Summary:


NtCreateMutant(>) 
 1 
NtNotifyChangeKey(>) 
 2 
NtOpenMutant(>) 
 7 
NtUserFindExistingCursorIcon(>) 
 50 

NtDelayExecution(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtReleaseMutant(>) 
 8 
NtQueryVirtualMemory(>) 
 58 

NtDuplicateToken(>) 
 1 
NtQueryPerformanceCounter(>) 
 2 
NtDuplicateObject(>) 
 9 
NtUserRegisterClassExWOW(>) 
 61 

NtEnumerateValueKey(>) 
 1 
NtQuerySystemTime(>) 
 2 
NtQueryInformationProcess(>) 
 9 
NtCreateSection(>) 
 77 

NtGdiCreateBitmap(>) 
 1 
NtUserGetDC(>) 
 2 
NtOpenProcessTokenEx(>) 
 11 
NtFlushInstructionCache(>) 
 90 

NtGdiInit(>) 
 1 
NtWaitForMultipleObjects(>) 
 2 
NtOpenThreadTokenEx(>) 
 11 
NtQuerySystemInformation(>) 
 121 

NtGdiQueryFontAssocInfo(>) 
 1 
NtConnectPort(>) 
 3 
NtQueryDefaultUILanguage(>) 
 12 
NtQueryAttributesFile(>) 
 128 

NtGdiSelectBitmap(>) 
 1 
NtDeleteValueKey(>) 
 3 
NtUserSystemParametersInfo(>) 
 12 
NtContinue(>) 
 135 

NtOpenEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtQueryInformationFile(>) 
 13 
NtResumeThread(>) 
 150 

NtOpenKeyedEvent(>) 
 1 
NtReleaseSemaphore(>) 
 3 
NtQuerySection(>) 
 13 
NtQueryInformationThread(>) 
 153 

NtOpenProcess(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtCreateThread(>) 
 157 

NtOpenSymbolicLinkObject(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQueryInformationToken(>) 
 14 
NtTestAlert(>) 
 169 

NtQueryEvent(>) 
 1 
NtUserRegisterWindowMessage(>) 
 3 
NtOpenThreadToken(>) 
 16 
NtRegisterThreadTerminatePort(>) 
 171 

NtQueryInstallUILanguage(>) 
 1 
NtAccessCheck(>) 
 4 
NtSetValueKey(>) 
 19 
NtRequestWaitReplyPort(>) 
 182 

NtQueryObject(>) 
 1 
NtCreateIoCompletion(>) 
 4 
NtUnmapViewOfSection(>) 
 19 
NtOpenKey(>) 
 238 

NtQuerySymbolicLinkObject(>) 
 1 
NtEnumerateKey(>) 
 4 
NtCreateKey(>) 
 20 
NtSetInformationThread(>) 
 267 

NtRaiseException(>) 
 1 
NtReadFile(>) 
 4 
NtQueryDebugFilterState(>) 
 21 
NtSetEventBoostPriority(>) 
 286 

NtSetInformationProcess(>) 
 1 
NtSetEvent(>) 
 4 
NtSetInformationFile(>) 
 26 
NtQueryValueKey(>) 
 308 

NtUserCallNoParam(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtFreeVirtualMemory(>) 
 28 
NtProtectVirtualMemory(>) 
 340 

NtUserCallOneParam(>) 
 1 
NtCreateSemaphore(>) 
 6 
NtCreateFile(>) 
 29 
NtWaitForSingleObject(>) 
 349 

NtUserGetThreadDesktop(>) 
 1 
NtOpenProcessToken(>) 
 6 
NtOpenSection(>) 
 32 
NtClose(>) 
 392 

NtUserGetThreadState(>) 
 1 
NtQueryDefaultLocale(>) 
 6 
NtOpenFile(>) 
 46 
NtAllocateVirtualMemory(>) 
 464 

