
 03367  2092   NtSetEventBoostPriority  (280, ...
 03368  2096   NtRegisterThreadTerminatePort  (24, ...
 03369  1756   NtWaitForSingleObject  (280, 0, 0x0, ...
 03370  2064   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03358  2100   NtWaitForSingleObject  ... ) == 0x0
 03367  2092   NtSetEventBoostPriority  ... ) == 0x0
 03366   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 82004, 0}  ... {28, 56, reply, 0, 1252, 896, 82004, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\4\0\0\344\4\0\0\274\10\0\0" )  ) == 0x0
 03371  2088   NtWaitForSingleObject  (280, 0, 0x0, ...
 03372  2100   NtSetEventBoostPriority  (280, ...
 03370  2064   NtWaitForSingleObject  ... ) == 0x102
 03368  2096   NtRegisterThreadTerminatePort  ... ) == 0x0
 03373   896   NtResumeThread  (1112, ...
 03369  1756   NtWaitForSingleObject  ... ) == 0x0
 03372  2100   NtSetEventBoostPriority  ... ) == 0x0
 03374  2064   NtWaitForSingleObject  (280, 0, 0x0, ...
 03375  2096   NtWaitForSingleObject  (280, 0, 0x0, ...
 03376  1756   NtSetEventBoostPriority  (280, ...
 03373   896   NtResumeThread  ... 1, ) == 0x0
 03377  2092   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03378  2100   NtSetEventBoostPriority  (92, ...
 03379  2236   NtWaitForSingleObject  (92, 0, 0x0, ...
 03371  2088   NtWaitForSingleObject  ... ) == 0x0
 03380   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03377  2092   NtDuplicateObject  ... 1116, ) == 0x0
 02422  2104   NtWaitForSingleObject  ... ) == 0x0
 03378  2100   NtSetEventBoostPriority  ... ) == 0x0
 03381  2088   NtSetEventBoostPriority  (280, ...
 03376  1756   NtSetEventBoostPriority  ... ) == 0x0
 03382  2104   NtWaitForSingleObject  (280, 0, 0x0, ...
 03383  2092   NtWaitForSingleObject  (280, 0, 0x0, ...
 03384  2100   NtTestAlert  (...
 03375  2096   NtWaitForSingleObject  ... ) == 0x0
 03381  2088   NtSetEventBoostPriority  ... ) == 0x0
 03380   896   NtAllocateVirtualMemory  ... 153944064, 1048576, ) == 0x0
 03385  2096   NtSetEventBoostPriority  (280, ...
 03384  2100   NtTestAlert  ... ) == 0x0
 03386  2088   NtWaitForSingleObject  (280, 0, 0x0, ...
 03374  2064   NtWaitForSingleObject  ... ) == 0x0
 03385  2096   NtSetEventBoostPriority  ... ) == 0x0
 03387   896   NtAllocateVirtualMemory  (-1, 154984448, 0, 8192, 4096, 4, ...
 03388  2100   NtContinue  (118291760, 1, ...
 03389  1756   NtSetEventBoostPriority  (1004, ...
 03390  2064   NtSetEventBoostPriority  (280, ...
 03387   896   NtAllocateVirtualMemory  ... 154984448, 8192, ) == 0x0
 03391  2100   NtRegisterThreadTerminatePort  (24, ...
 03382  2104   NtWaitForSingleObject  ... ) == 0x0
 03246  2052   NtWaitForSingleObject  ... ) == 0x0
 03389  1756   NtSetEventBoostPriority  ... ) == 0x0
 03392   896   NtProtectVirtualMemory  (-1, (0x93ce000), 4096, 260, ...
 03390  2064   NtSetEventBoostPriority  ... ) == 0x0
 03393  2096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03394  2104   NtSetEventBoostPriority  (280, ...
 03395  2052   NtWaitForSingleObject  (280, 0, 0x0, ...
 03396  1756   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03392   896   NtProtectVirtualMemory  ... (0x93ce000), 4096, 4, ) == 0x0