NtAddAtom(>) 
 2 
NtQueryVolumeInformationFile(>) 
 6 
NtCreateEvent(>) 
 47 

NtCallbackReturn(>) 
 2 
NtWriteFile(>) 
 6 
NtDeviceIoControlFile(>) 
 47 

NtGdiCreateSolidBrush(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147481368, {status=0x0, info=1}, ) }, 0, 32, ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147481368, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147481368, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147481368, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147481368, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147481368, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147481368, 0, 0x0, 0x0, 0x90120,  (-2147481368, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147481480, ) == 0x0
 00059   896   NtClose  (-2147481480, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481480, ... -2147482136, ) == 0x0
 00061   896   NtClose  (-2147482136, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482136, ... -2147482748, ) == 0x0
 00063   896   NtClose  (-2147482748, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482748, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147481480, ... ) == 0x0
 00105   896   NtClose  (-2147482136, ... ) == 0x0
 00106   896   NtClose  (-2147482748, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147482748, ) == 0x0
 00145   896   NtClose  (-2147482748, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482748, ... -2147482136, ) == 0x0
 00147   896   NtClose  (-2147482136, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482136, ... -2147481480, ) == 0x0
 00149   896   NtClose  (-2147481480, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481480, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147482748, ... ) == 0x0
 00178   896   NtClose  (-2147482136, ... ) == 0x0
 00179   896   NtClose  (-2147481480, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147481368, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x408000), 151552, 4, ... (0x408000), 151552, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x408000), 151552, 128, ... (0x408000), 151552, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4227072, 151552, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40292e,}, 4, ... ) == 0x0
 00260   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00261   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262   896   NtClose  (16, ... ) == 0x0
 00263   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00264   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00266   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00267   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00268   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00269   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00270   896   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00271   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00273   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00274   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00275   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00276   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00277   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00278   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00280   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00281   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00283   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00284   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00285   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00286   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00287   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00288   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00289   896   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00290   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00291   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00294   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00295   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00296   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00297   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00298   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00299   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00300   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00301   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00302   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242932, ... ) }, 1242932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00303   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00305   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00306   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00307   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00308   896   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00309   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00310   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00312   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00313   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00314   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00315   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00316   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00318   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00319   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00320   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00321   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242972, ... ) }, 1242972, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00322   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00323   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00324   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00326   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00327   896   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00328   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00330   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00332   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00333   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00334   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00335   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00336   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00337   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00338   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00339   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00340   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00341   896   NtQueryVirtualMemory  (-1, 0x408729, Basic, 28, ... {BaseAddress=0x408000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00342   896   NtContinue  (1244400, 0, ...
 00343   896   NtAllocateVirtualMemory  (-1, 0, 0, 2398, 4096, 64, ... 3276800, 4096, ) == 0x0
 00344   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00345   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00346   896   NtClose  (16, ... ) == 0x0
 00347   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00348   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00349   896   NtClose  (16, ... ) == 0x0
 00350   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00351   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00352   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00353   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00355   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00356   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00358   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00359   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00360   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00361   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00362   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00363   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00364   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00365   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00366   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00367   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00368   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00369   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00370   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00371   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00372   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00373   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00374   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00375   896   NtClose  (16, ... ) == 0x0
 00376   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00377   896   NtClose  (28, ... ) == 0x0
 00378   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00379   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00380   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00381   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00382   896   NtClose  (28, ... ) == 0x0
 00383   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00384   896   NtClose  (16, ... ) == 0x0
 00385   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00386   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00387   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00388   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00389   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00390   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00391   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00392   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00393   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00394   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00395   896   NtClose  (36, ... ) == 0x0
 00396   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00397   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00398   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00399   896   NtClose  (36, ... ) == 0x0
 00400   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00401   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00402   896   NtClose  (32, ... ) == 0x0
 00403   896   NtClose  (16, ... ) == 0x0
 00404   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00405   896   NtClose  (28, ... ) == 0x0
 00406   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00407   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00408   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00409   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00410   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00411   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00412   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00413   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00414   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00415   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00416   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00417   896   NtClose  (28, ... ) == 0x0
 00418   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00419   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00420   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00421   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00422   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00423   896   NtClose  (28, ... ) == 0x0
 00424   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00425   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00426   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00427   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00428   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00429   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00430   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00431   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00432   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00433   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00434   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00435   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00436   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00437   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00438   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00439   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00440   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00441   896   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00442   896   NtClose  (28, ... ) == 0x0
 00443   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00444   896   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00445   896   NtClose  (28, ... ) == 0x0
 00446   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00447   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00448   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00449   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00450   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00451   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00452   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00453   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00454   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00455   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00456   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 16, ) }, ... 16, ) == 0x0
 00457   896   NtQueryValueKey  (16,  (16, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00458   896   NtClose  (16, ... ) == 0x0
 00459   896   NtMapViewOfSection  (-2147481368, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x430000), 0x0, 1060864, ) == 0x0
 00460   896   NtClose  (-2147481368, ... ) == 0x0
 00461   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 16, ) == 0x0
 00462   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00463   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147481368, ) == 0x0
 00464   896   NtQueryInformationToken  (-2147481368, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00465   896   NtQueryInformationToken  (-2147481368, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00466   896   NtClose  (-2147481368, ... ) == 0x0
 00467   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5505024, 4096, ) == 0x0
 00468   896   NtFreeVirtualMemory  (-1, (0x540000), 4096, 32768, ... (0x540000), 4096, ) == 0x0
 00469   896   NtDuplicateObject  (-1, 32, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00470   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00471   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00472   896   NtClose  (-2147481368, ... ) == 0x0
 00473   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00474   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00475   896   NtClose  (-2147481368, ... ) == 0x0
 00476   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00477   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00478   896   NtUserCallNoParam  (24, ... ) == 0x0
 00479   896   NtGdiCreateCompatibleDC  (0, ...
 00480   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5505024, 4096, ) == 0x0
 00479   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00481   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00482   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00483   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00484   896   NtGdiCreateSolidBrush  (0, 0, ...
 00485   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8716288, 4096, ) == 0x0
 00484   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00486   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00487   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00488   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00489   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00490   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00491   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00492   896   NtClose  (44, ... ) == 0x0
 00493   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00494   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00495   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00496   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00497   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00498   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00499   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00500   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00501   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00502   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00503   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00504   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00505   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00506   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00507   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00508   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00509   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00510   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00511   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00512   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00513   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00514   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00515   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00516   896   NtCallbackReturn  (0, 0, 0, ...
 00517   896   NtGdiInit  (... ) == 0x1
 00518   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00519   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00520   896   NtAllocateVirtualMemory  (-1, 0, 0, 27136, 4096, 64, ... 8781824, 28672, ) == 0x0
 00521   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00522   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00523   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00524   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00525   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00526   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 48, ) == 0x0
 00527   896   NtQuerySection  (48, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00528   896   NtClose  (44, ... ) == 0x0
 00529   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00530   896   NtClose  (48, ... ) == 0x0
 00531   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 48, ) }, ... 48, ) == 0x0
 00532   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00533   896   NtClose  (48, ... ) == 0x0
 00534   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00535   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00536   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00537   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00538   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00539   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00540   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00541   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00542   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00543   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 48, {status=0x0, info=1}, ) }, 5, 96, ... 48, {status=0x0, info=1}, ) == 0x0
 00544   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 48, ... 44, ) == 0x0
 00545   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00546   896   NtClose  (48, ... ) == 0x0
 00547   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00548   896   NtClose  (44, ... ) == 0x0
 00549   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00550   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00551   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00552   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00553   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00554   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00555   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00556   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00557   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8847360, 65536, ) == 0x0
 00558   896   NtAllocateVirtualMemory  (-1, 8847360, 0, 4096, 4096, 4, ... 8847360, 4096, ) == 0x0
 00559   896   NtAllocateVirtualMemory  (-1, 8851456, 0, 8192, 4096, 4, ... 8851456, 8192, ) == 0x0
 00560   896   NtAllocateVirtualMemory  (-1, 8859648, 0, 4096, 4096, 4, ... 8859648, 4096, ) == 0x0
 00561   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00562   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x880000), 0x0, 12288, ) == 0x0
 00563   896   NtClose  (44, ... ) == 0x0
 00564   896   NtAllocateVirtualMemory  (-1, 8863744, 0, 4096, 4096, 4, ... 8863744, 4096, ) == 0x0
 00565   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00566   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00567   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00568   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00569   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00570   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00571   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00572   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00573   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00574   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00575   896   NtClose  (44, ... ) == 0x0
 00576   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00577   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00578   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00579   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00580   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00581   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00582   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00583   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00584   896   NtClose  (44, ... ) == 0x0
 00585   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00586   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00587   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00588   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00589   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00590   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00591   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00592   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00593   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00594   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00595   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00596   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00597   896   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00598   896   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00599   896   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00600   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00601   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00602   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00603   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00604   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00605   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00606   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00607   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00608   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00609   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00610   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00611   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00612   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00613   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x890000), 0x0, 36864, ) == STATUS_IMAGE_NOT_AT_BASE
 00614   896   NtProtectVirtualMemory  (-1, (0x891000), 18944, 4, ... (0x891000), 20480, 32, ) == 0x0
 00615   896   NtProtectVirtualMemory  (-1, (0x897000), 1024, 4, ... (0x897000), 4096, 2, ) == 0x0
 00616   896   NtProtectVirtualMemory  (-1, (0x898000), 1536, 4, ... (0x898000), 4096, 2, ) == 0x0
 00617   896   NtMapViewOfSection  (44, -1, (0x890000), 0, 0, 0x0, 36864, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00618   896   NtProtectVirtualMemory  (-1, (0x891000), 18944, 16, ... (0x891000), 20480, 4, ) == 0x0
 00619   896   NtProtectVirtualMemory  (-1, (0x897000), 1024, 2, ... (0x897000), 4096, 8, ) == 0x0
 00620   896   NtProtectVirtualMemory  (-1, (0x898000), 1536, 2, ... (0x898000), 4096, 8, ) == 0x0
 00621   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00622   896   NtClose  (44, ... ) == 0x0
 00623   896   NtProtectVirtualMemory  (-1, (0x891000), 160, 4, ... (0x891000), 4096, 16, ) == 0x0
 00624   896   NtProtectVirtualMemory  (-1, (0x891000), 4096, 16, ... (0x891000), 4096, 4, ) == 0x0
 00625   896   NtFlushInstructionCache  (-1, 8982528, 160, ... ) == 0x0
 00626   896   NtProtectVirtualMemory  (-1, (0x891000), 160, 4, ... (0x891000), 4096, 16, ) == 0x0
 00627   896   NtProtectVirtualMemory  (-1, (0x891000), 4096, 16, ... (0x891000), 4096, 4, ) == 0x0
 00628   896   NtFlushInstructionCache  (-1, 8982528, 160, ... ) == 0x0
 00629   896   NtProtectVirtualMemory  (-1, (0x891000), 160, 4, ... (0x891000), 4096, 16, ) == 0x0
 00630   896   NtProtectVirtualMemory  (-1, (0x891000), 4096, 16, ... (0x891000), 4096, 4, ) == 0x0
 00631   896   NtFlushInstructionCache  (-1, 8982528, 160, ... ) == 0x0
 00632   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00633   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00634   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00635   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 44, ) }, ... 44, ) == 0x0
 00636   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00637   896   NtClose  (44, ... ) == 0x0
 00638   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00639   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00640   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00641   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00642   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00643   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00644   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00645   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00646   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00647   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00648   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00649   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00650   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00651   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00652   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00653   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00654   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00655   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00656   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00657   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00658   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00659   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00660   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00661   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00662   896   NtCreateSemaphore  (0x1f0003, {24, 44, 0x80, 1331504, 0,  (0x1f0003, {24, 44, 0x80, 1331504, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 48, ) }, 0, 2147483647, ... 48, ) == STATUS_OBJECT_NAME_EXISTS
 00663   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00664   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00665   896   NtQueryPerformanceCounter  (... {-1450140862, 16}, {3579545, 0}, ) == 0x0
 00666   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WININET.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   896   NtQueryPerformanceCounter  (... {-1450139750, 16}, {3579545, 0}, ) == 0x0
 00668   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 8192, 4096, 4, ... 1335296, 8192, ) == 0x0
 00669   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00670   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9043968, 1048576, ) == 0x0
 00671   896   NtAllocateVirtualMemory  (-1, 9043968, 0, 4096, 4096, 4, ... 9043968, 4096, ) == 0x0
 00672   896   NtAllocateVirtualMemory  (-1, 9048064, 0, 8192, 4096, 4, ... 9048064, 8192, ) == 0x0
 00673   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00674   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242348,  (0xc0100080, {24, 0, 0x40, 0, 1242348, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) == 0x0
 00675   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00676   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f54c, 0x22414c,  (56, 60, 0x0, 0x12f54c, 0x22414c, "\224\365\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00677   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00678   896   NtQueryValueKey  (-2147481368,  (-2147481368, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00679   896   NtQueryValueKey  (-2147481368,  (-2147481368, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00680   896   NtClose  (-2147481368, ... ) == 0x0
 00681   896   NtClose  (2280, ... ) == 0x0
 00676   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \3106\342\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#u\0l\0t\0t\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00682   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242564,  (0xc0100080, {24, 0, 0x40, 0, 1242564, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) == 0x0
 00683   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00684   896   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 76, ) == 0x0
 00685   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 80, ) == 0x0
 00686   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 84, ) == 0x0
 00687   896   NtAllocateVirtualMemory  (-1, 9056256, 0, 8192, 4096, 4, ... 9056256, 8192, ) == 0x0
 00688   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10092544, 1048576, ) == 0x0
 00689   896   NtAllocateVirtualMemory  (-1, 11132928, 0, 8192, 4096, 4, ... 11132928, 8192, ) == 0x0
 00690   896   NtProtectVirtualMemory  (-1, (0xa9e000), 4096, 260, ... (0xa9e000), 4096, 4, ) == 0x0
 00691   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1241648, 1241592, 1, ... 88, {1252, 2016}, ) == 0x0
 00692   896   NtQueryInformationThread  (88, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00693   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 9044344}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9044344} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9044344} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00694   896   NtResumeThread  (88, ... 1, ) == 0x0
 00695   896   NtClose  (88, ...
 00696  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 92, ) == 0x0
 00697  2016   NtWaitForSingleObject  (92, 0, 0x0, ...
 00695   896   NtClose  ... ) == 0x0
 00698   896   NtSetEvent  (72, ... 0x0, ) == 0x0
 00699   896   NtSetEvent  (52, ... 0x0, ) == 0x0
 00700   896   NtClose  (52, ... ) == 0x0
 00701   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00702   896   NtAllocateVirtualMemory  (-1, 9064448, 0, 4096, 4096, 4, ... 9064448, 4096, ) == 0x0
 00703   896   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f54c, 0x22414c,  (56, 60, 0x0, 0x12f54c, 0x22414c, "\224\365\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00704   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00705   896   NtQueryValueKey  (-2147481368,  (-2147481368, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00706   896   NtQueryValueKey  (-2147481368,  (-2147481368, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00707   896   NtClose  (-2147481368, ... ) == 0x0
 00708   896   NtClose  (2280, ... ) == 0x0
 00703   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \350R\342\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344Vid\00\211\25\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0X\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00709   896   NtSetEvent  (72, ... 0x0, ) == 0x0
 00710   896   NtSetEvent  (52, ... 0x0, ) == 0x0
 00711   896   NtClose  (52, ... ) == 0x0
 00712   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00713   896   NtOpenProcessToken  (-1, 0xa, ... 52, ) == 0x0
 00714   896   NtDuplicateToken  (52, 0xc, {24, 0, 0x0, 0, 1242832, 0x0}, 0, 2, ... 96, ) == 0x0
 00715   896   NtClose  (52, ... ) == 0x0
 00716   896   NtAccessCheck  (1337328, 96, 0x1, 1242908, 1242960, 56, 1242940, ... (0x1), ) == 0x0
 00717   896   NtClose  (96, ... ) == 0x0
 00718   896   NtQueryDefaultUILanguage  (1241712, ...
 00719   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00720   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 00721   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00722   896   NtClose  (-2147481368, ... ) == 0x0
 00723   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00724   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00725   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00726   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00727   896   NtClose  (-2147481452, ... ) == 0x0
 00728   896   NtClose  (-2147481368, ... ) == 0x0
 00718   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00729   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00730   896   NtQueryDefaultUILanguage  (2090319928, ...
 00731   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00732   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 00733   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00734   896   NtClose  (-2147481368, ... ) == 0x0
 00735   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00736   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00737   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00738   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00739   896   NtClose  (-2147481452, ... ) == 0x0
 00740   896   NtClose  (-2147481368, ... ) == 0x0
 00730   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00741   896   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00742   896   NtQueryDefaultLocale  (1, 1239808, ... ) == 0x0
 00743   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00744   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240844, 1179817, 1240568}  (24, {128, 156, new_msg, 0, 2088850039, 1240844, 1179817, 1240568} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81838, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81838, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240844, 1179817, 1240568} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81838, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363\22\0\0\0\0\0" )  ) == 0x0
 00745   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00746   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00747   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00748   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00749   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1239036, ... ) }, 1239036, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00750   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00751   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00752   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00753   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239100, ... ) }, 1239100, ... ) == 0x0
 00754   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 96, {status=0x0, info=1}, ) }, 3, 33, ... 96, {status=0x0, info=1}, ) == 0x0
 00755   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00756   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00757   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00758   896   NtClose  (52, ... ) == 0x0
 00759   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xab0000), 0x0, 1056768, ) == 0x0
 00760   896   NtClose  (100, ... ) == 0x0
 00761   896   NtUnmapViewOfSection  (-1, 0xab0000, ... ) == 0x0
 00762   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00763   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 100, ... 52, ) == 0x0
 00764   896   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00765   896   NtClose  (100, ... ) == 0x0
 00766   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00767   896   NtClose  (52, ... ) == 0x0
 00768   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00769   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00770   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00771   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00772   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00773   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00774   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00775   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00776   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00777   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00778   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00779   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00780   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00781   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00782   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00783   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00784   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00785   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00786   896   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00787   896   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00788   896   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00789   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00790   896   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240580, ... ) , 42, 1240580, ... ) == 0x0
 00791   896   NtQueryDefaultUILanguage  (1239264, ...
 00792   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00793   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 00794   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00795   896   NtClose  (-2147481368, ... ) == 0x0
 00796   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00797   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00798   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00799   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00800   896   NtClose  (-2147481452, ... ) == 0x0
 00801   896   NtClose  (-2147481368, ... ) == 0x0
 00791   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00802   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238104, ... ) }, 1238104, ... ) == 0x0
 00803   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00804   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00805   896   NtClose  (52, ... ) == 0x0
 00806   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xab0000), 0x0, 4096, ) == 0x0
 00807   896   NtClose  (100, ... ) == 0x0
 00808   896   NtUnmapViewOfSection  (-1, 0xab0000, ... ) == 0x0
 00809   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237700, ... ) }, 1237700, ... ) == 0x0
 00810   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238444,  (0x80100080, {24, 0, 0x40, 0, 1238444, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) == 0x0
 00811   896   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 100, ... 52, ) == 0x0
 00812   896   NtClose  (100, ... ) == 0x0
 00813   896   NtMapViewOfSection  (52, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xab0000), {0, 0}, 4096, ) == 0x0
 00814   896   NtClose  (52, ... ) == 0x0
 00815   896   NtUnmapViewOfSection  (-1, 0xab0000, ... ) == 0x0
 00816   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 52, {status=0x0, info=1}, ) }, 1, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00817   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 52, ... 100, ) == 0x0
 00818   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xab0000), 0x0, 4096, ) == 0x0
 00819   896   NtQueryInformationFile  (52, 1238096, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00820   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00821   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238396, 1179817, 1238120}  (24, {128, 156, new_msg, 0, 2088850039, 1238396, 1179817, 1238120} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81839, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81839, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238396, 1179817, 1238120} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81839, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\351\22\0\0\0\0\0" )  ) == 0x0
 00822   896   NtClose  (52, ... ) == 0x0
 00823   896   NtClose  (100, ... ) == 0x0
 00824   896   NtUnmapViewOfSection  (-1, 0xab0000, ... ) == 0x0
 00825   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00826   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00827   896   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00828   896   NtUserGetDC  (0, ... ) == 0x1010052
 00829   896   NtQueryVirtualMemory  (-1, 0x7c91ca50, Basic, 28, ... {BaseAddress=0x7c91c000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x60000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00830   896   NtQueryVirtualMemory  (-1, 0x7c9163a8, Basic, 28, ... {BaseAddress=0x7c916000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00831   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 00832   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 00833   896   NtContinue  (1238304, 0, ...
 00834   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 00835   896   NtUnmapViewOfSection  (-1, 0x773d0000, ... ) == 0x0
 00836   896   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 00837   896   NtUnmapViewOfSection  (-1, 0xaa0000, ... ) == 0x0
 00838   896   NtClose  (96, ... ) == 0x0
 00839   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00840   896   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00841   896   NtClose  (96, ... ) == 0x0
 00842   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00843   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00844   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00845   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00846   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00847   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00848   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00849   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00850   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00851   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00852   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00853   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00854   896   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00855   896   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00856   896   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00857   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00858   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00859   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11141120, 65536, ) == 0x0
 00860   896   NtAllocateVirtualMemory  (-1, 11141120, 0, 4096, 4096, 4, ... 11141120, 4096, ) == 0x0
 00861   896   NtAllocateVirtualMemory  (-1, 11145216, 0, 8192, 4096, 4, ... 11145216, 8192, ) == 0x0
 00862   896   NtAllocateVirtualMemory  (-1, 11153408, 0, 4096, 4096, 4, ... 11153408, 4096, ) == 0x0
 00863   896   NtAllocateVirtualMemory  (-1, 11157504, 0, 4096, 4096, 4, ... 11157504, 4096, ) == 0x0
 00864   896   NtQueryDefaultUILanguage  (1238736, ...
 00865   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00866   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481368, ) == 0x0
 00867   896   NtQueryInformationToken  (-2147481368, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00868   896   NtClose  (-2147481368, ... ) == 0x0
 00869   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00870   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x240, 0, 0,  (0x80000000, {24, -2147481368, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00871   896   NtOpenKey  (0x80000000, {24, -2147481368, 0x640, 0, 0,  (0x80000000, {24, -2147481368, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00872   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00873   896   NtClose  (-2147481452, ... ) == 0x0
 00874   896   NtClose  (-2147481368, ... ) == 0x0
 00864   896   NtQueryDefaultUILanguage  ... ) == 0x0
 00875   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll"}, 1, 96, ... 96, {status=0x0, info=1}, ) }, 1, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00876   896   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 96, ... 100, ) == 0x0
 00877   896   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xad0000), 0x0, 618496, ) == 0x0
 00878   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00879   896   NtQueryDefaultLocale  (1, 1236832, ... ) == 0x0
 00880   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00881   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1237868, 1179817, 1237592}  (24, {128, 156, new_msg, 0, 2088850039, 1237868, 1179817, 1237592} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1`\0\0\0\377\377\377\377\0\0\0\0\340q\264\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0`\347\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81840, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1`\0\0\0\377\377\377\377\0\0\0\0\340q\264\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0`\347\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 896, 81840, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1237868, 1179817, 1237592} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1`\0\0\0\377\377\377\377\0\0\0\0\340q\264\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0`\347\22\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81840, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1`\0\0\0\377\377\377\377\0\0\0\0\340q\264\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0`\347\22\0\0\0\0\0" )  ) == 0x0
 00882   896   NtClose  (96, ... ) == 0x0
 00883   896   NtClose  (100, ... ) == 0x0
 00884   896   NtUnmapViewOfSection  (-1, 0xad0000, ... ) == 0x0
 00885   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00886   896   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 100, ) == 0x0
 00887   896   NtQueryInformationProcess  (100, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00888   896   NtClose  (100, ... ) == 0x0
 00889   896   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00890   896   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 00891   896   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 00892   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00893   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00894   896   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00895   896   NtClose  (100, ... ) == 0x0
 00896   896   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00897   896   NtOpenProcessToken  (-1, 0x8, ... 96, ) == 0x0
 00898   896   NtAccessCheck  (1337328, 96, 0x1, 1239928, 1239980, 56, 1239960, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00899   896   NtClose  (96, ... ) == 0x0
 00900   896   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Control Panel\Desktop"}, ... 96, ) }, ... 96, ) == 0x0
 00901   896   NtQueryValueKey  (96,  (96, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00902   896   NtClose  (96, ... ) == 0x0
 00903   896   NtUserSystemParametersInfo  (41, 500, 1240108, 0, ... ) == 0x1
 00904   896   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 00905   896   NtClose  (100, ... ) == 0x0
 00906   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00907   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c03b
 00908   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c03d
 00909   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00910   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c03f
 00911   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00912   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c041
 00913   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00914   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c043
 00915   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c045
 00916   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00917   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c047
 00918   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00919   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c049
 00920   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00921   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c04b
 00922   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00923   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c04d
 00924   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00925   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c04f
 00926   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c051
 00927   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00928   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c053
 00929   896   NtUserFindExistingCursorIcon  (1239856, 1239872, 1239920, ... ) == 0x10011
 00930   896   NtUserRegisterClassExWOW  (1239800, 1239868, 1239884, 1239900, 0, 384, 0, ... ) == 0x8177c055
 00931   896   NtUserFindExistingCursorIcon  (1239856, 1239872, 1239920, ... ) == 0x10011
 00932   896   NtUserRegisterClassExWOW  (1239800, 1239868, 1239884, 1239900, 0, 384, 0, ... ) == 0x8177c057
 00933   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00934   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c059
 00935   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10013
 00936   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c05b
 00937   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00938   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c05d
 00939   896   NtUserFindExistingCursorIcon  (1239860, 1239876, 1239924, ... ) == 0x10011
 00940   896   NtUserRegisterClassExWOW  (1239804, 1239872, 1239888, 1239904, 0, 384, 0, ... ) == 0x8177c05f
 00941   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00942   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00943   896   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00944   896   NtClose  (100, ... ) == 0x0
 00945   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00946   896   NtSetInformationObject  (100, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00947   896   NtCreateKey  (0x2001f, {24, 100, 0x40, 0, 0,  (0x2001f, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 96, 2, ) }, 0, 0x0, 0, ... 96, 2, ) == 0x0
 00948   896   NtSetEventBoostPriority  (92, ...
 00697  2016   NtWaitForSingleObject  ... ) == 0x0
 00949  2016   NtTestAlert  (... ) == 0x0
 00950  2016   NtContinue  (11140400, 1, ...
 00951  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00952  2016   NtDeviceIoControlFile  (68, 80, 0x0, 0x77e466a0, 0x228144,  (68, 80, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0X\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00948   896   NtSetEventBoostPriority  ... ) == 0x0
 00953   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00954   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 1242908, ... }, 1242908, ...
 00955  2016   NtWaitForMultipleObjects  (2, (72, 80, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 00956  2016   NtDeviceIoControlFile  (68, 84, 0x0, 0x77e46680, 0x228144,  (68, 84, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0X\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00957  2016   NtWaitForMultipleObjects  (2, (72, 84, ), 1, 1, {1294967296, -1}, ...
 00954   896   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00958   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00959   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00960   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 52, ... 104, ) == 0x0
 00961   896   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00962   896   NtClose  (52, ... ) == 0x0
 00963   896   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 102400, ) == 0x0
 00964   896   NtClose  (104, ... ) == 0x0
 00965   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 00966   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 00967   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 00968   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 00969   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 00970   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 00971   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 00972   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 00973   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 00974   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 00975   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 00976   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 00977   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 00978   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 00979   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 00980   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 00981   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 00982   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 00983   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00984   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00985   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11337728, 65536, ) == 0x0
 00986   896   NtAllocateVirtualMemory  (-1, 11337728, 0, 4096, 4096, 4, ... 11337728, 4096, ) == 0x0
 00987   896   NtAllocateVirtualMemory  (-1, 11341824, 0, 8192, 4096, 4, ... 11341824, 8192, ) == 0x0
 00988   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 104, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 104, {status=0x0, info=0}, ) == 0x0
 00989   896   NtCreateFile  (0x40000000, {24, 0, 0x40, 0, 0,  (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 52, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 52, {status=0x0, info=0}, ) == 0x0
 00990   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 108, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 108, {status=0x0, info=0}, ) == 0x0
 00991   896   NtCreateFile  (0x100003, {24, 0, 0x40, 0, 0,  (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 112, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 112, {status=0x0, info=0}, ) == 0x0
 00992   896   NtCreateFile  (0x20100080, {24, 0, 0x40, 0, 1242836,  (0x20100080, {24, 0, 0x40, 0, 1242836, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 116, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 116, {status=0x0, info=0}, ) == 0x0
 00993   896   NtAllocateVirtualMemory  (-1, 11350016, 0, 36864, 4096, 4, ... 11350016, 36864, ) == 0x0
 00994   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 00995   896   NtDeviceIoControlFile  (104, 120, 0x0, 0x0, 0x120003,  (104, 120, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (104, 120, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 00996   896   NtClose  (120, ... ) == 0x0
 00997   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 00998   896   NtDeviceIoControlFile  (104, 120, 0x0, 0x0, 0x120003,  (104, 120, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118},  (104, 120, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0
 00999   896   NtClose  (120, ... ) == 0x0
 01000   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 01001   896   NtDeviceIoControlFile  (104, 120, 0x0, 0x0, 0x120003,  (104, 120, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363m\201\1\0\0\0\5\0\0\0\232A\250\25J#\243\6\274\205\1\0\326\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0O8k\0\366\221\0\0\356\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , 36, 348, ... {status=0x0, info=158},  (104, 120, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363m\201\1\0\0\0\5\0\0\0\232A\250\25J#\243\6\274\205\1\0\326\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0O8k\0\366\221\0\0\356\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , ) == 0x0
 01002   896   NtClose  (120, ... ) == 0x0
 01003   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 01004   896   NtDeviceIoControlFile  (104, 120, 0x0, 0x0, 0x120003,  (104, 120, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (104, 120, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01005   896   NtClose  (120, ... ) == 0x0
 01006   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 01007   896   NtDeviceIoControlFile  (104, 120, 0x0, 0x0, 0x120003,  (104, 120, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4},  (104, 120, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0
 01008   896   NtClose  (120, ... ) == 0x0
 01009   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 01010   896   NtDeviceIoControlFile  (104, 120, 0x0, 0x0, 0x120003,  (104, 120, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8},  (104, 120, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0
 01011   896   NtClose  (120, ... ) == 0x0
 01012   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 120, ) == 0x0
 01013   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 124, ) == 0x0
 01014   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01015   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01016   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01017   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01018   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01019   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01020   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01021   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01022   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01023   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01024   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01025   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01026   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01027   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01028   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01029   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01030   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01031   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01032   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01033   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01034   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01035   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01036   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01037   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01038   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01039   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01040   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01041   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01042   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01043   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01044   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01045   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01046   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01047   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01048   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01049   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01050   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01051   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01052   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01053   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01054   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01055   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01056   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01057   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01058   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01059   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01060   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01061   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01062   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01063   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01064   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01065   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01066   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01067   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01068   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01069   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01070   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01071   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01072   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01073   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01074   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01075   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01076   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01077   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01078   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01079   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01080   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01081   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01082   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01083   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01084   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01085   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01086   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01087   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01088   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01089   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01090   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01091   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01092   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01093   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01094   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01095   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01096   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01097   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01098   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01099   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01100   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01101   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01102   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01103   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01104   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01105   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01106   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01107   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01108   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01109   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01110   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01111   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01112   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01113   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01114   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01115   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01116   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01117   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01118   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01119   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01120   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01121   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01122   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01123   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01124   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01125   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01126   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01127   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01128   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01129   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01130   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01131   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01132   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01133   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01134   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11403264, 65536, ) == 0x0
 01135   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01136   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 1, 4096, 4, ... 11403264, 4096, ) == 0x0
 01137   896   NtQueryVirtualMemory  (-1, 0xae0000, Basic, 28, ... {BaseAddress=0xae0000,AllocationBase=0xae0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01138   896   NtFreeVirtualMemory  (-1, (0xae0000), 0, 32768, ... (0xae0000), 65536, ) == 0x0
 01139   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 128, ) }, ... 128, ) == 0x0
 01140   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 132, ) }, ... 132, ) == 0x0
 01141   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 136, ) }, ... 136, ) == 0x0
 01142   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 140, ) }, ... 140, ) == 0x0
 01143   896   NtQueryDefaultLocale  (1, 1242816, ... ) == 0x0
 01144   896   NtFreeVirtualMemory  (-1, (0x860000), 0, 32768, ... (0x860000), 28672, ) == 0x0
 01145   896   NtFreeVirtualMemory  (-1, (0x320147), 0, 32768, ... (0x320000), 4096, ) == 0x0
 01146   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01147   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 01148   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 01149   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 20480, 4096, 4, ... 3280896, 20480, ) == 0x0
 01150   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11403264, 1048576, ) == 0x0
 01151   896   NtAllocateVirtualMemory  (-1, 11403264, 0, 32768, 4096, 4, ... 11403264, 32768, ) == 0x0
 01152   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 144, ) }, ... 144, ) == 0x0
 01153   896   NtQueryValueKey  (144,  (144, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (144, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01154   896   NtQueryValueKey  (144,  (144, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (144, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01155   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0
 01156   896   NtOpenKey  (0x2000000, {24, 144, 0x40, 0, 0,  (0x2000000, {24, 144, 0x40, 0, 0, "Protocol_Catalog9"}, ... 152, ) }, ... 152, ) == 0x0
 01157   896   NtQueryValueKey  (152,  (152, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01158   896   NtNotifyChangeKey  (152, 148, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01159   896   NtQueryValueKey  (152,  (152, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01160   896   NtOpenKey  (0x2000000, {24, 152, 0x40, 0, 0,  (0x2000000, {24, 152, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01161   896   NtQueryValueKey  (152,  (152, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01162   896   NtQueryValueKey  (152,  (152, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01163   896   NtOpenKey  (0x2000000, {24, 152, 0x40, 0, 0,  (0x2000000, {24, 152, 0x40, 0, 0, "Catalog_Entries"}, ... 156, ) }, ... 156, ) == 0x0
 01164   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000001"}, ... 160, ) }, ... 160, ) == 0x0
 01165   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01166   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01167   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 01168   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\221\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\221\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\222\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\221\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\221\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\222\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\221\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\221\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\222\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01169   896   NtClose  (160, ... ) == 0x0
 01170   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000002"}, ... 160, ) }, ... 160, ) == 0x0
 01171   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01172   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01173   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\226\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\226\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\227\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\227\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\226\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\226\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\227\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\227\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\226\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\226\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\227\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\227\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01174   896   NtClose  (160, ... ) == 0x0
 01175   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000003"}, ... 160, ) }, ... 160, ) == 0x0
 01176   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01177   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01178   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\233\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\233\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\234\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\234\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\236\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\233\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\233\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\234\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\234\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\236\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\236\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\233\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\233\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\234\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\234\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\235\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\236\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01179   896   NtClose  (160, ... ) == 0x0
 01180   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000004"}, ... 160, ) }, ... 160, ) == 0x0
 01181   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01182   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01183   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\240\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\240\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\241\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\243\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\240\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\240\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\241\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\243\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\243\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\240\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\240\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\241\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\242\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\243\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01184   896   NtClose  (160, ... ) == 0x0
 01185   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000005"}, ... 160, ) }, ... 160, ) == 0x0
 01186   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01187   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01188   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\245\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\245\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\246\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\246\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\250\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\245\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\245\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\246\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\246\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\250\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\250\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\245\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\245\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\246\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\246\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\247\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\250\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01189   896   NtClose  (160, ... ) == 0x0
 01190   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000006"}, ... 160, ) }, ... 160, ) == 0x0
 01191   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01192   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01193   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 01194   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\253\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\253\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\254\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\254\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\253\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\253\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\254\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\254\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\253\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\253\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\254\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\254\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01195   896   NtClose  (160, ... ) == 0x0
 01196   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000007"}, ... 160, ) }, ... 160, ) == 0x0
 01197   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01198   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01199   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\260\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\260\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\261\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\261\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\260\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\260\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\261\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\261\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\260\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\260\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\261\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\261\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01200   896   NtClose  (160, ... ) == 0x0
 01201   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000008"}, ... 160, ) }, ... 160, ) == 0x0
 01202   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01203   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01204   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\265\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\265\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\266\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\266\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\270\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\265\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\265\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\266\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\266\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\270\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\270\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\265\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\265\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\266\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\266\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\267\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\270\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01205   896   NtClose  (160, ... ) == 0x0
 01206   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000009"}, ... 160, ) }, ... 160, ) == 0x0
 01207   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01208   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01209   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\272\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\272\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\273\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\273\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\275\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\272\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\272\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\273\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\273\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\275\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\275\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\272\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\272\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\273\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\273\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\274\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\275\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01210   896   NtClose  (160, ... ) == 0x0
 01211   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000010"}, ... 160, ) }, ... 160, ) == 0x0
 01212   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01213   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01214   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01215   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\300\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\300\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\301\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\301\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\300\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\300\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\301\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\301\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\300\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\300\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\301\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\301\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01216   896   NtClose  (160, ... ) == 0x0
 01217   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000011"}, ... 160, ) }, ... 160, ) == 0x0
 01218   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01219   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01220   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\305\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\305\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\306\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\306\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\305\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\305\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\306\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\306\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\305\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\305\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\306\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\306\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01221   896   NtClose  (160, ... ) == 0x0
 01222   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000012"}, ... 160, ) }, ... 160, ) == 0x0
 01223   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01224   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01225   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\312\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\312\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\313\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\313\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\315\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\312\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\312\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\313\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\313\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\315\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\315\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\312\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\312\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\313\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\313\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\314\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\315\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01226   896   NtClose  (160, ... ) == 0x0
 01227   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000013"}, ... 160, ) }, ... 160, ) == 0x0
 01228   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01229   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01230   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\317\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\317\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\320\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\320\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\322\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\317\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\317\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\320\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\320\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\322\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\322\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\317\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\317\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\320\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\320\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\321\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\322\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01231   896   NtClose  (160, ... ) == 0x0
 01232   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000014"}, ... 160, ) }, ... 160, ) == 0x0
 01233   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01234   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01235   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\324\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\324\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\325\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\325\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\327\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\324\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\324\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\325\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\325\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\327\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\327\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\324\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\324\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\325\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\325\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\326\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\327\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01236   896   NtClose  (160, ... ) == 0x0
 01237   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000015"}, ... 160, ) }, ... 160, ) == 0x0
 01238   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01239   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01240   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01241   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\332\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\332\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\333\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\333\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\335\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\332\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\332\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\333\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\333\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\335\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\335\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\332\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\332\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\333\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\333\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\334\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\335\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01242   896   NtClose  (160, ... ) == 0x0
 01243   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000016"}, ... 160, ) }, ... 160, ) == 0x0
 01244   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01245   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01246   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\337\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\337\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\340\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\340\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\337\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\337\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\340\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\340\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\337\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\337\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\340\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\340\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\341\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01247   896   NtClose  (160, ... ) == 0x0
 01248   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000017"}, ... 160, ) }, ... 160, ) == 0x0
 01249   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01250   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01251   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\344\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\344\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\345\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\345\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\344\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\344\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\345\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\345\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\344\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\344\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\345\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\345\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01252   896   NtClose  (160, ... ) == 0x0
 01253   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000018"}, ... 160, ) }, ... 160, ) == 0x0
 01254   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01255   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01256   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\351\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\351\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\352\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\352\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\351\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\351\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\352\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\352\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\351\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\351\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\352\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\352\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01257   896   NtClose  (160, ... ) == 0x0
 01258   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000019"}, ... 160, ) }, ... 160, ) == 0x0
 01259   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01260   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01261   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01262   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\357\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\357\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\360\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\360\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\362\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\357\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\357\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\360\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\360\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\362\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\362\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\357\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\357\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\360\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\360\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\361\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\362\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01263   896   NtClose  (160, ... ) == 0x0
 01264   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000020"}, ... 160, ) }, ... 160, ) == 0x0
 01265   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01266   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01267   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\364\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\364\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\365\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\365\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\364\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\364\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\365\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\365\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\364\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\364\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\365\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\365\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01268   896   NtClose  (160, ... ) == 0x0
 01269   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000021"}, ... 160, ) }, ... 160, ) == 0x0
 01270   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01271   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01272   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\371\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\371\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\372\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\372\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\371\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\371\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\372\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\372\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0 (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\371\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\371\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\372\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\234\0\0\0h\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pv\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\372\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\240\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\240\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01273   896   NtClose  (160, ... ) == 0x0
 01274   896   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "000000000022"}, ... 160, ) }, ... 160, ) == 0x0
 01275   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01276   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01277   896   NtQueryValueKey  (160,  (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\376\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\376\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\377\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\234\0\0\0\377\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\5\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\224\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\1\5\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\5\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\234\0\0\0\2\5\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\220\0\0\0\220\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0@v\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (160, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\376\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\376\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\377\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\234\0\0\0\377\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\5\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\224\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\1\5\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\5\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\234\0\0\0\2\5\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\220\0\0\0\220\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0@v\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\376\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\240\0\0\0\376\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\377\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\234\0\0\0\377\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\5\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\224\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\1\5\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\5\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\234\0\0\0\2\5\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\220\0\0\0\220\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0@v\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01278   896   NtClose  (160, ... ) == 0x0
 01279   896   NtClose  (156, ... ) == 0x0
 01280   896   NtWaitForSingleObject  (148, 0, {0, 0}, ... ) == 0x102
 01281   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 156, ) == 0x0
 01282   896   NtOpenKey  (0x2000000, {24, 144, 0x40, 0, 0,  (0x2000000, {24, 144, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 160, ) }, ... 160, ) == 0x0
 01283   896   NtQueryValueKey  (160,  (160, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01284   896   NtNotifyChangeKey  (160, 156, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01285   896   NtQueryValueKey  (160,  (160, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01286   896   NtOpenKey  (0x2000000, {24, 160, 0x40, 0, 0,  (0x2000000, {24, 160, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01287   896   NtQueryValueKey  (160,  (160, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01288   896   NtOpenKey  (0x2000000, {24, 160, 0x40, 0, 0,  (0x2000000, {24, 160, 0x40, 0, 0, "Catalog_Entries"}, ... 164, ) }, ... 164, ) == 0x0
 01289   896   NtOpenKey  (0x20019, {24, 164, 0x40, 0, 0,  (0x20019, {24, 164, 0x40, 0, 0, "000000000001"}, ... 168, ) }, ... 168, ) == 0x0
 01290   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01291   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01292   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01293   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01294   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01295   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01296   896   NtQueryValueKey  (168,  (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01297   896   NtQueryValueKey  (168,  (168, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01298   896   NtQueryValueKey  (168,  (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01299   896   NtQueryValueKey  (168,  (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01300   896   NtQueryValueKey  (168,  (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01301   896   NtQueryValueKey  (168,  (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01302   896   NtClose  (168, ... ) == 0x0
 01303   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01304   896   NtOpenKey  (0x20019, {24, 164, 0x40, 0, 0,  (0x20019, {24, 164, 0x40, 0, 0, "000000000002"}, ... 168, ) }, ... 168, ) == 0x0
 01305   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01306   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01307   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01308   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01309   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01310   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01311   896   NtQueryValueKey  (168,  (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01312   896   NtQueryValueKey  (168,  (168, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01313   896   NtQueryValueKey  (168,  (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01314   896   NtQueryValueKey  (168,  (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01315   896   NtQueryValueKey  (168,  (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01316   896   NtQueryValueKey  (168,  (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01317   896   NtClose  (168, ... ) == 0x0
 01318   896   NtOpenKey  (0x20019, {24, 164, 0x40, 0, 0,  (0x20019, {24, 164, 0x40, 0, 0, "000000000003"}, ... 168, ) }, ... 168, ) == 0x0
 01319   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01320   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01321   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01322   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01323   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01324   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01325   896   NtQueryValueKey  (168,  (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01326   896   NtQueryValueKey  (168,  (168, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01327   896   NtQueryValueKey  (168,  (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01328   896   NtQueryValueKey  (168,  (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01329   896   NtQueryValueKey  (168,  (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01330   896   NtQueryValueKey  (168,  (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01331   896   NtClose  (168, ... ) == 0x0
 01332   896   NtOpenKey  (0x20019, {24, 164, 0x40, 0, 0,  (0x20019, {24, 164, 0x40, 0, 0, "000000000004"}, ... 168, ) }, ... 168, ) == 0x0
 01333   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01334   896   NtQueryValueKey  (168,  (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01335   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01336   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01337   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01338   896   NtQueryValueKey  (168,  (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (168, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01339   896   NtQueryValueKey  (168,  (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (168, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01340   896   NtQueryValueKey  (168,  (168, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01341   896   NtQueryValueKey  (168,  (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01342   896   NtQueryValueKey  (168,  (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01343   896   NtQueryValueKey  (168,  (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01344   896   NtQueryValueKey  (168,  (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (168, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01345   896   NtClose  (168, ... ) == 0x0
 01346   896   NtClose  (164, ... ) == 0x0
 01347   896   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x102
 01348   896   NtClose  (144, ... ) == 0x0
 01349   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01350   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01351   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 144, ) }, ... 144, ) == 0x0
 01352   896   NtQueryValueKey  (144,  (144, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01353   896   NtClose  (144, ... ) == 0x0
 01354   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 144, ) == 0x0
 01355   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 01356   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241640,  (0x80100080, {24, 0, 0x40, 0, 1241640, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 164, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 164, {status=0x0, info=1}, ) == 0x0
 01357   896   NtQueryInformationFile  (164, 1242076, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01358   896   NtQueryInformationFile  (164, 1241992, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01359   896   NtQueryInformationFile  (164, 1241808, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01360   896   NtQueryInformationFile  (164, 1366440, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01361   896   NtQueryInformationFile  (164, 1240256, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01362   896   NtQueryInformationFile  (164, 1240532, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01363   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240408,  (0x40110080, {24, 0, 0x40, 0, 1240408, "\??\C:\WINDOWS\lsasss.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01364   896   NtClose  (-2147481368, ... ) == 0x0
 01363   896   NtCreateFile  ... 168, {status=0x0, info=2}, ) == 0x0
 01365   896   NtQueryVolumeInformationFile  (168, 1240560, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01366   896   NtQueryInformationFile  (168, 1240144, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01367   896   NtQueryVolumeInformationFile  (164, 1240560, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01368   896   NtQueryVolumeInformationFile  (164, 1239904, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01369   896   NtSetInformationFile  (168, 1240460, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01370   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 164, ... 172, ) == 0x0
 01371   896   NtMapViewOfSection  (172, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbe0000), {0, 0}, 147456, ) == 0x0
 01372   896   NtClose  (172, ... ) == 0x0
 01373   896   NtWriteFile  (168, 0, 0, 0,  (168, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0i8\366\222-Y\230\301-Y\230\301-Y\230\301\256Q\305\301/Y\230\301-Y\230\301.Y\230\301\305F\222\3017Y\230\301\256E\226\301&Y\230\301-Y\231\301}Y\230\301OF\213\301$Y\230\301\305F\223\301)Y\230\301Rich-Y\230\301\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\2\0\240\240\240\240\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0.)\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\320\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\24\200\0\0\212\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0p\0\0\0\20\0\0\02\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\0\0\0.)\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\320\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\24\200\0\0\212\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0p\0\0\0\20\0\0\02\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01374   896   NtWriteFile  (168, 0, 0, 0,  (168, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01375   896   NtWriteFile  (168, 0, 0, 0,  (168, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24576, 0x0, 0, ... {status=0x0, info=24576}, ) , 24576, 0x0, 0, ... {status=0x0, info=24576}, ) == 0x0
 01376   896   NtUnmapViewOfSection  (-1, 0xbe0000, ... ) == 0x0
 01377   896   NtSetInformationFile  (168, 1241808, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01378   896   NtClose  (164, ... ) == 0x0
 01379   896   NtClose  (168, ... ) == 0x0
 01380   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 168, ) }, ... 168, ) == 0x0
 01381   896   NtSetValueKey  (168,  (168, "lsasss.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0l\0s\0a\0s\0s\0s\0.\0e\0x\0e\0\0\0", 44, ... , 0, 1,  (168, "lsasss.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0l\0s\0a\0s\0s\0s\0.\0e\0x\0e\0\0\0", 44, ... , 44, ...
 01382   896   NtSetInformationFile  (-2147482448, -135747792, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01383   896   NtSetInformationFile  (-2147482448, -135747884, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01384   896   NtSetInformationFile  (-2147482448, -135748192, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01385   896   NtSetInformationFile  (-2147482448, -135748288, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01381   896   NtSetValueKey  ... ) == 0x0
 01386   896   NtClose  (168, ... ) == 0x0
 01387   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 168, ) }, ... 168, ) == 0x0
 01388   896   NtDeleteValueKey  (168,  (168, "ssgrate.exe", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01389   896   NtClose  (168, ... ) == 0x0
 01390   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 168, ) }, ... 168, ) == 0x0
 01391   896   NtDeleteValueKey  (168,  (168, "drvsys.exe", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392   896   NtClose  (168, ... ) == 0x0
 01393   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 168, ) }, ... 168, ) == 0x0
 01394   896   NtDeleteValueKey  (168,  (168, "Drvddll_exe", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01395   896   NtClose  (168, ... ) == 0x0
 01396   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "SkynetNotice"}, 0, ... 168, ) }, 0, ... 168, ) == 0x0
 01397   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 12451840, 1048576, ) == 0x0
 01398   896   NtAllocateVirtualMemory  (-1, 13492224, 0, 8192, 4096, 4, ... 13492224, 8192, ) == 0x0
 01399   896   NtProtectVirtualMemory  (-1, (0xcde000), 4096, 260, ... (0xcde000), 4096, 4, ) == 0x0
 01400   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 164, {1252, 420}, ) == 0x0
 01401   896   NtQueryInformationThread  (164, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=420,}, 0x0, ) == 0x0
 01402   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\244\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\0\0\0\344\4\0\0\244\1\0\0" )  ) == 0x0
 01403   896   NtResumeThread  (164, ... 1, ) == 0x0
 01404   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13500416, 1048576, ) == 0x0
 01405   896   NtAllocateVirtualMemory  (-1, 14540800, 0, 8192, 4096, 4, ... 14540800, 8192, ) == 0x0
 01406   420   NtTestAlert  (... ) == 0x0
 01407   420   NtContinue  (13499696, 1, ...
 01408   420   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01409   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 172, ) == 0x0
 01410   420   NtWaitForSingleObject  (148, 0, {0, 0}, ... ) == 0x102
 01411   420   NtAllocateVirtualMemory  (-1, 13488128, 0, 4096, 4096, 260, ...
 01412   896   NtProtectVirtualMemory  (-1, (0xdde000), 4096, 260, ... (0xdde000), 4096, 4, ) == 0x0
 01413   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 176, {1252, 384}, ) == 0x0
 01414   896   NtQueryInformationThread  (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 01415   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 01416   896   NtResumeThread  (176, ... 1, ) == 0x0
 01417   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01411   420   NtAllocateVirtualMemory  ... 13488128, 4096, ) == 0x0
 01418   384   NtWaitForSingleObject  (92, 0, 0x0, ...
 01419   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 13496820, ... ) }, 13496820, ... ) == 0x0
 01420   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 180, {status=0x0, info=1}, ) }, 5, 96, ... 180, {status=0x0, info=1}, ) == 0x0
 01421   420   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 180, ... 184, ) == 0x0
 01422   420   NtClose  (180, ... ) == 0x0
 01423   420   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xde0000), 0x0, 245760, ) == 0x0
 01424   420   NtClose  (184, ...
 01417   896   NtAllocateVirtualMemory  ... 14811136, 1048576, ) == 0x0
 01425   896   NtAllocateVirtualMemory  (-1, 15851520, 0, 8192, 4096, 4, ... 15851520, 8192, ) == 0x0
 01426   896   NtProtectVirtualMemory  (-1, (0xf1e000), 4096, 260, ... (0xf1e000), 4096, 4, ) == 0x0
 01427   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 180, {1252, 1028}, ) == 0x0
 01428   896   NtQueryInformationThread  (180, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 01429   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\4\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 01424   420   NtClose  ... ) == 0x0
 01430   896   NtResumeThread  (180, ... 1, ) == 0x0
 01431   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15859712, 1048576, ) == 0x0
 01432   896   NtAllocateVirtualMemory  (-1, 16900096, 0, 8192, 4096, 4, ... 16900096, 8192, ) == 0x0
 01433   420   NtUnmapViewOfSection  (-1, 0xde0000, ...
 01434  1028   NtWaitForSingleObject  (92, 0, 0x0, ...
 01433   420   NtUnmapViewOfSection  ... ) == 0x0
 01435   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 13497128, ... ) }, 13497128, ... ) == 0x0
 01436   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 184, {status=0x0, info=1}, ) }, 5, 96, ... 184, {status=0x0, info=1}, ) == 0x0
 01437   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 184, ... 188, ) == 0x0
 01438   420   NtQuerySection  (188, Image, 48, ...
 01439   896   NtProtectVirtualMemory  (-1, (0x101e000), 4096, 260, ... (0x101e000), 4096, 4, ) == 0x0
 01440   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 192, {1252, 2012}, ) == 0x0
 01441   896   NtQueryInformationThread  (192, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 01442   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\334\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\0\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 01443   896   NtResumeThread  (192, ... 1, ) == 0x0
 01444   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01438   420   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01445  2012   NtWaitForSingleObject  (92, 0, 0x0, ...
 01446   420   NtClose  (184, ... ) == 0x0
 01447   420   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 01448   420   NtClose  (188, ... ) == 0x0
 01449   420   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01450   420   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ...
 01444   896   NtAllocateVirtualMemory  ... 16908288, 1048576, ) == 0x0
 01451   896   NtAllocateVirtualMemory  (-1, 17948672, 0, 8192, 4096, 4, ... 17948672, 8192, ) == 0x0
 01452   896   NtProtectVirtualMemory  (-1, (0x111e000), 4096, 260, ... (0x111e000), 4096, 4, ) == 0x0
 01453   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 188, {1252, 1168}, ) == 0x0
 01454   896   NtQueryInformationThread  (188, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 01455   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\220\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 01450   420   NtProtectVirtualMemory  ... (0x71a51000), 4096, 4, ) == 0x0
 01456   420   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01457   420   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01458   420   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01459   420   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01460   420   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01461   420   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ...
 01462   896   NtResumeThread  (188, ... 1, ) == 0x0
 01463   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17956864, 1048576, ) == 0x0
 01464   896   NtAllocateVirtualMemory  (-1, 18997248, 0, 8192, 4096, 4, ... 18997248, 8192, ) == 0x0
 01465   896   NtProtectVirtualMemory  (-1, (0x121e000), 4096, 260, ... (0x121e000), 4096, 4, ) == 0x0
 01466   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 184, {1252, 1180}, ) == 0x0
 01467   896   NtQueryInformationThread  (184, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 01461   420   NtProtectVirtualMemory  ... (0x71a51000), 4096, 4, ) == 0x0
 01468  1168   NtWaitForSingleObject  (92, 0, 0x0, ...
 01469   420   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01470   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\234\4\0\0" ...  ...
 01471   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01472   420   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01473   420   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01474   420   NtSetEventBoostPriority  (92, ...
 01470   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 01475   896   NtResumeThread  (184, ... 1, ) == 0x0
 01476   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19005440, 1048576, ) == 0x0
 01477   896   NtAllocateVirtualMemory  (-1, 20045824, 0, 8192, 4096, 4, ... 20045824, 8192, ) == 0x0
 01478   896   NtProtectVirtualMemory  (-1, (0x131e000), 4096, 260, ... (0x131e000), 4096, 4, ) == 0x0
 01479   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01418   384   NtWaitForSingleObject  ... ) == 0x0
 01474   420   NtSetEventBoostPriority  ... ) == 0x0
 01480  1180   NtWaitForSingleObject  (92, 0, 0x0, ...
 01481   384   NtSetEventBoostPriority  (92, ...
 01482   420   NtWaitForSingleObject  (92, 0, 0x0, ...
 01434  1028   NtWaitForSingleObject  ... ) == 0x0
 01481   384   NtSetEventBoostPriority  ... ) == 0x0
 01483  1028   NtSetEventBoostPriority  (92, ...
 01479   896   NtCreateThread  ... 196, {1252, 928}, ) == 0x0
 01445  2012   NtWaitForSingleObject  ... ) == 0x0
 01483  1028   NtSetEventBoostPriority  ... ) == 0x0
 01484  2012   NtSetEventBoostPriority  (92, ...
 01485   896   NtQueryInformationThread  (196, Basic, 28, ...
 01486   384   NtTestAlert  (...
 01468  1168   NtWaitForSingleObject  ... ) == 0x0
 01484  2012   NtSetEventBoostPriority  ... ) == 0x0
 01485   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 01487  1168   NtSetEventBoostPriority  (92, ...
 01486   384   NtTestAlert  ... ) == 0x0
 01488  1028   NtTestAlert  (...
 01480  1180   NtWaitForSingleObject  ... ) == 0x0
 01487  1168   NtSetEventBoostPriority  ... ) == 0x0
 01489   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\240\3\0\0" ...  ...
 01490   384   NtContinue  (14548272, 1, ...
 01491  1180   NtSetEventBoostPriority  (92, ...
 01488  1028   NtTestAlert  ... ) == 0x0
 01492  2012   NtTestAlert  (...
 01489   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81847, 0}  ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 01482   420   NtWaitForSingleObject  ... ) == 0x0
 01491  1180   NtSetEventBoostPriority  ... ) == 0x0
 01493   384   NtRegisterThreadTerminatePort  (24, ...
 01494  1028   NtContinue  (15858992, 1, ...
 01492  2012   NtTestAlert  ... ) == 0x0
 01495  1168   NtTestAlert  (...
 01496   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01497   896   NtResumeThread  (196, ...
 01493   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 01498  1028   NtRegisterThreadTerminatePort  (24, ...
 01499  2012   NtContinue  (16907568, 1, ...
 01496   420   NtCreateEvent  ... 200, ) == 0x0
 01495  1168   NtTestAlert  ... ) == 0x0
 01497   896   NtResumeThread  ... 1, ) == 0x0
 01500   384   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01498  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 01501  2012   NtRegisterThreadTerminatePort  (24, ...
 01502  1180   NtTestAlert  (...
 01503   928   NtTestAlert  (...
 01504  1168   NtContinue  (17956144, 1, ...
 01505   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01506   420   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 01507  1028   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01501  2012   NtRegisterThreadTerminatePort  ... ) == 0x0
 01502  1180   NtTestAlert  ... ) == 0x0
 01503   928   NtTestAlert  ... ) == 0x0
 01508  1168   NtRegisterThreadTerminatePort  (24, ...
 01505   896   NtAllocateVirtualMemory  ... 20054016, 1048576, ) == 0x0
 01506   420   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01509  2012   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01510  1180   NtContinue  (19004720, 1, ...
 01511   928   NtContinue  (20053296, 1, ...
 01508  1168   NtRegisterThreadTerminatePort  ... ) == 0x0
 01512   896   NtAllocateVirtualMemory  (-1, 21094400, 0, 8192, 4096, 4, ...
 01513   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 13496740, ... }, 13496740, ...
 01514  1180   NtRegisterThreadTerminatePort  (24, ...
 01515   928   NtRegisterThreadTerminatePort  (24, ...
 01516  1168   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01512   896   NtAllocateVirtualMemory  ... 21094400, 8192, ) == 0x0
 01514  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 01515   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 01517  1180   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01518   896   NtProtectVirtualMemory  (-1, (0x141e000), 4096, 260, ...
 01519   928   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01518   896   NtProtectVirtualMemory  ... (0x141e000), 4096, 4, ) == 0x0
 01520   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 204, {1252, 428}, ) == 0x0
 01521   896   NtQueryInformationThread  (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 01522   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 01523   896   NtResumeThread  (204, ... 1, ) == 0x0
 01524   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01519   928   NtSetInformationThread  ... ) == 0x0
 01525   428   NtWaitForSingleObject  (92, 0, 0x0, ...
 01524   896   NtAllocateVirtualMemory  ... 21102592, 1048576, ) == 0x0
 01526   896   NtAllocateVirtualMemory  (-1, 22142976, 0, 8192, 4096, 4, ... 22142976, 8192, ) == 0x0
 01527   896   NtProtectVirtualMemory  (-1, (0x151e000), 4096, 260, ... (0x151e000), 4096, 4, ) == 0x0
 01528   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 208, {1252, 1732}, ) == 0x0
 01529   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 01530   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\304\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 01531   928   NtQueryValueKey  (96,  (96, "FromCacheTimeout", Partial, 144, ... , Partial, 144, ...
 01532   896   NtResumeThread  (208, ...
 01513   420   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01532   896   NtResumeThread  ... 1, ) == 0x0
 01533   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 13496740, ... }, 13496740, ...
 01534   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01533   420   NtQueryAttributesFile  ... ) == 0x0
 01534   896   NtAllocateVirtualMemory  ... 22151168, 1048576, ) == 0x0
 01535   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... }, 5, 96, ...
 01536   896   NtAllocateVirtualMemory  (-1, 23191552, 0, 8192, 4096, 4, ...
 01535   420   NtOpenFile  ... 212, {status=0x0, info=1}, ) == 0x0
 01536   896   NtAllocateVirtualMemory  ... 23191552, 8192, ) == 0x0
 01537   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 212, ...
 01531   928   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01538  1732   NtWaitForSingleObject  (92, 0, 0x0, ...
 01539   896   NtProtectVirtualMemory  (-1, (0x161e000), 4096, 260, ...
 01537   420   NtCreateSection  ... 216, ) == 0x0
 01539   896   NtProtectVirtualMemory  ... (0x161e000), 4096, 4, ) == 0x0
 01540   420   NtQuerySection  (216, Image, 48, ...
 01541   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01540   420   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01541   896   NtCreateThread  ... 220, {1252, 748}, ) == 0x0
 01542   420   NtClose  (212, ...
 01543   896   NtQueryInformationThread  (220, Basic, 28, ...
 01542   420   NtClose  ... ) == 0x0
 01543   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 01544   420   NtMapViewOfSection  (216, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01545   928   NtQueryValueKey  (96,  (96, "SecureProtocols", Partial, 144, ... , Partial, 144, ...
 01546   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0\344\4\0\0\354\2\0\0" ...  ...
 01544   420   NtMapViewOfSection  ... (0x662b0000), 0x0, 360448, ) == 0x0
 01546   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81850, 0}  ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 01547   420   NtClose  (216, ...
 01548   896   NtResumeThread  (220, ...
 01547   420   NtClose  ... ) == 0x0
 01548   896   NtResumeThread  ... 1, ) == 0x0
 01549   420   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01550   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01549   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01545   928   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) }, 16, ) == 0x0
 01551   748   NtWaitForSingleObject  (92, 0, 0x0, ...
 01552   420   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01550   896   NtAllocateVirtualMemory  ... 23199744, 1048576, ) == 0x0
 01553   928   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies"}, ... }, ...
 01554   896   NtAllocateVirtualMemory  (-1, 24240128, 0, 8192, 4096, 4, ...
 01552   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01500   384   NtSetInformationThread  ... ) == 0x0
 01507  1028   NtSetInformationThread  ... ) == 0x0
 01509  2012   NtSetInformationThread  ... ) == 0x0
 01516  1168   NtSetInformationThread  ... ) == 0x0
 01517  1180   NtSetInformationThread  ... ) == 0x0
 01554   896   NtAllocateVirtualMemory  ... 24240128, 8192, ) == 0x0
 01555   420   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 01556   384   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01557  1028   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01558  2012   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01559  1168   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01560   896   NtProtectVirtualMemory  (-1, (0x171e000), 4096, 260, ...
 01555   420   NtFlushInstructionCache  ... ) == 0x0
 01561  1180   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01556   384   NtCreateEvent  ... 216, ) == 0x0
 01557  1028   NtCreateEvent  ... 212, ) == 0x0
 01558  2012   NtCreateEvent  ... 224, ) == 0x0
 01560   896   NtProtectVirtualMemory  ... (0x171e000), 4096, 4, ) == 0x0
 01562   420   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01559  1168   NtCreateEvent  ... 228, ) == 0x0
 01561  1180   NtCreateEvent  ... 232, ) == 0x0
 01563   384   NtWaitForSingleObject  (216, 0, 0x0, ...
 01564  1028   NtClose  (212, ...
 01565   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01562   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01566  2012   NtClose  (224, ...
 01567  1168   NtClose  (228, ...
 01568  1180   NtClose  (232, ...
 01564  1028   NtClose  ... ) == 0x0
 01569   420   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01565   896   NtCreateThread  ... 212, {1252, 900}, ) == 0x0
 01566  2012   NtClose  ... ) == 0x0
 01567  1168   NtClose  ... ) == 0x0
 01568  1180   NtClose  ... ) == 0x0
 01570  1028   NtWaitForSingleObject  (216, 0, 0x0, ...
 01571   896   NtQueryInformationThread  (212, Basic, 28, ...
 01569   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01572  2012   NtWaitForSingleObject  (216, 0, 0x0, ...
 01573  1168   NtWaitForSingleObject  (216, 0, 0x0, ...
 01574  1180   NtWaitForSingleObject  (216, 0, 0x0, ...
 01553   928   NtOpenKey  ... 232, ) == 0x0
 01571   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 01575   420   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 01576   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\204\3\0\0" ...  ...
 01575   420   NtFlushInstructionCache  ... ) == 0x0
 01576   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81851, 0}  ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 01577   420   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01578   928   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software\Policies"}, ... }, ...
 01577   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01579   896   NtResumeThread  (212, ...
 01580   420   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01579   896   NtResumeThread  ... 1, ) == 0x0
 01578   928   NtOpenKey  ... 228, ) == 0x0
 01581   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01580   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01582   900   NtWaitForSingleObject  (92, 0, 0x0, ...
 01581   896   NtAllocateVirtualMemory  ... 24248320, 1048576, ) == 0x0
 01583   420   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 01584   896   NtAllocateVirtualMemory  (-1, 25288704, 0, 8192, 4096, 4, ...
 01583   420   NtFlushInstructionCache  ... ) == 0x0
 01584   896   NtAllocateVirtualMemory  ... 25288704, 8192, ) == 0x0
 01585   420   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01586   928   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software"}, ... }, ...
 01585   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01587   896   NtProtectVirtualMemory  (-1, (0x181e000), 4096, 260, ...
 01588   420   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01587   896   NtProtectVirtualMemory  ... (0x181e000), 4096, 4, ) == 0x0
 01586   928   NtOpenKey  ... 224, ) == 0x0
 01589   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01588   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01589   896   NtCreateThread  ... 236, {1252, 1388}, ) == 0x0
 01590   420   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 01591   896   NtQueryInformationThread  (236, Basic, 28, ...
 01590   420   NtFlushInstructionCache  ... ) == 0x0
 01591   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 01592   420   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01593   928   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software"}, ... }, ...
 01592   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01594   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0l\5\0\0" ...  ...
 01595   420   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01594   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81852, 0}  ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 01596   896   NtResumeThread  (236, ... 1, ) == 0x0
 01597   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25296896, 1048576, ) == 0x0
 01598   896   NtAllocateVirtualMemory  (-1, 26337280, 0, 8192, 4096, 4, ... 26337280, 8192, ) == 0x0
 01599   896   NtProtectVirtualMemory  (-1, (0x191e000), 4096, 260, ... (0x191e000), 4096, 4, ) == 0x0
 01600   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01595   420   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01601  1388   NtWaitForSingleObject  (92, 0, 0x0, ...
 01602   420   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01603   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01604   420   NtSetEventBoostPriority  (92, ...
 01525   428   NtWaitForSingleObject  ... ) == 0x0
 01605   428   NtSetEventBoostPriority  (92, ...
 01538  1732   NtWaitForSingleObject  ... ) == 0x0
 01606  1732   NtSetEventBoostPriority  (92, ...
 01551   748   NtWaitForSingleObject  ... ) == 0x0
 01607   748   NtSetEventBoostPriority  (92, ...
 01582   900   NtWaitForSingleObject  ... ) == 0x0
 01608   900   NtSetEventBoostPriority  (92, ...
 01601  1388   NtWaitForSingleObject  ... ) == 0x0
 01609  1388   NtTestAlert  (... ) == 0x0
 01608   900   NtSetEventBoostPriority  ... ) == 0x0
 01607   748   NtSetEventBoostPriority  ... ) == 0x0
 01606  1732   NtSetEventBoostPriority  ... ) == 0x0
 01605   428   NtSetEventBoostPriority  ... ) == 0x0
 01604   420   NtSetEventBoostPriority  ... ) == 0x0
 01600   896   NtCreateThread  ... 240, {1252, 2036}, ) == 0x0
 01610  1388   NtContinue  (25296176, 1, ...
 01611   900   NtTestAlert  (...
 01612   748   NtTestAlert  (...
 01613  1732   NtTestAlert  (...
 01614   420   NtQuerySystemInformation  (Basic, 44, ...
 01615   896   NtQueryInformationThread  (240, Basic, 28, ...
 01616  1388   NtRegisterThreadTerminatePort  (24, ...
 01611   900   NtTestAlert  ... ) == 0x0
 01612   748   NtTestAlert  ... ) == 0x0
 01613  1732   NtTestAlert  ... ) == 0x0
 01614   420   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01615   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 01616  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 01617   900   NtContinue  (24247600, 1, ...
 01618   748   NtContinue  (23199024, 1, ...
 01619  1732   NtContinue  (22150448, 1, ...
 01620   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... }, ...
 01621   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\364\7\0\0" ...  ...
 01622  1388   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01623   900   NtRegisterThreadTerminatePort  (24, ...
 01624   748   NtRegisterThreadTerminatePort  (24, ...
 01625  1732   NtRegisterThreadTerminatePort  (24, ...
 01620   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01621   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 01623   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 01624   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 01625  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 01626   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... }, ...
 01627   428   NtTestAlert  (...
 01622  1388   NtSetInformationThread  ... ) == 0x0
 01628   900   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01629   748   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01630  1732   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01631   896   NtResumeThread  (240, ...
 01627   428   NtTestAlert  ... ) == 0x0
 01626   420   NtOpenKey  ... 244, ) == 0x0
 01632  1388   NtWaitForSingleObject  (216, 0, 0x0, ...
 01631   896   NtResumeThread  ... 1, ) == 0x0
 01633   428   NtContinue  (21101872, 1, ...
 01634   420   NtQueryValueKey  (244,  (244, "MaxRpcSize", Partial, 144, ... , Partial, 144, ...
 01635  2036   NtTestAlert  (...
 01636   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01637   428   NtRegisterThreadTerminatePort  (24, ...
 01634   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01635  2036   NtTestAlert  ... ) == 0x0
 01636   896   NtAllocateVirtualMemory  ... 26345472, 1048576, ) == 0x0
 01637   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 01638   420   NtClose  (244, ...
 01639  2036   NtContinue  (26344752, 1, ...
 01640   896   NtAllocateVirtualMemory  (-1, 27385856, 0, 8192, 4096, 4, ...
 01641   428   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01638   420   NtClose  ... ) == 0x0
 01642  2036   NtRegisterThreadTerminatePort  (24, ...
 01640   896   NtAllocateVirtualMemory  ... 27385856, 8192, ) == 0x0
 01643   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... }, ...
 01642  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01644   896   NtProtectVirtualMemory  (-1, (0x1a1e000), 4096, 260, ...
 01643   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01644   896   NtProtectVirtualMemory  ... (0x1a1e000), 4096, 4, ) == 0x0
 01645   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01646   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01645   420   NtCreateEvent  ... 244, ) == 0x0
 01646   896   NtCreateThread  ... 248, {1252, 1372}, ) == 0x0
 01647   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01648   896   NtQueryInformationThread  (248, Basic, 28, ...
 01647   420   NtCreateEvent  ... 252, ) == 0x0
 01648   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 01649   420   NtQuerySystemTime  (...
 01650  2036   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01651   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 01652   896   NtResumeThread  (248, ... 1, ) == 0x0
 01653   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27394048, 1048576, ) == 0x0
 01654   896   NtAllocateVirtualMemory  (-1, 28434432, 0, 8192, 4096, 4, ... 28434432, 8192, ) == 0x0
 01655   896   NtProtectVirtualMemory  (-1, (0x1b1e000), 4096, 260, ... (0x1b1e000), 4096, 4, ) == 0x0
 01656   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01649   420   NtQuerySystemTime  ... {1420079164, 29929616}, ) == 0x0
 01650  2036   NtSetInformationThread  ... ) == 0x0
 01657  1372   NtTestAlert  (...
 01658   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01656   896   NtCreateThread  ... 256, {1252, 1600}, ) == 0x0
 01657  1372   NtTestAlert  ... ) == 0x0
 01658   420   NtCreateEvent  ... 260, ) == 0x0
 01659   896   NtQueryInformationThread  (256, Basic, 28, ...
 01660  1372   NtContinue  (27393328, 1, ...
 01661   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... }, ...
 01659   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 01662  1372   NtRegisterThreadTerminatePort  (24, ...
 01661   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01663   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0@\6\0\0" ...  ...
 01662  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 01664   420   NtQuerySystemInformation  (Performance, 312, ...
 01663   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81855, 0}  ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 01665  2036   NtWaitForSingleObject  (216, 0, 0x0, ...
 01666  1372   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01664   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01667   896   NtResumeThread  (256, ...
 01668   420   NtQueryInformationProcess  (-1, QuotaLimits, 32, ...
 01667   896   NtResumeThread  ... 1, ) == 0x0
 01668   420   NtQueryInformationProcess  ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01669   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01670   420   NtQueryInformationProcess  (-1, VmCounters, 44, ...
 01669   896   NtAllocateVirtualMemory  ... 28442624, 1048576, ) == 0x0
 01670   420   NtQueryInformationProcess  ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01671   896   NtAllocateVirtualMemory  (-1, 29483008, 0, 8192, 4096, 4, ...
 01672   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01671   896   NtAllocateVirtualMemory  ... 29483008, 8192, ) == 0x0
 01666  1372   NtSetInformationThread  ... ) == 0x0
 01673  1600   NtTestAlert  (...
 01672   420   NtCreateEvent  ... 264, ) == 0x0
 01674   896   NtProtectVirtualMemory  (-1, (0x1c1e000), 4096, 260, ...
 01673  1600   NtTestAlert  ... ) == 0x0
 01675   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01674   896   NtProtectVirtualMemory  ... (0x1c1e000), 4096, 4, ) == 0x0
 01676  1600   NtContinue  (28441904, 1, ...
 01675   420   NtDuplicateObject  ... 268, ) == 0x0
 01677   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01678  1600   NtRegisterThreadTerminatePort  (24, ...
 01679   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01677   896   NtCreateThread  ... 272, {1252, 1948}, ) == 0x0
 01678  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 01679   420   NtOpenKey  ... 276, ) == 0x0
 01680   896   NtQueryInformationThread  (272, Basic, 28, ...
 01681  1372   NtWaitForSingleObject  (216, 0, 0x0, ...
 01682   420   NtQueryValueKey  (276,  (276, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01680   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 01683  1600   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01682   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01684   420   NtClose  (276, ... ) == 0x0
 01685   420   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01686   420   NtOpenThreadToken  (-2, 0x20008, 1, ... ) == STATUS_NO_TOKEN
 01687   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 13496432, ... ) }, 13496432, ... ) == 0x0
 01688   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... 276, ) }, ... 276, ) == 0x0
 01689   420   NtQueryValueKey  (276,  (276, "Transports", Partial, 144, ... , Partial, 144, ...
 01690   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0\234\7\0\0" ...  ...
 01683  1600   NtSetInformationThread  ... ) == 0x0
 01690   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81856, 0}  ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 01689   420   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01691   896   NtResumeThread  (272, ...
 01692   420   NtQueryValueKey  (276,  (276, "Transports", Partial, 144, ... , Partial, 144, ...
 01691   896   NtResumeThread  ... 1, ) == 0x0
 01692   420   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01693   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01694   420   NtClose  (276, ...
 01695  1600   NtWaitForSingleObject  (216, 0, 0x0, ...
 01696  1948   NtTestAlert  (...
 01694   420   NtClose  ... ) == 0x0
 01693   896   NtAllocateVirtualMemory  ... 29491200, 1048576, ) == 0x0
 01696  1948   NtTestAlert  ... ) == 0x0
 01697   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01698   896   NtAllocateVirtualMemory  (-1, 30531584, 0, 8192, 4096, 4, ...
 01699  1948   NtContinue  (29490480, 1, ...
 01698   896   NtAllocateVirtualMemory  ... 30531584, 8192, ) == 0x0
 01700  1948   NtRegisterThreadTerminatePort  (24, ...
 01701   896   NtProtectVirtualMemory  (-1, (0x1d1e000), 4096, 260, ...
 01700  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01701   896   NtProtectVirtualMemory  ... (0x1d1e000), 4096, 4, ) == 0x0
 01697   420   NtOpenKey  ... 276, ) == 0x0
 01702   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01703   420   NtQueryValueKey  (276,  (276, "Mapping", Partial, 144, ... , Partial, 144, ...
 01704  1948   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01703   420   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01705   420   NtQueryValueKey  (276,  (276, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01706   420   NtQueryValueKey  (276,  (276, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) , Partial, 152, ... TitleIdx=0, Type=3, Data= (276, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01707   420   NtClose  (276, ... ) == 0x0
 01708   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 276, ) }, ... 276, ) == 0x0
 01709   420   NtQueryValueKey  (276,  (276, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01702   896   NtCreateThread  ... 280, {1252, 252}, ) == 0x0
 01704  1948   NtSetInformationThread  ... ) == 0x0
 01710   896   NtQueryInformationThread  (280, Basic, 28, ...
 01709   420   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01710   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 01711   420   NtQueryValueKey  (276,  (276, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01712   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\1\0\0\344\4\0\0\374\0\0\0" ...  ...
 01711   420   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01712   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81857, 0}  ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\1\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 01713   420   NtQueryValueKey  (276,  (276, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 01714  1948   NtWaitForSingleObject  (216, 0, 0x0, ...
 01713   420   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01715   896   NtResumeThread  (280, ...
 01716   420   NtQueryValueKey  (276,  (276, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01715   896   NtResumeThread  ... 1, ) == 0x0
 01716   420   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01717   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01718   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 13497388, ... }, 13497388, ...
 01717   896   NtAllocateVirtualMemory  ... 30539776, 1048576, ) == 0x0
 01718   420   NtQueryAttributesFile  ... ) == 0x0
 01719   896   NtAllocateVirtualMemory  (-1, 31580160, 0, 8192, 4096, 4, ...
 01720   252   NtWaitForSingleObject  (92, 0, 0x0, ...
 01719   896   NtAllocateVirtualMemory  ... 31580160, 8192, ) == 0x0
 01721   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 284, {status=0x0, info=1}, ) }, 5, 96, ... 284, {status=0x0, info=1}, ) == 0x0
 01722   420   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 284, ... 288, ) == 0x0
 01723   420   NtClose  (284, ... ) == 0x0
 01724   420   NtMapViewOfSection  (288, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x860000), 0x0, 20480, ) == 0x0
 01725   420   NtClose  (288, ... ) == 0x0
 01726   896   NtProtectVirtualMemory  (-1, (0x1e1e000), 4096, 260, ... (0x1e1e000), 4096, 4, ) == 0x0
 01727   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 288, {1252, 1300}, ) == 0x0
 01728   896   NtQueryInformationThread  (288, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 01729   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\24\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 01730   896   NtResumeThread  (288, ... 1, ) == 0x0
 01731   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01732   420   NtUnmapViewOfSection  (-1, 0x860000, ...
 01733  1300   NtWaitForSingleObject  (92, 0, 0x0, ...
 01732   420   NtUnmapViewOfSection  ... ) == 0x0
 01734   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 13497696, ... ) }, 13497696, ... ) == 0x0
 01735   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 284, {status=0x0, info=1}, ) }, 5, 96, ... 284, {status=0x0, info=1}, ) == 0x0
 01736   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 284, ... 292, ) == 0x0
 01737   420   NtQuerySection  (292, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01738   420   NtClose  (284, ... ) == 0x0
 01731   896   NtAllocateVirtualMemory  ... 31588352, 1048576, ) == 0x0
 01739   896   NtAllocateVirtualMemory  (-1, 32628736, 0, 8192, 4096, 4, ... 32628736, 8192, ) == 0x0
 01740   896   NtProtectVirtualMemory  (-1, (0x1f1e000), 4096, 260, ... (0x1f1e000), 4096, 4, ) == 0x0
 01741   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 284, {1252, 1096}, ) == 0x0
 01742   896   NtQueryInformationThread  (284, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 01743   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0H\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 01744   420   NtMapViewOfSection  (292, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01745   420   NtClose  (292, ... ) == 0x0
 01746   420   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ... (0x71a91000), 4096, 32, ) == 0x0
 01747   420   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 01748   420   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 01749   896   NtResumeThread  (284, ... 1, ) == 0x0
 01750   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32636928, 1048576, ) == 0x0
 01751   896   NtAllocateVirtualMemory  (-1, 33677312, 0, 8192, 4096, 4, ... 33677312, 8192, ) == 0x0
 01752   896   NtProtectVirtualMemory  (-1, (0x201e000), 4096, 260, ... (0x201e000), 4096, 4, ) == 0x0
 01753   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 292, {1252, 1708}, ) == 0x0
 01754   896   NtQueryInformationThread  (292, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 01755   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... }, ...
 01756  1096   NtWaitForSingleObject  (92, 0, 0x0, ...
 01755   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01757   420   NtSetEventBoostPriority  (92, ...
 01720   252   NtWaitForSingleObject  ... ) == 0x0
 01758   252   NtSetEventBoostPriority  (92, ...
 01733  1300   NtWaitForSingleObject  ... ) == 0x0
 01759  1300   NtSetEventBoostPriority  (92, ...
 01756  1096   NtWaitForSingleObject  ... ) == 0x0
 01760  1096   NtTestAlert  (... ) == 0x0
 01759  1300   NtSetEventBoostPriority  ... ) == 0x0
 01758   252   NtSetEventBoostPriority  ... ) == 0x0
 01757   420   NtSetEventBoostPriority  ... ) == 0x0
 01761   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\1\0\0\344\4\0\0\254\6\0\0" ...  ...
 01762  1096   NtContinue  (32636208, 1, ...
 01763  1300   NtTestAlert  (...
 01764   252   NtTestAlert  (...
 01761   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81860, 0}  ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\1\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 01765  1096   NtRegisterThreadTerminatePort  (24, ...
 01763  1300   NtTestAlert  ... ) == 0x0
 01764   252   NtTestAlert  ... ) == 0x0
 01766   896   NtResumeThread  (292, ...
 01765  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 01767  1300   NtContinue  (31587632, 1, ...
 01768   252   NtContinue  (30539056, 1, ...
 01766   896   NtResumeThread  ... 1, ) == 0x0
 01769  1096   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01770  1300   NtRegisterThreadTerminatePort  (24, ...
 01771   252   NtRegisterThreadTerminatePort  (24, ...
 01772   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01770  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 01771   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 01773   420   NtClose  (276, ...
 01774  1708   NtAllocateVirtualMemory  (-1, 8867840, 0, 4096, 4096, 4, ...
 01769  1096   NtSetInformationThread  ... ) == 0x0
 01775  1300   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01776   252   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01773   420   NtClose  ... ) == 0x0
 01774  1708   NtAllocateVirtualMemory  ... 8867840, 4096, ) == 0x0
 01772   896   NtAllocateVirtualMemory  ... 33685504, 1048576, ) == 0x0
 01777  1096   NtWaitForSingleObject  (216, 0, 0x0, ...
 01778   420   NtWaitForSingleObject  (92, 0, 0x0, ...
 01779  1708   NtSetEventBoostPriority  (92, ...
 01780   896   NtAllocateVirtualMemory  (-1, 34725888, 0, 8192, 4096, 4, ...
 01778   420   NtWaitForSingleObject  ... ) == 0x0
 01779  1708   NtSetEventBoostPriority  ... ) == 0x0
 01781   420   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ...
 01780   896   NtAllocateVirtualMemory  ... 34725888, 8192, ) == 0x0
 01781   420   NtAllocateVirtualMemory  ... 1372160, 4096, ) == 0x0
 01782  1708   NtTestAlert  (...
 01783   896   NtProtectVirtualMemory  (-1, (0x211e000), 4096, 260, ...
 01784   420   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 13500032, 67, ... }, 0x0, 0, 3, 3, 0, 13500032, 67, ...
 01783   896   NtProtectVirtualMemory  ... (0x211e000), 4096, 4, ) == 0x0
 01784   420   NtCreateFile  ... 276, {status=0x0, info=0}, ) == 0x0
 01785   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01786   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x1207b,  (276, 200, 0x0, 0x0, 0x1207b, "\7\0\0\0x\1\24\0\340\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 01782  1708   NtTestAlert  ... ) == 0x0
 01786   420   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 01787  1708   NtContinue  (33684784, 1, ...
 01788   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x1207b,  (276, 200, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", 16, 16, ... , 16, 16, ...
 01789  1708   NtRegisterThreadTerminatePort  (24, ...
 01788   420   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 01789  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 01785   896   NtCreateThread  ... 296, {1252, 1024}, ) == 0x0
 01790  1708   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01791   896   NtQueryInformationThread  (296, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 01792   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\1\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\1\0\0\344\4\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\1\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\1\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 01793   896   NtResumeThread  (296, ... 1, ) == 0x0
 01794   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 34734080, 1048576, ) == 0x0
 01795   896   NtAllocateVirtualMemory  (-1, 35774464, 0, 8192, 4096, 4, ... 35774464, 8192, ) == 0x0
 01796   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x12047,  (276, 200, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 01797  1024   NtTestAlert  (...
 01790  1708   NtSetInformationThread  ... ) == 0x0
 01796   420   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 01797  1024   NtTestAlert  ... ) == 0x0
 01798   896   NtProtectVirtualMemory  (-1, (0x221e000), 4096, 260, ...
 01799   420   NtWaitForSingleObject  (148, 0, {0, 0}, ...
 01800  1024   NtContinue  (34733360, 1, ...
 01798   896   NtProtectVirtualMemory  ... (0x221e000), 4096, 4, ) == 0x0
 01799   420   NtWaitForSingleObject  ... ) == 0x102
 01801  1024   NtRegisterThreadTerminatePort  (24, ...
 01802   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01803   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x12003,  (276, 200, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 01801  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 01802   896   NtCreateThread  ... 300, {1252, 1324}, ) == 0x0
 01804  1708   NtWaitForSingleObject  (216, 0, 0x0, ...
 01803   420   NtDeviceIoControlFile  ... {status=0x0, info=304},  ... {status=0x0, info=304}, "\1\0\0\0\1\0\0\0\16\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01805   896   NtQueryInformationThread  (300, Basic, 28, ...
 01806  1024   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01807   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x12047,  (276, 200, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01805   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1324,}, 0x0, ) == 0x0
 01807   420   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01806  1024   NtSetInformationThread  ... ) == 0x0
 01808   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x12037,  (276, 200, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 01809   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0,\5\0\0" ...  ...
 01808   420   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01809   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81862, 0}  ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0,\5\0\0" )  ) == 0x0
 01810  1024   NtWaitForSingleObject  (216, 0, 0x0, ...
 01811   896   NtResumeThread  (300, ...
 01812   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x1200b,  (276, 200, 0x0, 0x0, 0x1200b, "\0\376\315\0\5\0\0\0\0\327\24\0", 12, 0, ... , 12, 0, ...
 01811   896   NtResumeThread  ... 1, ) == 0x0
 01812   420   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01813   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01814   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x12047,  (276, 200, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\315\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01815  1324   NtTestAlert  (...
 01814   420   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01815  1324   NtTestAlert  ... ) == 0x0
 01816   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 01817  1324   NtContinue  (35781936, 1, ...
 01816   420   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01818  1324   NtRegisterThreadTerminatePort  (24, ...
 01813   896   NtAllocateVirtualMemory  ... 35782656, 1048576, ) == 0x0
 01818  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 01819   896   NtAllocateVirtualMemory  (-1, 36823040, 0, 8192, 4096, 4, ...
 01820   420   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01819   896   NtAllocateVirtualMemory  ... 36823040, 8192, ) == 0x0
 01820   420   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01821   896   NtProtectVirtualMemory  (-1, (0x231e000), 4096, 260, ...
 01822   420   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01821   896   NtProtectVirtualMemory  ... (0x231e000), 4096, 4, ) == 0x0
 01822   420   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01823   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01824   420   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01825  1324   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01824   420   NtOpenFile  ... 308, {status=0x0, info=0}, ) == 0x0
 01825  1324   NtSetInformationThread  ... ) == 0x0
 01823   896   NtCreateThread  ... 312, {1252, 1776}, ) == 0x0
 01826   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\344\1\27\253%\300\303\22E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01827   896   NtQueryInformationThread  (312, Basic, 28, ...
 01828   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01827   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 01828   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01829   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\360\6\0\0" ...  ...
 01830   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01829   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81863, 0}  ... {28, 56, reply, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 01830   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01831  1324   NtWaitForSingleObject  (216, 0, 0x0, ...
 01832   420   NtQuerySystemInformation  (Performance, 312, ...
 01833   896   NtResumeThread  (312, ... 1, ) == 0x0
 01834   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 36831232, 1048576, ) == 0x0
 01835   896   NtAllocateVirtualMemory  (-1, 37871616, 0, 8192, 4096, 4, ... 37871616, 8192, ) == 0x0
 01836   896   NtProtectVirtualMemory  (-1, (0x241e000), 4096, 260, ... (0x241e000), 4096, 4, ) == 0x0
 01837   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01832   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01838   420   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01839   420   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01840   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01841  1776   NtTestAlert  (...
 01837   896   NtCreateThread  ... 316, {1252, 500}, ) == 0x0
 01841  1776   NtTestAlert  ... ) == 0x0
 01842   896   NtQueryInformationThread  (316, Basic, 28, ...
 01843  1776   NtContinue  (36830512, 1, ...
 01842   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa0000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 01844  1776   NtRegisterThreadTerminatePort  (24, ...
 01845   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0\344\4\0\0\364\1\0\0" ...  ...
 01844  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 01845   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81864, 0}  ... {28, 56, reply, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 01840   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01846  1776   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01847   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01848   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01849   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\27C[\15\244\24+/\271\362\14\265\275\374MC\346\221\213\7\262\255\361\230D'\274\33\-\261\23\223\307\34\2646 \260#\3346\350\31&:\3663r[87>\330\317o\200\222\341\3~j\301\35X\275\33\224\4R\327\224\345%M`\201\251/\301", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\27C[\15\244\24+/\271\362\14\265\275\374MC\346\221\213\7\262\255\361\230D'\274\33\-\261\23\223\307\34\2646 \260#\3346\350\31&:\3663r[87>\330\317o\200\222\341\3~j\301\35X\275\33\224\4R\327\224\345%M`\201\251/\301", 80, ... ) , 80, ... ) == 0x0
 01850   420   NtClose  (-2147481484, ... ) == 0x0
 01826   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "0\5S"\325e\241\241\\270%\371\243\1R\251\223\207 \2\216P2\265i8\225\2Dp2\331/\364\271!\351\37\10Fz(\365\7H\217g\3369\320U\36\2251Rg\311\377SW]\272\313%\216\216\356\277\333\2101?\212\371:\206\227X\363\343\223\332*L\21B:\210\314\3375\207\304\335\10!\347\317&r\355q\30E\340\231Jl\362\210\235U.\201\255I^\246\305$\241\327\260\266\310T\2138+PO6\14\355c%N^\360\231b\344\356\35\331\202Z\213\321\374\267r\25\10\340\234\331\320\315$\315\5%\11\337|\324>\354+\353\330\335*\367\223\243\230\25\266\1E\271\246\340\204N>'N\354\323\372z.@\210\302\360\330Z\203\317{\1776p1\234\273H\332[ah\2462\307\304G\223\263\232\311\225\210"^omd\11\2\27s\365\325\307S+\320u\253z#\374\201\326\5**\213\34\256\324", ) \325e\241\241\\270%\371\243\1R\251\223\207 \2\216P2\265i8\225\2Dp2\331/\364\271!\351\37\10Fz(\365\7H\217g\3369\320U\36\2251Rg\311\377SW]\272\313%\216\216\356\277\333\2101?\212\371:\206\227X\363\343\223\332*L\21B:\210\314\3375\207\304\335\10!\347\317&r\355q\30E\340\231Jl\362\210\235U.\201\255I^\246\305$\241\327\260\266\310T\2138+PO6\14\355c%N^\360\231b\344\356\35\331\202Z\213\321\374\267r\25\10\340\234\331\320\315$\315\5%\11\337|\324>\354+\353\330\335*\367\223\243\230\25\266\1E\271\246\340\204N>'N\354\323\372z.@\210\302\360\330Z\203\317{\1776p1\234\273H\332[ah\2462\307\304G\223\263\232\311\225\210 ... {status=0x0, info=256}, "0\5S"\325e\241\241\\270%\371\243\1R\251\223\207 \2\216P2\265i8\225\2Dp2\331/\364\271!\351\37\10Fz(\365\7H\217g\3369\320U\36\2251Rg\311\377SW]\272\313%\216\216\356\277\333\2101?\212\371:\206\227X\363\343\223\332*L\21B:\210\314\3375\207\304\335\10!\347\317&r\355q\30E\340\231Jl\362\210\235U.\201\255I^\246\305$\241\327\260\266\310T\2138+PO6\14\355c%N^\360\231b\344\356\35\331\202Z\213\321\374\267r\25\10\340\234\331\320\315$\315\5%\11\337|\324>\354+\353\330\335*\367\223\243\230\25\266\1E\271\246\340\204N>'N\354\323\372z.@\210\302\360\330Z\203\317{\1776p1\234\273H\332[ah\2462\307\304G\223\263\232\311\225\210"^omd\11\2\27s\365\325\307S+\320u\253z#\374\201\326\5**\213\34\256\324", ) , ) == 0x0
 01851   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 320, ) == 0x0
 01852   896   NtResumeThread  (316, ...
 01846  1776   NtSetInformationThread  ... ) == 0x0
 01852   896   NtResumeThread  ... 1, ) == 0x0
 01853   420   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 13496952, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 13496952, 188, ...
 01854   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 37879808, 1048576, ) == 0x0
 01855   896   NtAllocateVirtualMemory  (-1, 38920192, 0, 8192, 4096, 4, ... 38920192, 8192, ) == 0x0
 01853   420   NtConnectPort  ... 324, 0x0, 0x0, 0x0, 188, ) == 0x0
 01856  1776   NtWaitForSingleObject  (216, 0, 0x0, ...
 01857   500   NtTestAlert  (...
 01858   420   NtRequestWaitReplyPort  (324, {200, 224, new_msg, 0, 2883626, 1366384, 12, 2}  (324, {200, 224, new_msg, 0, 2883626, 1366384, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\2\0\4\0\0\0\230@\24\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0-\247\362\375\215V\340\36\320\22\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\250\22\25\0\266\261\266$x\1\24\0\310\22\25\0h\1\24\0\0\0\0\0\0\0\0\0\310\22\25\0P\0\0\0\320\22\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\315\0\372\31\221|\214\370\315\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 01859   896   NtProtectVirtualMemory  (-1, (0x251e000), 4096, 260, ...
 01857   500   NtTestAlert  ... ) == 0x0
 01859   896   NtProtectVirtualMemory  ... (0x251e000), 4096, 4, ) == 0x0
 01860   500   NtContinue  (37879088, 1, ...
 01858   420   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 420, 81866, 0}  ... {200, 224, reply, 0, 1252, 420, 81866, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\230@\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0-\247\362\375\215V\340\36\320\22\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\250\22\25\0\266\261\266$x\1\24\0\310\22\25\0h\1\24\0\0\0\0\0\0\0\0\0\310\22\25\0P\0\0\0\320\22\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\315\0\372\31\221|\214\370\315\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 01861   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01862   500   NtRegisterThreadTerminatePort  (24, ...
 01861   896   NtCreateThread  ... 328, {1252, 248}, ) == 0x0
 01862   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 01863   896   NtQueryInformationThread  (328, Basic, 28, ...
 01864   420   NtRequestWaitReplyPort  (324, {44, 68, new_msg, 56, 0, 0, 0, 0}  (324, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\00\24\25\0\322\0\0\0" ...  ...
 01863   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 01864   420   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 420, 81867, 0}  ... {40, 64, reply, 0, 1252, 420, 81867, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 01865   500   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01866   420   NtRequestWaitReplyPort  (324, {64, 88, new_msg, 56, 1310720, 13496820, 1381416, 0}  (324, {64, 88, new_msg, 56, 1310720, 13496820, 1381416, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0(\25\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 420, 81868, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0(\25\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 1252, 420, 81868, 0}  (324, {64, 88, new_msg, 56, 1310720, 13496820, 1381416, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0(\25\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 420, 81868, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0(\25\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01867   420   NtRequestWaitReplyPort  (324, {44, 68, new_msg, 56, 1252, 420, 81867, 0}  (324, {44, 68, new_msg, 56, 1252, 420, 81867, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\00\24\25\0\322\0\0\0" ...  ...
 01868   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\1\0\0\344\4\0\0\370\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\1\0\0\344\4\0\0\370\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\1\0\0\344\4\0\0\370\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 01869   896   NtResumeThread  (328, ... 1, ) == 0x0
 01870   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01865   500   NtSetInformationThread  ... ) == 0x0
 01867   420   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 420, 81869, 0}  ... {40, 64, reply, 0, 1252, 420, 81869, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 01871   248   NtTestAlert  (...
 01870   896   NtAllocateVirtualMemory  ... 38928384, 1048576, ) == 0x0
 01872   420   NtRequestWaitReplyPort  (324, {64, 88, new_msg, 56, 1310720, 13496820, 13497564, 0}  (324, {64, 88, new_msg, 56, 1310720, 13496820, 13497564, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0\360\31\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01871   248   NtTestAlert  ... ) == 0x0
 01873   896   NtAllocateVirtualMemory  (-1, 39968768, 0, 8192, 4096, 4, ...
 01874   248   NtContinue  (38927664, 1, ...
 01873   896   NtAllocateVirtualMemory  ... 39968768, 8192, ) == 0x0
 01872   420   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 420, 81871, 0}  ... {64, 88, reply, 56, 1252, 420, 81871, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0\360\31\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01875   248   NtRegisterThreadTerminatePort  (24, ...
 01876   896   NtProtectVirtualMemory  (-1, (0x261e000), 4096, 260, ...
 01877   500   NtWaitForSingleObject  (216, 0, 0x0, ...
 01875   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 01876   896   NtProtectVirtualMemory  ... (0x261e000), 4096, 4, ) == 0x0
 01878   420   NtRequestWaitReplyPort  (324, {44, 68, new_msg, 56, 1252, 420, 81869, 0}  (324, {44, 68, new_msg, 56, 1252, 420, 81869, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\00\24\25\0\322\0\0\0" ...  ...
 01879   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01878   420   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 420, 81872, 0}  ... {40, 64, reply, 0, 1252, 420, 81872, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 01880   248   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01881   420   NtRequestWaitReplyPort  (324, {64, 88, new_msg, 56, 1310720, 13496820, 13497564, 0}  (324, {64, 88, new_msg, 56, 1310720, 13496820, 13497564, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0\210\34\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 420, 81873, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0\210\34\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 1252, 420, 81873, 0}  (324, {64, 88, new_msg, 56, 1310720, 13496820, 13497564, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0\210\34\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 420, 81873, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\315\0\351\201\347w\214\370\315\0\30\356\220|p\5\221|\1\0\0\0\210\34\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01882   420   NtClose  (320, ... ) == 0x0
 01883   420   NtClose  (324, ... ) == 0x0
 01884   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{TDD\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01885   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01879   896   NtCreateThread  ... 324, {1252, 1884}, ) == 0x0
 01880   248   NtSetInformationThread  ... ) == 0x0
 01886   896   NtQueryInformationThread  (324, Basic, 28, ...
 01885   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01886   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 01887   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01888   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\1\0\0\344\4\0\0\\7\0\0" ...  ...
 01887   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01888   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81875, 0}  ... {28, 56, reply, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\1\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 01889   420   NtQuerySystemInformation  (Performance, 312, ...
 01890   248   NtWaitForSingleObject  (216, 0, 0x0, ...
 01889   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01891   896   NtResumeThread  (324, ...
 01892   420   NtQuerySystemInformation  (Exception, 16, ...
 01891   896   NtResumeThread  ... 1, ) == 0x0
 01893   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 39976960, 1048576, ) == 0x0
 01894   896   NtAllocateVirtualMemory  (-1, 41017344, 0, 8192, 4096, 4, ... 41017344, 8192, ) == 0x0
 01895   896   NtProtectVirtualMemory  (-1, (0x271e000), 4096, 260, ... (0x271e000), 4096, 4, ) == 0x0
 01896   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 320, {1252, 1308}, ) == 0x0
 01897   896   NtQueryInformationThread  (320, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 01892   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01898  1884   NtTestAlert  (...
 01899   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01898  1884   NtTestAlert  ... ) == 0x0
 01899   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01900  1884   NtContinue  (39976240, 1, ...
 01901   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01902  1884   NtRegisterThreadTerminatePort  (24, ...
 01901   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01902  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 01903   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01904   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\1\0\0\344\4\0\0\34\5\0\0" ...  ...
 01905  1884   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01904   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81876, 0}  ... {28, 56, reply, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\1\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 01906   896   NtResumeThread  (320, ... 1, ) == 0x0
 01907   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 41025536, 1048576, ) == 0x0
 01908   896   NtAllocateVirtualMemory  (-1, 42065920, 0, 8192, 4096, 4, ... 42065920, 8192, ) == 0x0
 01909   896   NtProtectVirtualMemory  (-1, (0x281e000), 4096, 260, ... (0x281e000), 4096, 4, ) == 0x0
 01910   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01903   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01905  1884   NtSetInformationThread  ... ) == 0x0
 01911  1308   NtTestAlert  (...
 01912   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01910   896   NtCreateThread  ... 332, {1252, 1676}, ) == 0x0
 01911  1308   NtTestAlert  ... ) == 0x0
 01912   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01913   896   NtQueryInformationThread  (332, Basic, 28, ...
 01914  1308   NtContinue  (41024816, 1, ...
 01915   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\330\371\353\311\306\202W\27\326?\314f\304\265\35,`:\352\336\326\217yM$\210A\371;Q\227S\213\254MC\271k\267!\212\243\272\220\21H~\203\261\234"\350\270\36.l\6\314\12\15\233\345\322\345\376\251\232]\357\302w\336\361v+\246\17\303/1", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\330\371\353\311\306\202W\27\326?\314f\304\265\35,`:\352\336\326\217yM$\210A\371;Q\227S\213\254MC\271k\267!\212\243\272\220\21H~\203\261\234"\350\270\36.l\6\314\12\15\233\345\322\345\376\251\232]\357\302w\336\361v+\246\17\303/1", 80, ... \350\270\36.l\6\314\12\15\233\345\322\345\376\251\232]\357\302w\336\361v+\246\17\303/1", 80, ...
 01913   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 01916  1308   NtRegisterThreadTerminatePort  (24, ...
 01915   420   NtSetValueKey  ... ) == 0x0
 01917   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0\344\4\0\0\214\6\0\0" ...  ...
 01916  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 01918   420   NtClose  (-2147481484, ...
 01917   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81877, 0}  ... {28, 56, reply, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 01919  1884   NtWaitForSingleObject  (216, 0, 0x0, ...
 01920  1308   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01918   420   NtClose  ... ) == 0x0
 01921   896   NtResumeThread  (332, ...
 01884   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "T\355\244G\4Brr\2e\223\24\254\205I\255\313\257\223k\37\302\373k\12\266\321\373\2275\356F\7X%\276:\340n)\250\210\255\363\265H\302\213\203\246\326\370\276\272/\224\370\341\347CT~S\304\356\376\16\304\261\26\325'd\230K,\364y\16I\13\320\311N\210\303\30!w\274\377]\261\251u\327O\377Y\257\231+\347\27 \323\221/\225s\215\2039$\3224\35p\34\30\177\305\2512Y\300\12XTv\317g\3\366\16'\247\350\5\210\324pA\252\243\234 wE\236H\33\312\363\366$I\271\14\367\303\23\217(\272'Y?G\330\274\241l2\200\354\13\351\364\340X$71\314\343\24/k+\227o\2466\356N\202S\3151O\4\22xo\26\353Y\33C\177\262$\12\3022\177\3\343\374\14\377\222\240.\371\372\235\215\306J\314\254P\303\304\31tk\245\216\273Q\326\222\15W\337\277W\217\3460\316\335t", ) , ) == 0x0
 01921   896   NtResumeThread  ... 1, ) == 0x0
 01922   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{\21p\354$H\232\241\271\226D\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01923   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01924   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01923   896   NtAllocateVirtualMemory  ... 42074112, 1048576, ) == 0x0
 01924   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01925   896   NtAllocateVirtualMemory  (-1, 43114496, 0, 8192, 4096, 4, ...
 01926   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01925   896   NtAllocateVirtualMemory  ... 43114496, 8192, ) == 0x0
 01920  1308   NtSetInformationThread  ... ) == 0x0
 01927  1676   NtTestAlert  (...
 01926   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01928   896   NtProtectVirtualMemory  (-1, (0x291e000), 4096, 260, ...
 01927  1676   NtTestAlert  ... ) == 0x0
 01929   420   NtQuerySystemInformation  (Performance, 312, ...
 01928   896   NtProtectVirtualMemory  ... (0x291e000), 4096, 4, ) == 0x0
 01930  1676   NtContinue  (42073392, 1, ...
 01929   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01931   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01932  1676   NtRegisterThreadTerminatePort  (24, ...
 01933   420   NtQuerySystemInformation  (Exception, 16, ...
 01931   896   NtCreateThread  ... 336, {1252, 1620}, ) == 0x0
 01932  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 01933   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01934   896   NtQueryInformationThread  (336, Basic, 28, ...
 01935  1308   NtWaitForSingleObject  (216, 0, 0x0, ...
 01936   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01934   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 01937  1676   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01936   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01938   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01939   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01940   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01941   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\330\266\274\17\346\30d2\20'\224\361\242)\343]Y9\1\313\340t\224\301\333\325\351U\20cXCwk\337\252f\310Ok_\202b}\375\342\314\260$\331\211f \222\16F\346\265\363jj\272Er\324-\263l\26\244\323\260\353"\305`M\217W\23", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\330\266\274\17\346\30d2\20'\224\361\242)\343]Y9\1\313\340t\224\301\333\325\351U\20cXCwk\337\252f\310Ok_\202b}\375\342\314\260$\331\211f \222\16F\346\265\363jj\272Er\324-\263l\26\244\323\260\353"\305`M\217W\23", 80, ... ) \305`M\217W\23", 80, ... ) == 0x0
 01942   420   NtClose  (-2147481484, ... ) == 0x0
 01922   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "w\2141\241fQ\371\31P\317\303\212\206\301\207\15\300fo\10 K\10\36\232p\317\360\10\224\17\336I\242\334\375\347FN\3369\25z\313\325-\361\233\213P\370o\254G\251KH\337\317\301\333\265\12\367F:\231\372]\12\224\326Re<\312\374\360\377J)f\264\1~\05\100\230\252\346H\13o[I\363'\343R8\272w\322\221\304\325o\33\225h|\3021}\226M?\244\245\324\324\237\31:-\216\353G1\311-\1"x\274\246d\13\30\222\314vp\346\37\2438\27\325\353\213\33\240>}G\323\273k\22\3110\36I\250aW\354 \373\3526\345y\361\200g\215McIb44\364L\6\253:\276(0\240$su2~s\373j\220\313\25\314l\214\267\321t\2610\201\314\215~\201C\316\272-\326\307\357w\321v;\215\325iQ\21\257 \332\30\20iL\340\311\253\212*\274\310\224WN\212RM\266", ) x\274\246d\13\30\222\314vp\346\37\2438\27\325\353\213\33\240>}G\323\273k\22\3110\36I\250aW\354 \373\3526\345y\361\200g\215McIb44\364L\6\253:\276(0\240$su2~s\373j\220\313\25\314l\214\267\321t\2610\201\314\215~\201C\316\272-\326\307\357w\321v;\215\325iQ\21\257 \332\30\20iL\340\311\253\212*\274\310\224WN\212RM\266", ) == 0x0
 01943   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0T\6\0\0" ...  ...
 01937  1676   NtSetInformationThread  ... ) == 0x0
 01943   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81878, 0}  ... {28, 56, reply, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 01944   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{\21p\354$H\232\241\374\242\354$H\232\241\271\226D\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01945   896   NtResumeThread  (336, ...
 01946   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01945   896   NtResumeThread  ... 1, ) == 0x0
 01946   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01947   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01948   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01949  1676   NtWaitForSingleObject  (216, 0, 0x0, ...
 01950  1620   NtTestAlert  (...
 01948   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01947   896   NtAllocateVirtualMemory  ... 43122688, 1048576, ) == 0x0
 01950  1620   NtTestAlert  ... ) == 0x0
 01951   420   NtQuerySystemInformation  (Performance, 312, ...
 01952   896   NtAllocateVirtualMemory  (-1, 44163072, 0, 8192, 4096, 4, ...
 01953  1620   NtContinue  (43121968, 1, ...
 01952   896   NtAllocateVirtualMemory  ... 44163072, 8192, ) == 0x0
 01954  1620   NtRegisterThreadTerminatePort  (24, ...
 01955   896   NtProtectVirtualMemory  (-1, (0x2a1e000), 4096, 260, ...
 01954  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 01955   896   NtProtectVirtualMemory  ... (0x2a1e000), 4096, 4, ) == 0x0
 01951   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01956   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01957   420   NtQuerySystemInformation  (Exception, 16, ...
 01958  1620   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01957   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01959   420   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01960   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01961   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01962   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01963   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\266\255Y\375\305:t\206~\365Ap\17\300[\262\350H\21\343\32265]\274\236,<\319\340\206\310 \12\251\350\264\254asb\204!\213\237d\265\207\34\327\305\207\251v\344\375}\356\32,V/t\272#\3\306\177\276Ns\3746Ma\237PE\312", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\266\255Y\375\305:t\206~\365Ap\17\300[\262\350H\21\343\32265]\274\236,<\319\340\206\310 \12\251\350\264\254asb\204!\213\237d\265\207\34\327\305\207\251v\344\375}\356\32,V/t\272#\3\306\177\276Ns\3746Ma\237PE\312", 80, ... , 80, ...
 01956   896   NtCreateThread  ... 340, {1252, 1296}, ) == 0x0
 01958  1620   NtSetInformationThread  ... ) == 0x0
 01964   896   NtQueryInformationThread  (340, Basic, 28, ...
 01963   420   NtSetValueKey  ... ) == 0x0
 01964   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 01965   420   NtClose  (-2147481484, ...
 01966   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0\20\5\0\0" ...  ...
 01965   420   NtClose  ... ) == 0x0
 01966   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 01944   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "L\2235\211\244\211\352\342d\336\340\254\236\374.,_e\3634>\223\301\11:!\324\311\316\223\277o\310)\4\12k\322\5\215\234^\23d*\340$\327m\373\362\14\222U3\251\204\25\325\340G\302\264\276\3519\210>En^\337 \325\365\367\21 \4,F\34v\254q\362\345\243Q\350\223\353\271\307d\254F\203@\233\341C\200\244\5\226\206\231X\324\25pPkY\230+\254hW2K\05T\36\253\257\345\355\357\244\220\22\352\232\234\23\354\205~\32\271B\204\207\315\304\305\343\2364\366P\352a\306\266"\310\224\253a\3410\223\263\362\247\352\307]Hi."p\316TX~[\7_\0\204\242}\332\310`Az\311\3744\20oc\16\267\312\3368k\375?Y\364VB\210N\22&d\303\2468\201\330\242\216\374\222^c\225zd\23n\0\256\353\33\206\2546\325\329\271\331\267\4\215\30\344\256\322[\14Qy\240", ) \310\224\253a\3410\223\263\362\247\352\307]Hi. ... {status=0x0, info=256}, "L\2235\211\244\211\352\342d\336\340\254\236\374.,_e\3634>\223\301\11:!\324\311\316\223\277o\310)\4\12k\322\5\215\234^\23d*\340$\327m\373\362\14\222U3\251\204\25\325\340G\302\264\276\3519\210>En^\337 \325\365\367\21 \4,F\34v\254q\362\345\243Q\350\223\353\271\307d\254F\203@\233\341C\200\244\5\226\206\231X\324\25pPkY\230+\254hW2K\05T\36\253\257\345\355\357\244\220\22\352\232\234\23\354\205~\32\271B\204\207\315\304\305\343\2364\366P\352a\306\266"\310\224\253a\3410\223\263\362\247\352\307]Hi."p\316TX~[\7_\0\204\242}\332\310`Az\311\3744\20oc\16\267\312\3368k\375?Y\364VB\210N\22&d\303\2468\201\330\242\216\374\222^c\225zd\23n\0\256\353\33\206\2546\325\329\271\331\267\4\215\30\344\256\322[\14Qy\240", ) , ) == 0x0
 01967  1620   NtWaitForSingleObject  (216, 0, 0x0, ...
 01968   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{\21p\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\271\226D\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01969   896   NtResumeThread  (340, ...
 01970   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01969   896   NtResumeThread  ... 1, ) == 0x0
 01971   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 44171264, 1048576, ) == 0x0
 01972   896   NtAllocateVirtualMemory  (-1, 45211648, 0, 8192, 4096, 4, ... 45211648, 8192, ) == 0x0
 01973   896   NtProtectVirtualMemory  (-1, (0x2b1e000), 4096, 260, ... (0x2b1e000), 4096, 4, ) == 0x0
 01974   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 344, {1252, 440}, ) == 0x0
 01975   896   NtQueryInformationThread  (344, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 01970   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01976  1296   NtTestAlert  (...
 01977   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01976  1296   NtTestAlert  ... ) == 0x0
 01977   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01978  1296   NtContinue  (44170544, 1, ...
 01979   420   NtQuerySystemInformation  (Performance, 312, ...
 01980  1296   NtRegisterThreadTerminatePort  (24, ...
 01979   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01980  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 01981   420   NtQuerySystemInformation  (Exception, 16, ...
 01982   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\270\1\0\0" ...  ...
 01983  1296   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01982   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81880, 0}  ... {28, 56, reply, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 01984   896   NtResumeThread  (344, ... 1, ) == 0x0
 01985   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 45219840, 1048576, ) == 0x0
 01986   896   NtAllocateVirtualMemory  (-1, 46260224, 0, 8192, 4096, 4, ... 46260224, 8192, ) == 0x0
 01987   896   NtProtectVirtualMemory  (-1, (0x2c1e000), 4096, 260, ... (0x2c1e000), 4096, 4, ) == 0x0
 01988   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01981   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01983  1296   NtSetInformationThread  ... ) == 0x0
 01989   440   NtTestAlert  (...
 01990   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01988   896   NtCreateThread  ... 348, {1252, 1588}, ) == 0x0
 01989   440   NtTestAlert  ... ) == 0x0
 01990   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01991   896   NtQueryInformationThread  (348, Basic, 28, ...
 01992   440   NtContinue  (45219120, 1, ...
 01993   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01991   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 01994   440   NtRegisterThreadTerminatePort  (24, ...
 01993   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01995   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\04\6\0\0" ...  ...
 01994   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 01996   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01995   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 01997  1296   NtWaitForSingleObject  (216, 0, 0x0, ...
 01998   440   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 01996   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01999   896   NtResumeThread  (348, ...
 02000   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01999   896   NtResumeThread  ... 1, ) == 0x0
 02000   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02001   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02002   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\335\222\7\332\15-\322\241\13\205\333"\330op\262\235\35\310\2357/\243\365\223\236(\316\323\370\327>\303\210\17\311\236l\210\374c\250z\371:w\232O+7\365\317e\24WF\22\27\25\320)\342\250\1\232q=\337\236 \200\355q{\256\304\370\272\21\27", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\335\222\7\332\15-\322\241\13\205\333"\330op\262\235\35\310\2357/\243\365\223\236(\316\323\370\327>\303\210\17\311\236l\210\374c\250z\371:w\232O+7\365\317e\24WF\22\27\25\320)\342\250\1\232q=\337\236 \200\355q{\256\304\370\272\21\27", 80, ... \330op\262\235\35\310\2357/\243\365\223\236(\316\323\370\327>\303\210\17\311\236l\210\374c\250z\371:w\232O+7\365\317e\24WF\22\27\25\320)\342\250\1\232q=\337\236 \200\355q{\256\304\370\272\21\27", 80, ...
 02001   896   NtAllocateVirtualMemory  ... 46268416, 1048576, ) == 0x0
 02002   420   NtSetValueKey  ... ) == 0x0
 02003   896   NtAllocateVirtualMemory  (-1, 47308800, 0, 8192, 4096, 4, ...
 02004   420   NtClose  (-2147481484, ...
 02003   896   NtAllocateVirtualMemory  ... 47308800, 8192, ) == 0x0
 01998   440   NtSetInformationThread  ... ) == 0x0
 02005  1588   NtTestAlert  (...
 02004   420   NtClose  ... ) == 0x0
 02006   896   NtProtectVirtualMemory  (-1, (0x2d1e000), 4096, 260, ...
 02005  1588   NtTestAlert  ... ) == 0x0
 01968   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\365\312;\4\243\\233\3\300U\234\377\240\271\253\304\23\318\36\300\222\343`oD\13*\313%\22\2\300\36\264qN\14\23y\255\306cKK2\21\366\342B2\14\235n\336\234\320\3617\303u\316\332\263\365,\6\311U\201uC\317\343\224\240yo\325\3361\34\210\231!\206s\335#\216\215\231\351\17\315\347@\321\7\231R\25\324_k\2335Ar\314\261\277\271\37\223O\256\264\316\244\305*\237\216\336B\302a-\10\307\251\4U&)\272A\235\357\25\15\336\246C\14\210k\35o\33\18.\11\301\223q\273(\317\226j\322\266.WWTf\207\212N\220\5\304k\310ek\327\212oV\102\23v%\11\33\376\244-\275\320\\253\372\351^\323\2\307xDph|\355\270\352(\271\273\215\2444\276Is\261\310\32(\255\200Q\300\245\327\21b@ \342P.~\266f\202\251\35q\226\233_\30\202\34I\377\6\16", ) , ) == 0x0
 02006   896   NtProtectVirtualMemory  ... (0x2d1e000), 4096, 4, ) == 0x0
 02007  1588   NtContinue  (46267696, 1, ...
 02008   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{\21p\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\271\226D\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02009   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02010  1588   NtRegisterThreadTerminatePort  (24, ...
 02011   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02010  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 02011   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02012   440   NtWaitForSingleObject  (216, 0, 0x0, ...
 02009   896   NtCreateThread  ... 352, {1252, 2044}, ) == 0x0
 02013   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02014  1588   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02015   896   NtQueryInformationThread  (352, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 02016   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0\344\4\0\0\374\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 02017   896   NtResumeThread  (352, ... 1, ) == 0x0
 02018   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 47316992, 1048576, ) == 0x0
 02019   896   NtAllocateVirtualMemory  (-1, 48357376, 0, 8192, 4096, 4, ... 48357376, 8192, ) == 0x0
 02013   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02014  1588   NtSetInformationThread  ... ) == 0x0
 02020  2044   NtTestAlert  (...
 02021   420   NtQuerySystemInformation  (Performance, 312, ...
 02022   896   NtProtectVirtualMemory  (-1, (0x2e1e000), 4096, 260, ...
 02020  2044   NtTestAlert  ... ) == 0x0
 02021   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02022   896   NtProtectVirtualMemory  ... (0x2e1e000), 4096, 4, ) == 0x0
 02023  2044   NtContinue  (47316272, 1, ...
 02024   420   NtQuerySystemInformation  (Exception, 16, ...
 02025   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02026  2044   NtRegisterThreadTerminatePort  (24, ...
 02024   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02025   896   NtCreateThread  ... 356, {1252, 588}, ) == 0x0
 02026  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 02027   420   NtQuerySystemInformation  (Lookaside, 32, ...
 02028   896   NtQueryInformationThread  (356, Basic, 28, ...
 02029  1588   NtWaitForSingleObject  (216, 0, 0x0, ...
 02030  2044   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02028   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 02027   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02030  2044   NtSetInformationThread  ... ) == 0x0
 02031   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02032   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\1\0\0\344\4\0\0L\2\0\0" ...  ...
 02031   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02032   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\1\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 02033   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02034   896   NtResumeThread  (356, ...
 02033   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02034   896   NtResumeThread  ... 1, ) == 0x0
 02035   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02036   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02037  2044   NtWaitForSingleObject  (216, 0, 0x0, ...
 02038   588   NtTestAlert  (...
 02035   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02036   896   NtAllocateVirtualMemory  ... 48365568, 1048576, ) == 0x0
 02038   588   NtTestAlert  ... ) == 0x0
 02039   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\326\370\207<\6\370\352\363\3\203\265\276\262&\204S\301d\374\2045@\273\12X\25\342\304\0\363\340\207\322\270\25\252\204\364\335ki !B\342\0\336D\23\1\251\3605\332\355\276'\334\355\352\202\276"VP\366\316\363\377]\340\263\373\235,\200\314\263f", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\326\370\207<\6\370\352\363\3\203\265\276\262&\204S\301d\374\2045@\273\12X\25\342\304\0\363\340\207\322\270\25\252\204\364\335ki !B\342\0\336D\23\1\251\3605\332\355\276'\334\355\352\202\276"VP\366\316\363\377]\340\263\373\235,\200\314\263f", 80, ... VP\366\316\363\377]\340\263\373\235,\200\314\263f", 80, ...
 02040   896   NtAllocateVirtualMemory  (-1, 49405952, 0, 8192, 4096, 4, ...
 02041   588   NtContinue  (48364848, 1, ...
 02039   420   NtSetValueKey  ... ) == 0x0
 02040   896   NtAllocateVirtualMemory  ... 49405952, 8192, ) == 0x0
 02042   588   NtRegisterThreadTerminatePort  (24, ...
 02043   420   NtClose  (-2147481484, ...
 02044   896   NtProtectVirtualMemory  (-1, (0x2f1e000), 4096, 260, ...
 02042   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 02043   420   NtClose  ... ) == 0x0
 02044   896   NtProtectVirtualMemory  ... (0x2f1e000), 4096, 4, ) == 0x0
 02008   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "i\320\201\3106\262\372\2\210g\362\212\220\377.snEl1\367\220\206\344\31\370J\335b2ZN.\325\275\232G\240\3179\263\377\324Wh\301\334+\306^\230\244\216\300UM6\276+\323\2\372\326\225\257\227\362@7\241\247\315]e\345\326U\267\367\17\267)4\32\311\365\305\352\14\271\314C\335^\372~C\236\244C\323\251\261\242T0\261\374\5\2455\273([0\364\263C\231\356\3\240\347\20`\306\204\357\311\203\233\266H\374\371\201A\10'\355\207\270\313\234&\314H\263\350J\204Pe/\23m\256'*\227\211`\212\346\256\332\326\302\214\315\264B\34\24\14\314\334$fg\200'\223\33\12G\263\251\37(HP\256\231\7\357l(\272\325\22`\15\7\271\246\244\322\233F\372XL\364\217"\262\33\2342\226H\335\220\21\242\\345\235\215\e\272\326\216d\253\360\240f\363\0\371\267\320(v\6u\324wyN", ) \262\33\2342\226H\335\220\21\242\\345\235\215\e\272\326\216d\253\360\240f\363\0\371\267\320(v\6u\324wyN", ) == 0x0
 02045   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02046   588   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02047   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{\21p\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\271\226D\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02048   420   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02049   420   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02050   420   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02051   420   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02052   420   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02053   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02045   896   NtCreateThread  ... 360, {1252, 1652}, ) == 0x0
 02046   588   NtSetInformationThread  ... ) == 0x0
 02054   896   NtQueryInformationThread  (360, Basic, 28, ...
 02053   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02054   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 02055   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02056   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0t\6\0\0" ...  ...
 02055   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02056   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 02057   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02058   588   NtWaitForSingleObject  (216, 0, 0x0, ...
 02057   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02059   896   NtResumeThread  (360, ...
 02060   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "a\14\323$\244\343\354\266\240@\322\26{\373\226\22\342\33i\235\15K\310$\350Ya|\307@1\3205\24\326\341\207\321\2\324\220\377\35\346\370\31R\3572\21\235\334\313\5\321\354>\346<\237i\354[\354r_\225Y\223\234Jo\364\34\360%sT4\14", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "a\14\323$\244\343\354\266\240@\322\26{\373\226\22\342\33i\235\15K\310$\350Ya|\307@1\3205\24\326\341\207\321\2\324\220\377\35\346\370\31R\3572\21\235\334\313\5\321\354>\346<\237i\354[\354r_\225Y\223\234Jo\364\34\360%sT4\14", 80, ... , 80, ...
 02059   896   NtResumeThread  ... 1, ) == 0x0
 02061   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 49414144, 1048576, ) == 0x0
 02062   896   NtAllocateVirtualMemory  (-1, 50454528, 0, 8192, 4096, 4, ... 50454528, 8192, ) == 0x0
 02063   896   NtProtectVirtualMemory  (-1, (0x301e000), 4096, 260, ... (0x301e000), 4096, 4, ) == 0x0
 02064   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 364, {1252, 1376}, ) == 0x0
 02065   896   NtQueryInformationThread  (364, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 02060   420   NtSetValueKey  ... ) == 0x0
 02066  1652   NtTestAlert  (...
 02067   420   NtClose  (-2147481484, ...
 02066  1652   NtTestAlert  ... ) == 0x0
 02067   420   NtClose  ... ) == 0x0
 02068  1652   NtContinue  (49413424, 1, ...
 02047   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "o\306Eq\210)v\300\215\3233\357n\231\347\306\210\364\361\362/E\26x`Y4\251\7\314Z\31\213E\27\215\33"\367\224_\224\305\247TL0\0:\314(j(\351\365\202;3\225\311\27P\266\251\263\270\271v;r\250\21w\300\244\334T\357F>?\237\202\350X\372n\374\206\341-\327#\342\260cP\202\34\353\230\262\272\340-\244\311>\327\15r\206\331\230\272\322\0!].\256"\3630\324\264\316\356\326B\341+k\6q\264S\200\245\314\354\11\4>=v\255\257\275f\311\363\4\334\26\277fqX*\206\235\335\334\233\316\357~\232\33G\341eN2\227;7s\215\35\15\324kc\230PM*\372\232\267e\326\216\303\240'm\312\ I\231\260\305\207\300\304\204\250\36\14\245J0\253\213O\25I\351\27L/\265\20\252\274\\327m\2060\303\14\3511\6K\273\347\315\311\145\33\332nX\0f\37\37E", ) \367\224_\224\305\247TL0\0:\314(j(\351\365\202;3\225\311\27P\266\251\263\270\271v;r\250\21w\300\244\334T\357F>?\237\202\350X\372n\374\206\341-\327#\342\260cP\202\34\353\230\262\272\340-\244\311>\327\15r\206\331\230\272\322\0!].\256 ... {status=0x0, info=256}, "o\306Eq\210)v\300\215\3233\357n\231\347\306\210\364\361\362/E\26x`Y4\251\7\314Z\31\213E\27\215\33"\367\224_\224\305\247TL0\0:\314(j(\351\365\202;3\225\311\27P\266\251\263\270\271v;r\250\21w\300\244\334T\357F>?\237\202\350X\372n\374\206\341-\327#\342\260cP\202\34\353\230\262\272\340-\244\311>\327\15r\206\331\230\272\322\0!].\256"\3630\324\264\316\356\326B\341+k\6q\264S\200\245\314\354\11\4>=v\255\257\275f\311\363\4\334\26\277fqX*\206\235\335\334\233\316\357~\232\33G\341eN2\227;7s\215\35\15\324kc\230PM*\372\232\267e\326\216\303\240'm\312\ I\231\260\305\207\300\304\204\250\36\14\245J0\253\213O\25I\351\27L/\265\20\252\274\\327m\2060\303\14\3511\6K\273\347\315\311\145\33\332nX\0f\37\37E", ) , ) == 0x0
 02069  1652   NtRegisterThreadTerminatePort  (24, ...
 02070   420   NtDeviceIoControlFile  (308, 0, 0x0, 0x0, 0x390008,  (308, 0, 0x0, 0x0, 0x390008, "\343\254.\330\310)K\2415\277CW?{\21p\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\374\242\354$H\232\241\271\226D\314:e\31\377\227\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02069  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 02071   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02072   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0`\5\0\0" ...  ...
 02073  1652   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02072   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 02074   896   NtResumeThread  (364, ... 1, ) == 0x0
 02075   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 50462720, 1048576, ) == 0x0
 02076   896   NtAllocateVirtualMemory  (-1, 51503104, 0, 8192, 4096, 4, ... 51503104, 8192, ) == 0x0
 02077   896   NtProtectVirtualMemory  (-1, (0x311e000), 4096, 260, ... (0x311e000), 4096, 4, ) == 0x0
 02078   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02071   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02073  1652   NtSetInformationThread  ... ) == 0x0
 02079  1376   NtTestAlert  (...
 02080   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02078   896   NtCreateThread  ... 368, {1252, 1436}, ) == 0x0
 02079  1376   NtTestAlert  ... ) == 0x0
 02080   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02081   896   NtQueryInformationThread  (368, Basic, 28, ...
 02082  1376   NtContinue  (50462000, 1, ...
 02083   420   NtQuerySystemInformation  (Performance, 312, ...
 02081   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 02084  1376   NtRegisterThreadTerminatePort  (24, ...
 02083   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02085   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0\234\5\0\0" ...  ...
 02084  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 02086   420   NtQuerySystemInformation  (Exception, 16, ...
 02085   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 02087  1652   NtWaitForSingleObject  (216, 0, 0x0, ...
 02088  1376   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02086   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02089   896   NtResumeThread  (368, ...
 02090   420   NtQuerySystemInformation  (Lookaside, 32, ...
 02089   896   NtResumeThread  ... 1, ) == 0x0
 02090   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02091   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02092   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02091   896   NtAllocateVirtualMemory  ... 51511296, 1048576, ) == 0x0
 02092   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02093   896   NtAllocateVirtualMemory  (-1, 52551680, 0, 8192, 4096, 4, ...
 02094   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02093   896   NtAllocateVirtualMemory  ... 52551680, 8192, ) == 0x0
 02088  1376   NtSetInformationThread  ... ) == 0x0
 02095  1436   NtTestAlert  (...
 02094   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02096   896   NtProtectVirtualMemory  (-1, (0x321e000), 4096, 260, ...
 02095  1436   NtTestAlert  ... ) == 0x0
 02097   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02096   896   NtProtectVirtualMemory  ... (0x321e000), 4096, 4, ) == 0x0
 02098  1436   NtContinue  (51510576, 1, ...
 02097   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02099   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02100  1436   NtRegisterThreadTerminatePort  (24, ...
 02101   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\201Jic<\375\320.\323\346\210\317M\210m\5\234\346p\213\355\341\304\317"\271U\300?\213z\277\365\2465c\341\260:\370i$\324L\235\372\246~\2557JT\364\341\304\257\24U\12\30\306\376P]\206\312\240\261\61\11\276\2561j^\376\306*\324", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\201Jic<\375\320.\323\346\210\317M\210m\5\234\346p\213\355\341\304\317"\271U\300?\213z\277\365\2465c\341\260:\370i$\324L\235\372\246~\2557JT\364\341\304\257\24U\12\30\306\376P]\206\312\240\261\61\11\276\2561j^\376\306*\324", 80, ... \271U\300?\213z\277\365\2465c\341\260:\370i$\324L\235\372\246~\2557JT\364\341\304\257\24U\12\30\306\376P]\206\312\240\261\61\11\276\2561j^\376\306*\324", 80, ...
 02099   896   NtCreateThread  ... 372, {1252, 1368}, ) == 0x0
 02100  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 02101   420   NtSetValueKey  ... ) == 0x0
 02102   896   NtQueryInformationThread  (372, Basic, 28, ...
 02103  1376   NtWaitForSingleObject  (216, 0, 0x0, ...
 02104   420   NtClose  (-2147481484, ...
 02102   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 02105  1436   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02104   420   NtClose  ... ) == 0x0
 02070   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\373\332\343\331s\267\271\272\337\375\34z(i\304}^s\353{\227\312 \362\252\307>\221p\344\2279\25+\3567Xo\336\5y\375\305\273\214\237i\24\370cK\232^z\230\346\203\212\255\210\367# \370c\203\203\1\273\263\302N}\0\305\313\231@\227i\337\3069\1X<\255\300\13R[V\244\272\2\233\356\217\244\21)Vn<\356\364c\2\257W\25\344\373\310\304\3\224n\246q\327h\353\364f\260\316G\23j\246\310\3338\32\6h\312\254\17\22\30+\221kU^\216\13}~)Y/\202\375\306s\350nd\355\373\376a_\7F\226\345J_76,\302"\251\234\267\36h\306NcQW]\273P\222w\353\363\255\214\354\326\226]1\363\243\22\315\326!\217f1@U\353_M\12\14z\325Jg\332\276N\352\36aM\331fI-\244ZR\353\245\226\346\352\0\326\322S\354@6S[\247\274\264\267\211\254", ) \251\234\267\36h\306NcQW]\273P\222w\353\363\255\214\354\326\226]1\363\243\22\315\326!\217f1@U\353_M\12\14z\325Jg\332\276N\352\36aM\331fI-\244ZR\353\245\226\346\352\0\326\322S\354@6S[\247\274\264\267\211\254", ) == 0x0
 02106   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 02107   420   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 02108   420   NtOpenKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "ActiveComputerName"}, ... 384, ) }, ... 384, ) == 0x0
 02109   420   NtQueryValueKey  (384,  (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02110   420   NtClose  (384, ... ) == 0x0
 02111   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\1\0\0\344\4\0\0X\5\0\0" ...  ...
 02105  1436   NtSetInformationThread  ... ) == 0x0
 02111   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\1\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 02112   420   NtClose  (380, ...
 02113  1436   NtWaitForSingleObject  (216, 0, 0x0, ...
 02112   420   NtClose  ... ) == 0x0
 02114   896   NtResumeThread  (372, ...
 02115   420   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ...
 02114   896   NtResumeThread  ... 1, ) == 0x0
 02115   420   NtCreateIoCompletion  ... 380, ) == 0x0
 02116   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02117   420   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ...
 02116   896   NtAllocateVirtualMemory  ... 52559872, 1048576, ) == 0x0
 02117   420   NtCreateIoCompletion  ... 384, ) == 0x0
 02118   896   NtAllocateVirtualMemory  (-1, 53600256, 0, 8192, 4096, 4, ...
 02119  1368   NtTestAlert  (...
 02118   896   NtAllocateVirtualMemory  ... 53600256, 8192, ) == 0x0
 02119  1368   NtTestAlert  ... ) == 0x0
 02120   420   NtDuplicateObject  (-1, 380, -1, 0x0, 0, 2, ...
 02121  1368   NtContinue  (52559152, 1, ...
 02120   420   NtDuplicateObject  ... 388, ) == 0x0
 02122  1368   NtRegisterThreadTerminatePort  (24, ...
 02123   420   NtOpenThreadToken  (-2, 0xc, 1, ...
 02122  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 02123   420   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02124   896   NtProtectVirtualMemory  (-1, (0x331e000), 4096, 260, ...
 02125   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02124   896   NtProtectVirtualMemory  ... (0x331e000), 4096, 4, ) == 0x0
 02125   420   NtCreateEvent  ... 392, ) == 0x0
 02126   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02127  1368   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02126   896   NtCreateThread  ... 396, {1252, 724}, ) == 0x0
 02128   896   NtQueryInformationThread  (396, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 02129   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\324\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 02130   896   NtResumeThread  (396, ... 1, ) == 0x0
 02131   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02132   420   NtOpenThreadToken  (-2, 0xc, 1, ...
 02133   724   NtTestAlert  (...
 02127  1368   NtSetInformationThread  ... ) == 0x0
 02132   420   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02133   724   NtTestAlert  ... ) == 0x0
 02131   896   NtAllocateVirtualMemory  ... 53608448, 1048576, ) == 0x0
 02134   420   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02135   724   NtContinue  (53607728, 1, ...
 02136   896   NtAllocateVirtualMemory  (-1, 54648832, 0, 8192, 4096, 4, ...
 02134   420   NtSetInformationThread  ... ) == 0x0
 02137   724   NtRegisterThreadTerminatePort  (24, ...
 02136   896   NtAllocateVirtualMemory  ... 54648832, 8192, ) == 0x0
 02138   420   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 13496512,  (0xc0100080, {24, 0, 0x40, 0, 13496512, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02137   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 02139   896   NtProtectVirtualMemory  (-1, (0x341e000), 4096, 260, ...
 02138   420   NtCreateFile  ... 400, {status=0x0, info=1}, ) == 0x0
 02140  1368   NtWaitForSingleObject  (216, 0, 0x0, ...
 02139   896   NtProtectVirtualMemory  ... (0x341e000), 4096, 4, ) == 0x0
 02141   420   NtSetInformationFile  (400, 13496568, 8, Pipe, ...
 02142   724   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02143   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02141   420   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02142   724   NtSetInformationThread  ... ) == 0x0
 02144   420   NtSetInformationFile  (400, 13496556, 8, Completion, ...
 02143   896   NtCreateThread  ... 404, {1252, 1276}, ) == 0x0
 02144   420   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02145   896   NtQueryInformationThread  (404, Basic, 28, ...
 02146   420   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02145   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 02146   420   NtSetInformationThread  ... ) == 0x0
 02147   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\374\4\0\0" ...  ...
 02148   724   NtWaitForSingleObject  (216, 0, 0x0, ...
 02147   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 02149   420   NtWriteFile  (400, 265, 0, 0,  (400, 265, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02150   420   NtReadFile  (400, 265, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (400, 265, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02151   420   NtFsControlFile  (400, 265, 0x0, 0x0, 0x11c017,  (400, 265, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\315\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (400, 265, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\315\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02152   420   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 02153   420   NtFsControlFile  (400, 265, 0x0, 0x0, 0x11c017,  (400, 265, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\1\0\0\0\1\0\0\0&\0(\0\340\363\24\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , 136, 1024, ... {status=0x103, info=48},  (400, 265, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\1\0\0\0\1\0\0\0&\0(\0\340\363\24\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , ) == 0x103
 02154   420   NtFsControlFile  (400, 265, 0x0, 0x0, 0x11c017,  (400, 265, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\30\31\25\0\1\0\0\0$\31\25\0 \0\0\0\1\0\0\0\30\0\32\00\31\25\0L\31\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\370 \25\0\1\0\0\0\5\0i\0\10!\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=156},  (400, 265, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\30\31\25\0\1\0\0\0$\31\25\0 \0\0\0\1\0\0\0\30\0\32\00\31\25\0L\31\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\370 \25\0\1\0\0\0\5\0i\0\10!\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02155   420   NtClose  (392, ... ) == 0x0
 02156   420   NtClose  (400, ... ) == 0x0
 02157   420   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1383984, 0x0, 13498436, 188, ... , {12, 2, 1, 1}, 0x0, 1383984, 0x0, 13498436, 188, ...
 02158   896   NtResumeThread  (404, ... 1, ) == 0x0
 02159   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 54657024, 1048576, ) == 0x0
 02160   896   NtAllocateVirtualMemory  (-1, 55697408, 0, 8192, 4096, 4, ... 55697408, 8192, ) == 0x0
 02157   420   NtSecureConnectPort  ... 400, 0x0, 0x0, 0x0, 188, ) == 0x0
 02161  1276   NtTestAlert  (...
 02162   420   NtOpenThreadToken  (-2, 0xc, 1, ...
 02161  1276   NtTestAlert  ... ) == 0x0
 02162   420   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02163  1276   NtContinue  (54656304, 1, ...
 02164   420   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02165  1276   NtRegisterThreadTerminatePort  (24, ...
 02164   420   NtSetInformationThread  ... ) == 0x0
 02165  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 02166   420   NtRequestWaitReplyPort  (400, {200, 224, new_msg, 0, 1366384, 12, 2, 1310977}  (400, {200, 224, new_msg, 0, 1366384, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\2\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0[\220\5\27\213\23\273"hn#\257X\34N\365\12\0\0\0\365Ab1\32(js\0\0\0\08\365\24\0\355\371A\17\26v\37\245(\0\0\0{\241\0\230\0\0\24\0\240\366\315\0\266g\237R\0\0\0\0\320\22\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\315\0\372\31\221|X\376\315\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... hn#\257X\34N\365\12\0\0\0\365Ab1\32(js\0\0\0\08\365\24\0\355\371A\17\26v\37\245(\0\0\0{\241\0\230\0\0\24\0\240\366\315\0\266g\237R\0\0\0\0\320\22\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\315\0\372\31\221|X\376\315\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...
 02167   896   NtProtectVirtualMemory  (-1, (0x351e000), 4096, 260, ...
 02168  1276   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02167   896   NtProtectVirtualMemory  ... (0x351e000), 4096, 4, ) == 0x0
 02169   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 392, {1252, 220}, ) == 0x0
 02170   896   NtQueryInformationThread  (392, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 02171   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 02172   896   NtResumeThread  (392, ... 1, ) == 0x0
 02173   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02166   420   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 420, 81892, 0}  ... {200, 224, reply, 0, 1252, 420, 81892, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\2\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0[\220\5\27\213\23\273"hn#\257X\34N\365\12\0\0\0\365Ab1\32(js\0\0\0\08\365\24\0\355\371A\17\26v\37\245(\0\0\0{\241\0\230\0\0\24\0\240\366\315\0\266g\237R\0\0\0\0\320\22\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\315\0\372\31\221|X\376\315\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) hn#\257X\34N\365\12\0\0\0\365Ab1\32(js\0\0\0\08\365\24\0\355\371A\17\26v\37\245(\0\0\0{\241\0\230\0\0\24\0\240\366\315\0\266g\237R\0\0\0\0\320\22\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\315\0\372\31\221|X\376\315\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) == 0x0
 02168  1276   NtSetInformationThread  ... ) == 0x0
 02174   220   NtTestAlert  (...
 02175   420   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02173   896   NtAllocateVirtualMemory  ... 55705600, 1048576, ) == 0x0
 02174   220   NtTestAlert  ... ) == 0x0
 02175   420   NtSetInformationThread  ... ) == 0x0
 02176   896   NtAllocateVirtualMemory  (-1, 56745984, 0, 8192, 4096, 4, ...
 02177   220   NtContinue  (55704880, 1, ...
 02178   420   NtRequestWaitReplyPort  (400, {56, 80, new_msg, 0, 44, 3, 20, 0}  (400, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0gS\263F\252\227\2L\355h\28\1\0\0\0\0\0\0\0&\0(\0\24\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02176   896   NtAllocateVirtualMemory  ... 56745984, 8192, ) == 0x0
 02179   220   NtRegisterThreadTerminatePort  (24, ...
 02180   896   NtProtectVirtualMemory  (-1, (0x361e000), 4096, 260, ...
 02179   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 02180   896   NtProtectVirtualMemory  ... (0x361e000), 4096, 4, ) == 0x0
 02181  1276   NtWaitForSingleObject  (216, 0, 0x0, ...
 02182   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02183   220   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 02184   220   NtWaitForSingleObject  (216, 0, 0x0, ...
 02182   896   NtCreateThread  ... 408, {1252, 1328}, ) == 0x0
 02185   896   NtQueryInformationThread  (408, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 02186   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\00\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 02187   896   NtResumeThread  (408, ... 1, ) == 0x0
 02188   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 56754176, 1048576, ) == 0x0
 02189   896   NtAllocateVirtualMemory  (-1, 57794560, 0, 8192, 4096, 4, ... 57794560, 8192, ) == 0x0
 02190  1328   NtTestAlert  (... ) == 0x0
 02191  1328   NtContinue  (56753456, 1, ...
 02192  1328   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02193  1328   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02194   896   NtProtectVirtualMemory  (-1, (0x371e000), 4096, 260, ... (0x371e000), 4096, 4, ) == 0x0
 02195   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 412, {1252, 1636}, ) == 0x0
 02196   896   NtQueryInformationThread  (412, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 02178   420   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 420, 81893, 0}  ... {44, 68, reply, 0, 1252, 420, 81893, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02197   420   NtRaiseException  (13498896, 13498156, 1, ...
 02198   420   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02199   420   NtContinue  (13497124, 0, ...
 02200   420   NtDeviceIoControlFile  (276, 200, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ... {status=0x0, info=0}, "", ) == 0x103
 02201   420   NtWaitForSingleObject  (200, 1, {-5000000, -1}, ...
 02202   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0d\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 02203   896   NtResumeThread  (412, ... 1, ) == 0x0
 02204   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02205  1636   NtTestAlert  (... ) == 0x0
 02206  1636   NtContinue  (57802032, 1, ...
 02207  1636   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02208  1636   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02204   896   NtAllocateVirtualMemory  ... 57802752, 1048576, ) == 0x0
 02209   896   NtAllocateVirtualMemory  (-1, 58843136, 0, 8192, 4096, 4, ... 58843136, 8192, ) == 0x0
 02210   896   NtProtectVirtualMemory  (-1, (0x381e000), 4096, 260, ... (0x381e000), 4096, 4, ) == 0x0
 02211   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 416, {1252, 704}, ) == 0x0
 02212   896   NtQueryInformationThread  (416, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=704,}, 0x0, ) == 0x0
 02213   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\300\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\300\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\300\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\300\2\0\0" )  ) == 0x0
 02214   896   NtResumeThread  (416, ... 1, ) == 0x0
 02215   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 58851328, 1048576, ) == 0x0
 02216   896   NtAllocateVirtualMemory  (-1, 59891712, 0, 8192, 4096, 4, ... 59891712, 8192, ) == 0x0
 02217   704   NtTestAlert  (... ) == 0x0
 02218   704   NtContinue  (58850608, 1, ...
 02219   704   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02220   704   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02221   896   NtProtectVirtualMemory  (-1, (0x391e000), 4096, 260, ... (0x391e000), 4096, 4, ) == 0x0
 02222   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 420, {1252, 1152}, ) == 0x0
 02223   896   NtQueryInformationThread  (420, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 02224   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\200\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 02225   896   NtResumeThread  (420, ... 1, ) == 0x0
 02226   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02227  1152   NtTestAlert  (... ) == 0x0
 02228  1152   NtContinue  (59899184, 1, ...
 02229  1152   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02230  1152   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02226   896   NtAllocateVirtualMemory  ... 59899904, 1048576, ) == 0x0
 02231   896   NtAllocateVirtualMemory  (-1, 60940288, 0, 8192, 4096, 4, ... 60940288, 8192, ) == 0x0
 02232   896   NtProtectVirtualMemory  (-1, (0x3a1e000), 4096, 260, ... (0x3a1e000), 4096, 4, ) == 0x0
 02233   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 424, {1252, 1228}, ) == 0x0
 02234   896   NtQueryInformationThread  (424, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 02235   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\314\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\314\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\314\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 02236   896   NtResumeThread  (424, ... 1, ) == 0x0
 02237   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 60948480, 1048576, ) == 0x0
 02238   896   NtAllocateVirtualMemory  (-1, 61988864, 0, 8192, 4096, 4, ... 61988864, 8192, ) == 0x0
 02239  1228   NtTestAlert  (... ) == 0x0
 02240  1228   NtContinue  (60947760, 1, ...
 02241  1228   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02242  1228   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02243   896   NtProtectVirtualMemory  (-1, (0x3b1e000), 4096, 260, ... (0x3b1e000), 4096, 4, ) == 0x0
 02244   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 428, {1252, 792}, ) == 0x0
 02245   896   NtQueryInformationThread  (428, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 02246   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0\30\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0\30\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0\30\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 02247   896   NtResumeThread  (428, ... 1, ) == 0x0
 02248   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02249   792   NtTestAlert  (... ) == 0x0
 02250   792   NtContinue  (61996336, 1, ...
 02251   792   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02252   792   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02248   896   NtAllocateVirtualMemory  ... 61997056, 1048576, ) == 0x0
 02253   896   NtAllocateVirtualMemory  (-1, 63037440, 0, 8192, 4096, 4, ... 63037440, 8192, ) == 0x0
 02254   896   NtProtectVirtualMemory  (-1, (0x3c1e000), 4096, 260, ... (0x3c1e000), 4096, 4, ) == 0x0
 02255   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 432, {1252, 1484}, ) == 0x0
 02256   896   NtQueryInformationThread  (432, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 02257   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 02258   896   NtResumeThread  (432, ... 1, ) == 0x0
 02259   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 63045632, 1048576, ) == 0x0
 02260   896   NtAllocateVirtualMemory  (-1, 64086016, 0, 8192, 4096, 4, ... 64086016, 8192, ) == 0x0
 02261  1484   NtAllocateVirtualMemory  (-1, 8871936, 0, 4096, 4096, 4, ... 8871936, 4096, ) == 0x0
 02262  1484   NtTestAlert  (... ) == 0x0
 02263  1484   NtContinue  (63044912, 1, ...
 02264  1484   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02265  1484   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02266   896   NtProtectVirtualMemory  (-1, (0x3d1e000), 4096, 260, ... (0x3d1e000), 4096, 4, ) == 0x0
 02267   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 436, {1252, 888}, ) == 0x0
 02268   896   NtQueryInformationThread  (436, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=888,}, 0x0, ) == 0x0
 02269   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0x\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0x\3\0\0" )  ) == 0x0
 02270   896   NtResumeThread  (436, ... 1, ) == 0x0
 02271   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02272   888   NtTestAlert  (... ) == 0x0
 02273   888   NtContinue  (64093488, 1, ...
 02274   888   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02275   888   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02271   896   NtAllocateVirtualMemory  ... 64094208, 1048576, ) == 0x0
 02276   896   NtAllocateVirtualMemory  (-1, 65134592, 0, 8192, 4096, 4, ... 65134592, 8192, ) == 0x0
 02277   896   NtProtectVirtualMemory  (-1, (0x3e1e000), 4096, 260, ... (0x3e1e000), 4096, 4, ) == 0x0
 02278   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 440, {1252, 1120}, ) == 0x0
 02279   896   NtQueryInformationThread  (440, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 02280   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0`\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 02281   896   NtResumeThread  (440, ... 1, ) == 0x0
 02282   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 65142784, 1048576, ) == 0x0
 02283   896   NtAllocateVirtualMemory  (-1, 66183168, 0, 8192, 4096, 4, ... 66183168, 8192, ) == 0x0
 02284  1120   NtTestAlert  (... ) == 0x0
 02285  1120   NtContinue  (65142064, 1, ...
 02286  1120   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02287  1120   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02288   896   NtProtectVirtualMemory  (-1, (0x3f1e000), 4096, 260, ... (0x3f1e000), 4096, 4, ) == 0x0
 02289   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 444, {1252, 840}, ) == 0x0
 02290   896   NtQueryInformationThread  (444, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 02291   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0H\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0H\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0H\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 02292   896   NtResumeThread  (444, ... 1, ) == 0x0
 02293   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02294   840   NtTestAlert  (... ) == 0x0
 02295   840   NtContinue  (66190640, 1, ...
 02296   840   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02297   840   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02293   896   NtAllocateVirtualMemory  ... 66191360, 1048576, ) == 0x0
 02298   896   NtAllocateVirtualMemory  (-1, 67231744, 0, 8192, 4096, 4, ... 67231744, 8192, ) == 0x0
 02299   896   NtProtectVirtualMemory  (-1, (0x401e000), 4096, 260, ... (0x401e000), 4096, 4, ) == 0x0
 02300   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 448, {1252, 876}, ) == 0x0
 02301   896   NtQueryInformationThread  (448, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 02302   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0l\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 02303   896   NtResumeThread  (448, ... 1, ) == 0x0
 02304   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02305   876   NtTestAlert  (... ) == 0x0
 02306   876   NtContinue  (67239216, 1, ...
 02307   876   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02308   876   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02304   896   NtAllocateVirtualMemory  ... 67239936, 1048576, ) == 0x0
 02309   896   NtAllocateVirtualMemory  (-1, 68280320, 0, 8192, 4096, 4, ... 68280320, 8192, ) == 0x0
 02310   896   NtProtectVirtualMemory  (-1, (0x411e000), 4096, 260, ... (0x411e000), 4096, 4, ) == 0x0
 02311   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 452, {1252, 1104}, ) == 0x0
 02312   896   NtQueryInformationThread  (452, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 02313   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0P\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81905, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 02314   896   NtResumeThread  (452, ... 1, ) == 0x0
 02315   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 68288512, 1048576, ) == 0x0
 02316   896   NtAllocateVirtualMemory  (-1, 69328896, 0, 8192, 4096, 4, ... 69328896, 8192, ) == 0x0
 02317  1104   NtTestAlert  (... ) == 0x0
 02318  1104   NtContinue  (68287792, 1, ...
 02319  1104   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02320  1104   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02321   896   NtProtectVirtualMemory  (-1, (0x421e000), 4096, 260, ... (0x421e000), 4096, 4, ) == 0x0
 02322   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 456, {1252, 860}, ) == 0x0
 02323   896   NtQueryInformationThread  (456, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02324   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02325   896   NtResumeThread  (456, ... 1, ) == 0x0
 02326   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02327   860   NtTestAlert  (... ) == 0x0
 02328   860   NtContinue  (69336368, 1, ...
 02329   860   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02330   860   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02326   896   NtAllocateVirtualMemory  ... 69337088, 1048576, ) == 0x0
 02331   896   NtAllocateVirtualMemory  (-1, 70377472, 0, 8192, 4096, 4, ... 70377472, 8192, ) == 0x0
 02332   896   NtProtectVirtualMemory  (-1, (0x431e000), 4096, 260, ... (0x431e000), 4096, 4, ) == 0x0
 02333   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 460, {1252, 1516}, ) == 0x0
 02334   896   NtQueryInformationThread  (460, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 02335   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0\354\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 02336   896   NtResumeThread  (460, ... 1, ) == 0x0
 02337   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 70385664, 1048576, ) == 0x0
 02338   896   NtAllocateVirtualMemory  (-1, 71426048, 0, 8192, 4096, 4, ... 71426048, 8192, ) == 0x0
 02339  1516   NtTestAlert  (... ) == 0x0
 02340  1516   NtContinue  (70384944, 1, ...
 02341  1516   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02342  1516   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02343   896   NtProtectVirtualMemory  (-1, (0x441e000), 4096, 260, ... (0x441e000), 4096, 4, ) == 0x0
 02344   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 464, {1252, 780}, ) == 0x0
 02345   896   NtQueryInformationThread  (464, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02346   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02347   896   NtResumeThread  (464, ... 1, ) == 0x0
 02348   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02349   780   NtTestAlert  (... ) == 0x0
 02350   780   NtContinue  (71433520, 1, ...
 02351   780   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02352   780   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02348   896   NtAllocateVirtualMemory  ... 71434240, 1048576, ) == 0x0
 02353   896   NtAllocateVirtualMemory  (-1, 72474624, 0, 8192, 4096, 4, ... 72474624, 8192, ) == 0x0
 02354   896   NtProtectVirtualMemory  (-1, (0x451e000), 4096, 260, ... (0x451e000), 4096, 4, ) == 0x0
 02355   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 468, {1252, 940}, ) == 0x0
 02356   896   NtQueryInformationThread  (468, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 02357   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 02358   896   NtResumeThread  (468, ... 1, ) == 0x0
 02359   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 72482816, 1048576, ) == 0x0
 02360   896   NtAllocateVirtualMemory  (-1, 73523200, 0, 8192, 4096, 4, ... 73523200, 8192, ) == 0x0
 02361   940   NtTestAlert  (... ) == 0x0
 02362   940   NtContinue  (72482096, 1, ...
 02363   940   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02364   940   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02365   896   NtProtectVirtualMemory  (-1, (0x461e000), 4096, 260, ... (0x461e000), 4096, 4, ) == 0x0
 02366   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 472, {1252, 1268}, ) == 0x0
 02367   896   NtQueryInformationThread  (472, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02368   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 02369   896   NtResumeThread  (472, ... 1, ) == 0x0
 02370   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02371  1268   NtTestAlert  (... ) == 0x0
 02372  1268   NtContinue  (73530672, 1, ...
 02373  1268   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02374  1268   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02370   896   NtAllocateVirtualMemory  ... 73531392, 1048576, ) == 0x0
 02375   896   NtAllocateVirtualMemory  (-1, 74571776, 0, 8192, 4096, 4, ... 74571776, 8192, ) == 0x0
 02376   896   NtProtectVirtualMemory  (-1, (0x471e000), 4096, 260, ... (0x471e000), 4096, 4, ) == 0x0
 02377   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 476, {1252, 644}, ) == 0x0
 02378   896   NtQueryInformationThread  (476, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 02379   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\204\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 02380   896   NtResumeThread  (476, ... 1, ) == 0x0
 02381   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74579968, 1048576, ) == 0x0
 02382   896   NtAllocateVirtualMemory  (-1, 75620352, 0, 8192, 4096, 4, ... 75620352, 8192, ) == 0x0
 02383   644   NtTestAlert  (... ) == 0x0
 02384   644   NtContinue  (74579248, 1, ...
 02385   644   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02386   644   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02387   896   NtProtectVirtualMemory  (-1, (0x481e000), 4096, 260, ... (0x481e000), 4096, 4, ) == 0x0
 02388   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 480, {1252, 1736}, ) == 0x0
 02389   896   NtQueryInformationThread  (480, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02390   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02391   896   NtResumeThread  (480, ... 1, ) == 0x0
 02392   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02393  1736   NtTestAlert  (... ) == 0x0
 02394  1736   NtContinue  (75627824, 1, ...
 02395  1736   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02396  1736   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02392   896   NtAllocateVirtualMemory  ... 75628544, 1048576, ) == 0x0
 02397   896   NtAllocateVirtualMemory  (-1, 76668928, 0, 8192, 4096, 4, ... 76668928, 8192, ) == 0x0
 02398   896   NtProtectVirtualMemory  (-1, (0x491e000), 4096, 260, ... (0x491e000), 4096, 4, ) == 0x0
 02399   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 484, {1252, 320}, ) == 0x0
 02400   896   NtQueryInformationThread  (484, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 02401   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 02402   896   NtResumeThread  (484, ... 1, ) == 0x0
 02403   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 76677120, 1048576, ) == 0x0
 02404   896   NtAllocateVirtualMemory  (-1, 77717504, 0, 8192, 4096, 4, ... 77717504, 8192, ) == 0x0
 02405   320   NtTestAlert  (... ) == 0x0
 02406   320   NtContinue  (76676400, 1, ...
 02407   320   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02408   320   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02409   896   NtProtectVirtualMemory  (-1, (0x4a1e000), 4096, 260, ... (0x4a1e000), 4096, 4, ) == 0x0
 02410   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 488, {1252, 380}, ) == 0x0
 02411   896   NtQueryInformationThread  (488, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 02412   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 02413   896   NtResumeThread  (488, ... 1, ) == 0x0
 02414   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02415   380   NtTestAlert  (... ) == 0x0
 02416   380   NtContinue  (77724976, 1, ...
 02417   380   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02418   380   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02414   896   NtAllocateVirtualMemory  ... 77725696, 1048576, ) == 0x0
 02419   896   NtAllocateVirtualMemory  (-1, 78766080, 0, 8192, 4096, 4, ... 78766080, 8192, ) == 0x0
 02420   896   NtProtectVirtualMemory  (-1, (0x4b1e000), 4096, 260, ... (0x4b1e000), 4096, 4, ) == 0x0
 02421   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 492, {1252, 1332}, ) == 0x0
 02422   896   NtQueryInformationThread  (492, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 02423   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 02424   896   NtResumeThread  (492, ... 1, ) == 0x0
 02425   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78774272, 1048576, ) == 0x0
 02426   896   NtAllocateVirtualMemory  (-1, 79814656, 0, 8192, 4096, 4, ... 79814656, 8192, ) == 0x0
 02427  1332   NtTestAlert  (... ) == 0x0
 02428  1332   NtContinue  (78773552, 1, ...
 02429  1332   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02430  1332   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02431   896   NtProtectVirtualMemory  (-1, (0x4c1e000), 4096, 260, ... (0x4c1e000), 4096, 4, ) == 0x0
 02432   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 496, {1252, 1336}, ) == 0x0
 02433   896   NtQueryInformationThread  (496, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02434   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02435   896   NtResumeThread  (496, ... 1, ) == 0x0
 02436   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02437  1336   NtTestAlert  (... ) == 0x0
 02438  1336   NtContinue  (79822128, 1, ...
 02439  1336   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02440  1336   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02436   896   NtAllocateVirtualMemory  ... 79822848, 1048576, ) == 0x0
 02441   896   NtAllocateVirtualMemory  (-1, 80863232, 0, 8192, 4096, 4, ... 80863232, 8192, ) == 0x0
 02442   896   NtProtectVirtualMemory  (-1, (0x4d1e000), 4096, 260, ... (0x4d1e000), 4096, 4, ) == 0x0
 02443   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 500, {1252, 1808}, ) == 0x0
 02444   896   NtQueryInformationThread  (500, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 02445   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\20\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 02446   896   NtResumeThread  (500, ... 1, ) == 0x0
 02447   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 80871424, 1048576, ) == 0x0
 02448   896   NtAllocateVirtualMemory  (-1, 81911808, 0, 8192, 4096, 4, ... 81911808, 8192, ) == 0x0
 02449  1808   NtTestAlert  (... ) == 0x0
 02450  1808   NtContinue  (80870704, 1, ...
 02451  1808   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02452  1808   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02453   896   NtProtectVirtualMemory  (-1, (0x4e1e000), 4096, 260, ... (0x4e1e000), 4096, 4, ) == 0x0
 02454   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 504, {1252, 468}, ) == 0x0
 02455   896   NtQueryInformationThread  (504, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 02456   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 02457   896   NtResumeThread  (504, ... 1, ) == 0x0
 02458   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02459   468   NtTestAlert  (... ) == 0x0
 02460   468   NtContinue  (81919280, 1, ...
 02461   468   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02462   468   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02458   896   NtAllocateVirtualMemory  ... 81920000, 1048576, ) == 0x0
 02463   896   NtAllocateVirtualMemory  (-1, 82960384, 0, 8192, 4096, 4, ... 82960384, 8192, ) == 0x0
 02464   896   NtProtectVirtualMemory  (-1, (0x4f1e000), 4096, 260, ... (0x4f1e000), 4096, 4, ) == 0x0
 02465   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 508, {1252, 752}, ) == 0x0
 02466   896   NtQueryInformationThread  (508, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02467   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02468   896   NtResumeThread  (508, ... 1, ) == 0x0
 02469   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 82968576, 1048576, ) == 0x0
 02470   896   NtAllocateVirtualMemory  (-1, 84008960, 0, 8192, 4096, 4, ... 84008960, 8192, ) == 0x0
 02471   752   NtTestAlert  (... ) == 0x0
 02472   752   NtContinue  (82967856, 1, ...
 02473   752   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02474   752   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02475   896   NtProtectVirtualMemory  (-1, (0x501e000), 4096, 260, ... (0x501e000), 4096, 4, ) == 0x0
 02476   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 512, {1252, 1512}, ) == 0x0
 02477   896   NtQueryInformationThread  (512, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 02478   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 02479   896   NtResumeThread  (512, ... 1, ) == 0x0
 02480   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02481  1512   NtTestAlert  (... ) == 0x0
 02482  1512   NtContinue  (84016432, 1, ...
 02483  1512   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02484  1512   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02480   896   NtAllocateVirtualMemory  ... 84017152, 1048576, ) == 0x0
 02485   896   NtAllocateVirtualMemory  (-1, 85057536, 0, 8192, 4096, 4, ... 85057536, 8192, ) == 0x0
 02486   896   NtProtectVirtualMemory  (-1, (0x511e000), 4096, 260, ... (0x511e000), 4096, 4, ) == 0x0
 02487   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 516, {1252, 1380}, ) == 0x0
 02488   896   NtQueryInformationThread  (516, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02489   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02490   896   NtResumeThread  (516, ... 1, ) == 0x0
 02491   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 85065728, 1048576, ) == 0x0
 02492   896   NtAllocateVirtualMemory  (-1, 86106112, 0, 8192, 4096, 4, ... 86106112, 8192, ) == 0x0
 02493  1380   NtTestAlert  (... ) == 0x0
 02494  1380   NtContinue  (85065008, 1, ...
 02495  1380   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02496  1380   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02497   896   NtProtectVirtualMemory  (-1, (0x521e000), 4096, 260, ... (0x521e000), 4096, 4, ) == 0x0
 02498   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 520, {1252, 1564}, ) == 0x0
 02499   896   NtQueryInformationThread  (520, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 02500   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 02501   896   NtResumeThread  (520, ... 1, ) == 0x0
 02502   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02503  1564   NtTestAlert  (... ) == 0x0
 02504  1564   NtContinue  (86113584, 1, ...
 02505  1564   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02506  1564   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02502   896   NtAllocateVirtualMemory  ... 86114304, 1048576, ) == 0x0
 02507   896   NtAllocateVirtualMemory  (-1, 87154688, 0, 8192, 4096, 4, ... 87154688, 8192, ) == 0x0
 02508   896   NtProtectVirtualMemory  (-1, (0x531e000), 4096, 260, ... (0x531e000), 4096, 4, ) == 0x0
 02509   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 524, {1252, 164}, ) == 0x0
 02510   896   NtQueryInformationThread  (524, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 02511   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 02512   896   NtResumeThread  (524, ... 1, ) == 0x0
 02513   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 87162880, 1048576, ) == 0x0
 02514   896   NtAllocateVirtualMemory  (-1, 88203264, 0, 8192, 4096, 4, ... 88203264, 8192, ) == 0x0
 02515   164   NtTestAlert  (... ) == 0x0
 02516   164   NtContinue  (87162160, 1, ...
 02517   164   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02518   164   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02519   896   NtProtectVirtualMemory  (-1, (0x541e000), 4096, 260, ... (0x541e000), 4096, 4, ) == 0x0
 02520   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 528, {1252, 312}, ) == 0x0
 02521   896   NtQueryInformationThread  (528, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 02522   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\08\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 02523   896   NtResumeThread  (528, ... 1, ) == 0x0
 02524   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02525   312   NtTestAlert  (... ) == 0x0
 02526   312   NtContinue  (88210736, 1, ...
 02527   312   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02528   312   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02524   896   NtAllocateVirtualMemory  ... 88211456, 1048576, ) == 0x0
 02529   896   NtAllocateVirtualMemory  (-1, 89251840, 0, 8192, 4096, 4, ... 89251840, 8192, ) == 0x0
 02530   896   NtProtectVirtualMemory  (-1, (0x551e000), 4096, 260, ... (0x551e000), 4096, 4, ) == 0x0
 02531   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 532, {1252, 1964}, ) == 0x0
 02532   896   NtQueryInformationThread  (532, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 02533   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\254\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 02534   896   NtResumeThread  (532, ... 1, ) == 0x0
 02535   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 89260032, 1048576, ) == 0x0
 02536   896   NtAllocateVirtualMemory  (-1, 90300416, 0, 8192, 4096, 4, ... 90300416, 8192, ) == 0x0
 02537  1964   NtTestAlert  (... ) == 0x0
 02538  1964   NtContinue  (89259312, 1, ...
 02539  1964   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02540  1964   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02541   896   NtProtectVirtualMemory  (-1, (0x561e000), 4096, 260, ... (0x561e000), 4096, 4, ) == 0x0
 02542   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 536, {1252, 1568}, ) == 0x0
 02543   896   NtQueryInformationThread  (536, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 02544   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0 \6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 02545   896   NtResumeThread  (536, ... 1, ) == 0x0
 02546   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02547  1568   NtTestAlert  (... ) == 0x0
 02548  1568   NtContinue  (90307888, 1, ...
 02549  1568   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02550  1568   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02546   896   NtAllocateVirtualMemory  ... 90308608, 1048576, ) == 0x0
 02551   896   NtAllocateVirtualMemory  (-1, 91348992, 0, 8192, 4096, 4, ... 91348992, 8192, ) == 0x0
 02552   896   NtProtectVirtualMemory  (-1, (0x571e000), 4096, 260, ... (0x571e000), 4096, 4, ) == 0x0
 02553   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 540, {1252, 1624}, ) == 0x0
 02554   896   NtQueryInformationThread  (540, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1624,}, 0x0, ) == 0x0
 02555   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0X\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0X\6\0\0" )  ) == 0x0
 02556   896   NtResumeThread  (540, ... 1, ) == 0x0
 02557   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 91357184, 1048576, ) == 0x0
 02558   896   NtAllocateVirtualMemory  (-1, 92397568, 0, 8192, 4096, 4, ... 92397568, 8192, ) == 0x0
 02559  1624   NtTestAlert  (... ) == 0x0
 02560  1624   NtContinue  (91356464, 1, ...
 02561  1624   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02562  1624   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02563   896   NtProtectVirtualMemory  (-1, (0x581e000), 4096, 260, ... (0x581e000), 4096, 4, ) == 0x0
 02564   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 544, {1252, 1716}, ) == 0x0
 02565   896   NtQueryInformationThread  (544, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 02566   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\264\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 02567   896   NtResumeThread  (544, ... 1, ) == 0x0
 02568   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02569  1716   NtTestAlert  (... ) == 0x0
 02570  1716   NtContinue  (92405040, 1, ...
 02571  1716   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02572  1716   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02568   896   NtAllocateVirtualMemory  ... 92405760, 1048576, ) == 0x0
 02573   896   NtAllocateVirtualMemory  (-1, 93446144, 0, 8192, 4096, 4, ... 93446144, 8192, ) == 0x0
 02574   896   NtProtectVirtualMemory  (-1, (0x591e000), 4096, 260, ... (0x591e000), 4096, 4, ) == 0x0
 02575   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 548, {1252, 1440}, ) == 0x0
 02576   896   NtQueryInformationThread  (548, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 02577   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\240\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 02578   896   NtResumeThread  (548, ... 1, ) == 0x0
 02579   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 93454336, 1048576, ) == 0x0
 02580   896   NtAllocateVirtualMemory  (-1, 94494720, 0, 8192, 4096, 4, ... 94494720, 8192, ) == 0x0
 02581  1440   NtAllocateVirtualMemory  (-1, 8876032, 0, 4096, 4096, 4, ... 8876032, 4096, ) == 0x0
 02582  1440   NtTestAlert  (... ) == 0x0
 02583  1440   NtContinue  (93453616, 1, ...
 02584  1440   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02585  1440   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02586   896   NtProtectVirtualMemory  (-1, (0x5a1e000), 4096, 260, ... (0x5a1e000), 4096, 4, ) == 0x0
 02587   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 552, {1252, 1664}, ) == 0x0
 02588   896   NtQueryInformationThread  (552, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 02589   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\200\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 02590   896   NtResumeThread  (552, ... 1, ) == 0x0
 02591   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02592  1664   NtTestAlert  (... ) == 0x0
 02593  1664   NtContinue  (94502192, 1, ...
 02594  1664   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02595  1664   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02591   896   NtAllocateVirtualMemory  ... 94502912, 1048576, ) == 0x0
 02596   896   NtAllocateVirtualMemory  (-1, 95543296, 0, 8192, 4096, 4, ... 95543296, 8192, ) == 0x0
 02597   896   NtProtectVirtualMemory  (-1, (0x5b1e000), 4096, 260, ... (0x5b1e000), 4096, 4, ) == 0x0
 02598   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 556, {1252, 1972}, ) == 0x0
 02599   896   NtQueryInformationThread  (556, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 02600   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\264\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 02601   896   NtResumeThread  (556, ... 1, ) == 0x0
 02602   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 95551488, 1048576, ) == 0x0
 02603   896   NtAllocateVirtualMemory  (-1, 96591872, 0, 8192, 4096, 4, ... 96591872, 8192, ) == 0x0
 02604  1972   NtTestAlert  (... ) == 0x0
 02605  1972   NtContinue  (95550768, 1, ...
 02606  1972   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02607  1972   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02608   896   NtProtectVirtualMemory  (-1, (0x5c1e000), 4096, 260, ... (0x5c1e000), 4096, 4, ) == 0x0
 02609   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 560, {1252, 1036}, ) == 0x0
 02610   896   NtQueryInformationThread  (560, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 02611   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\14\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 02612   896   NtResumeThread  (560, ... 1, ) == 0x0
 02613   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02614  1036   NtTestAlert  (... ) == 0x0
 02615  1036   NtContinue  (96599344, 1, ...
 02616  1036   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02617  1036   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02613   896   NtAllocateVirtualMemory  ... 96600064, 1048576, ) == 0x0
 02618   896   NtAllocateVirtualMemory  (-1, 97640448, 0, 8192, 4096, 4, ... 97640448, 8192, ) == 0x0
 02619   896   NtProtectVirtualMemory  (-1, (0x5d1e000), 4096, 260, ... (0x5d1e000), 4096, 4, ) == 0x0
 02620   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 564, {1252, 1248}, ) == 0x0
 02621   896   NtQueryInformationThread  (564, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 02622   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\340\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 02623   896   NtResumeThread  (564, ... 1, ) == 0x0
 02624   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 97648640, 1048576, ) == 0x0
 02625   896   NtAllocateVirtualMemory  (-1, 98689024, 0, 8192, 4096, 4, ... 98689024, 8192, ) == 0x0
 02626  1248   NtTestAlert  (... ) == 0x0
 02627  1248   NtContinue  (97647920, 1, ...
 02628  1248   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02629  1248   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02630   896   NtProtectVirtualMemory  (-1, (0x5e1e000), 4096, 260, ... (0x5e1e000), 4096, 4, ) == 0x0
 02631   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 568, {1252, 1656}, ) == 0x0
 02632   896   NtQueryInformationThread  (568, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 02633   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0x\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0x\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0x\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 02634   896   NtResumeThread  (568, ... 1, ) == 0x0
 02635   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02636  1656   NtTestAlert  (... ) == 0x0
 02637  1656   NtContinue  (98696496, 1, ...
 02638  1656   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02639  1656   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02635   896   NtAllocateVirtualMemory  ... 98697216, 1048576, ) == 0x0
 02640   896   NtAllocateVirtualMemory  (-1, 99737600, 0, 8192, 4096, 4, ... 99737600, 8192, ) == 0x0
 02641   896   NtProtectVirtualMemory  (-1, (0x5f1e000), 4096, 260, ... (0x5f1e000), 4096, 4, ) == 0x0
 02642   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 572, {1252, 760}, ) == 0x0
 02643   896   NtQueryInformationThread  (572, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 02644   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\370\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 02645   896   NtResumeThread  (572, ... 1, ) == 0x0
 02646   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 99745792, 1048576, ) == 0x0
 02647   896   NtAllocateVirtualMemory  (-1, 100786176, 0, 8192, 4096, 4, ... 100786176, 8192, ) == 0x0
 02648   760   NtTestAlert  (... ) == 0x0
 02649   760   NtContinue  (99745072, 1, ...
 02650   760   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02651   760   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02652   896   NtProtectVirtualMemory  (-1, (0x601e000), 4096, 260, ... (0x601e000), 4096, 4, ) == 0x0
 02653   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 576, {1252, 484}, ) == 0x0
 02654   896   NtQueryInformationThread  (576, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=484,}, 0x0, ) == 0x0
 02655   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0\344\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0\344\1\0\0" )  ) == 0x0
 02656   896   NtResumeThread  (576, ... 1, ) == 0x0
 02657   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02658   484   NtTestAlert  (... ) == 0x0
 02659   484   NtContinue  (100793648, 1, ...
 02660   484   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02661   484   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02657   896   NtAllocateVirtualMemory  ... 100794368, 1048576, ) == 0x0
 02662   896   NtAllocateVirtualMemory  (-1, 101834752, 0, 8192, 4096, 4, ... 101834752, 8192, ) == 0x0
 02663   896   NtProtectVirtualMemory  (-1, (0x611e000), 4096, 260, ... (0x611e000), 4096, 4, ) == 0x0
 02664   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 580, {1252, 1580}, ) == 0x0
 02665   896   NtQueryInformationThread  (580, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 02666   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0,\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 02667   896   NtResumeThread  (580, ... 1, ) == 0x0
 02668   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 101842944, 1048576, ) == 0x0
 02669   896   NtAllocateVirtualMemory  (-1, 102883328, 0, 8192, 4096, 4, ... 102883328, 8192, ) == 0x0
 02670  1580   NtTestAlert  (... ) == 0x0
 02671  1580   NtContinue  (101842224, 1, ...
 02672  1580   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02673  1580   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02674   896   NtProtectVirtualMemory  (-1, (0x621e000), 4096, 260, ... (0x621e000), 4096, 4, ) == 0x0
 02675   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 584, {1252, 1756}, ) == 0x0
 02676   896   NtQueryInformationThread  (584, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 02677   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\334\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 02678   896   NtResumeThread  (584, ... 1, ) == 0x0
 02679   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02680  1756   NtTestAlert  (... ) == 0x0
 02681  1756   NtContinue  (102890800, 1, ...
 02682  1756   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02683  1756   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02679   896   NtAllocateVirtualMemory  ... 102891520, 1048576, ) == 0x0
 02684   896   NtAllocateVirtualMemory  (-1, 103931904, 0, 8192, 4096, 4, ... 103931904, 8192, ) == 0x0
 02685   896   NtProtectVirtualMemory  (-1, (0x631e000), 4096, 260, ... (0x631e000), 4096, 4, ) == 0x0
 02686   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 588, {1252, 1304}, ) == 0x0
 02687   896   NtQueryInformationThread  (588, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 02688   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\30\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\30\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 02689   896   NtResumeThread  (588, ... 1, ) == 0x0
 02690   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 103940096, 1048576, ) == 0x0
 02691   896   NtAllocateVirtualMemory  (-1, 104980480, 0, 8192, 4096, 4, ... 104980480, 8192, ) == 0x0
 02692  1304   NtTestAlert  (... ) == 0x0
 02693  1304   NtContinue  (103939376, 1, ...
 02694  1304   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02695  1304   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02696   896   NtProtectVirtualMemory  (-1, (0x641e000), 4096, 260, ... (0x641e000), 4096, 4, ) == 0x0
 02697   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 592, {1252, 2052}, ) == 0x0
 02698   896   NtQueryInformationThread  (592, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=2052,}, 0x0, ) == 0x0
 02699   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\4\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\4\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\4\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\4\10\0\0" )  ) == 0x0
 02700   896   NtResumeThread  (592, ... 1, ) == 0x0
 02701   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02702  2052   NtTestAlert  (... ) == 0x0
 02703  2052   NtContinue  (104987952, 1, ...
 02704  2052   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02705  2052   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02701   896   NtAllocateVirtualMemory  ... 104988672, 1048576, ) == 0x0
 02706   896   NtAllocateVirtualMemory  (-1, 106029056, 0, 8192, 4096, 4, ... 106029056, 8192, ) == 0x0
 02707   896   NtProtectVirtualMemory  (-1, (0x651e000), 4096, 260, ... (0x651e000), 4096, 4, ) == 0x0
 02708   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 596, {1252, 2056}, ) == 0x0
 02709   896   NtQueryInformationThread  (596, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=2056,}, 0x0, ) == 0x0
 02710   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\10\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\10\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\10\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\10\10\0\0" )  ) == 0x0
 02711   896   NtResumeThread  (596, ... 1, ) == 0x0
 02712   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 106037248, 1048576, ) == 0x0
 02713   896   NtAllocateVirtualMemory  (-1, 107077632, 0, 8192, 4096, 4, ... 107077632, 8192, ) == 0x0
 02714  2056   NtTestAlert  (... ) == 0x0
 02715  2056   NtContinue  (106036528, 1, ...
 02716  2056   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02717  2056   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02718   896   NtProtectVirtualMemory  (-1, (0x661e000), 4096, 260, ... (0x661e000), 4096, 4, ) == 0x0
 02719   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 600, {1252, 2060}, ) == 0x0
 02720   896   NtQueryInformationThread  (600, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=2060,}, 0x0, ) == 0x0
 02721   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\14\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\14\10\0\0" )  ) == 0x0
 02722   896   NtResumeThread  (600, ... 1, ) == 0x0
 02723   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 107085824, 1048576, ) == 0x0
 02724   896   NtAllocateVirtualMemory  (-1, 108126208, 0, 8192, 4096, 4, ... 108126208, 8192, ) == 0x0
 02725  2060   NtTestAlert  (... ) == 0x0
 02726  2060   NtContinue  (107085104, 1, ...
 02727  2060   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02728  2060   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02729   896   NtProtectVirtualMemory  (-1, (0x671e000), 4096, 260, ... (0x671e000), 4096, 4, ) == 0x0
 02730   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 604, {1252, 2064}, ) == 0x0
 02731   896   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 02732   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\20\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\20\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\20\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 02733   896   NtResumeThread  (604, ... 1, ) == 0x0
 02734   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02735  2064   NtTestAlert  (... ) == 0x0
 02736  2064   NtContinue  (108133680, 1, ...
 02737  2064   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02738  2064   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02734   896   NtAllocateVirtualMemory  ... 108134400, 1048576, ) == 0x0
 02739   896   NtAllocateVirtualMemory  (-1, 109174784, 0, 8192, 4096, 4, ... 109174784, 8192, ) == 0x0
 02740   896   NtProtectVirtualMemory  (-1, (0x681e000), 4096, 260, ... (0x681e000), 4096, 4, ) == 0x0
 02741   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 608, {1252, 2068}, ) == 0x0
 02742   896   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1252,Tid=2068,}, 0x0, ) == 0x0
 02743   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\24\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\24\10\0\0" )  ) == 0x0
 02744   896   NtResumeThread  (608, ... 1, ) == 0x0
 02745   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 109182976, 1048576, ) == 0x0
 02746   896   NtAllocateVirtualMemory  (-1, 110223360, 0, 8192, 4096, 4, ... 110223360, 8192, ) == 0x0
 02747  2068   NtTestAlert  (... ) == 0x0
 02748  2068   NtContinue  (109182256, 1, ...
 02749  2068   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02750  2068   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02751   896   NtProtectVirtualMemory  (-1, (0x691e000), 4096, 260, ... (0x691e000), 4096, 4, ) == 0x0
 02752   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 612, {1252, 2072}, ) == 0x0
 02753   896   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5b000,Pid=1252,Tid=2072,}, 0x0, ) == 0x0
 02754   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\30\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\30\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\30\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\30\10\0\0" )  ) == 0x0
 02755   896   NtResumeThread  (612, ... 1, ) == 0x0
 02756   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02757  2072   NtTestAlert  (... ) == 0x0
 02758  2072   NtContinue  (110230832, 1, ...
 02759  2072   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02760  2072   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02756   896   NtAllocateVirtualMemory  ... 110231552, 1048576, ) == 0x0
 02761   896   NtAllocateVirtualMemory  (-1, 111271936, 0, 8192, 4096, 4, ... 111271936, 8192, ) == 0x0
 02762   896   NtProtectVirtualMemory  (-1, (0x6a1e000), 4096, 260, ... (0x6a1e000), 4096, 4, ) == 0x0
 02763   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 616, {1252, 2076}, ) == 0x0
 02764   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5a000,Pid=1252,Tid=2076,}, 0x0, ) == 0x0
 02765   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\34\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\34\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\34\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\34\10\0\0" )  ) == 0x0
 02766   896   NtResumeThread  (616, ... 1, ) == 0x0
 02767   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 111280128, 1048576, ) == 0x0
 02768   896   NtAllocateVirtualMemory  (-1, 112320512, 0, 8192, 4096, 4, ... 112320512, 8192, ) == 0x0
 02769  2076   NtTestAlert  (... ) == 0x0
 02770  2076   NtContinue  (111279408, 1, ...
 02771  2076   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02772  2076   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02773   896   NtProtectVirtualMemory  (-1, (0x6b1e000), 4096, 260, ... (0x6b1e000), 4096, 4, ) == 0x0
 02774   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 2080}, ) == 0x0
 02775   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff59000,Pid=1252,Tid=2080,}, 0x0, ) == 0x0
 02776   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0 \10\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0 \10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0 \10\0\0" ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0 \10\0\0" )  ) == 0x0
 02777   896   NtResumeThread  (620, ... 1, ) == 0x0
 02778   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02779  2080   NtTestAlert  (... ) == 0x0
 02780  2080   NtContinue  (112327984, 1, ...
 02781  2080   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02782  2080   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02778   896   NtAllocateVirtualMemory  ... 112328704, 1048576, ) == 0x0
 02783   896   NtAllocateVirtualMemory  (-1, 113369088, 0, 8192, 4096, 4, ... 113369088, 8192, ) == 0x0
 02784   896   NtProtectVirtualMemory  (-1, (0x6c1e000), 4096, 260, ... (0x6c1e000), 4096, 4, ) == 0x0
 02785   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 2084}, ) == 0x0
 02786   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff58000,Pid=1252,Tid=2084,}, 0x0, ) == 0x0
 02787   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0$\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0$\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0$\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0$\10\0\0" )  ) == 0x0
 02788   896   NtResumeThread  (624, ... 1, ) == 0x0
 02789   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 113377280, 1048576, ) == 0x0
 02790   896   NtAllocateVirtualMemory  (-1, 114417664, 0, 8192, 4096, 4, ... 114417664, 8192, ) == 0x0
 02791  2084   NtTestAlert  (... ) == 0x0
 02792  2084   NtContinue  (113376560, 1, ...
 02793  2084   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02794  2084   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02795   896   NtProtectVirtualMemory  (-1, (0x6d1e000), 4096, 260, ... (0x6d1e000), 4096, 4, ) == 0x0
 02796   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 628, {1252, 2088}, ) == 0x0
 02797   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff57000,Pid=1252,Tid=2088,}, 0x0, ) == 0x0
 02798   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0(\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0(\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0(\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0(\10\0\0" )  ) == 0x0
 02799   896   NtResumeThread  (628, ... 1, ) == 0x0
 02800   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02801  2088   NtTestAlert  (... ) == 0x0
 02802  2088   NtContinue  (114425136, 1, ...
 02803  2088   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02804  2088   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02800   896   NtAllocateVirtualMemory  ... 114425856, 1048576, ) == 0x0
 02805   896   NtAllocateVirtualMemory  (-1, 115466240, 0, 8192, 4096, 4, ... 115466240, 8192, ) == 0x0
 02806   896   NtProtectVirtualMemory  (-1, (0x6e1e000), 4096, 260, ... (0x6e1e000), 4096, 4, ) == 0x0
 02807   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 2092}, ) == 0x0
 02808   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff56000,Pid=1252,Tid=2092,}, 0x0, ) == 0x0
 02809   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0,\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0,\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0,\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0,\10\0\0" )  ) == 0x0
 02810   896   NtResumeThread  (632, ... 1, ) == 0x0
 02811   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02812  2092   NtTestAlert  (... ) == 0x0
 02813  2092   NtContinue  (115473712, 1, ...
 02814  2092   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02815  2092   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02811   896   NtAllocateVirtualMemory  ... 115474432, 1048576, ) == 0x0
 02816   896   NtAllocateVirtualMemory  (-1, 116514816, 0, 8192, 4096, 4, ... 116514816, 8192, ) == 0x0
 02817   896   NtProtectVirtualMemory  (-1, (0x6f1e000), 4096, 260, ... (0x6f1e000), 4096, 4, ) == 0x0
 02818   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1252, 2096}, ) == 0x0
 02819   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff55000,Pid=1252,Tid=2096,}, 0x0, ) == 0x0
 02820   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\00\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\00\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\00\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\00\10\0\0" )  ) == 0x0
 02821   896   NtResumeThread  (636, ... 1, ) == 0x0
 02822   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 116523008, 1048576, ) == 0x0
 02823   896   NtAllocateVirtualMemory  (-1, 117563392, 0, 8192, 4096, 4, ... 117563392, 8192, ) == 0x0
 02824  2096   NtTestAlert  (... ) == 0x0
 02825  2096   NtContinue  (116522288, 1, ...
 02826  2096   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02827  2096   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02828   896   NtProtectVirtualMemory  (-1, (0x701e000), 4096, 260, ... (0x701e000), 4096, 4, ) == 0x0
 02829   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 2100}, ) == 0x0
 02830   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff54000,Pid=1252,Tid=2100,}, 0x0, ) == 0x0
 02831   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\10\0\0" )  ) == 0x0
 02832   896   NtResumeThread  (640, ... 1, ) == 0x0
 02833   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02834  2100   NtTestAlert  (... ) == 0x0
 02835  2100   NtContinue  (117570864, 1, ...
 02836  2100   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02837  2100   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02833   896   NtAllocateVirtualMemory  ... 117571584, 1048576, ) == 0x0
 02838   896   NtAllocateVirtualMemory  (-1, 118611968, 0, 8192, 4096, 4, ... 118611968, 8192, ) == 0x0
 02839   896   NtProtectVirtualMemory  (-1, (0x711e000), 4096, 260, ... (0x711e000), 4096, 4, ) == 0x0
 02840   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 2104}, ) == 0x0
 02841   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff53000,Pid=1252,Tid=2104,}, 0x0, ) == 0x0
 02842   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\10\0\0" )  ) == 0x0
 02843   896   NtResumeThread  (644, ... 1, ) == 0x0
 02844   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 118620160, 1048576, ) == 0x0
 02845   896   NtAllocateVirtualMemory  (-1, 119660544, 0, 8192, 4096, 4, ... 119660544, 8192, ) == 0x0
 02846  2104   NtTestAlert  (... ) == 0x0
 02847  2104   NtContinue  (118619440, 1, ...
 02848  2104   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02849  2104   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02850   896   NtProtectVirtualMemory  (-1, (0x721e000), 4096, 260, ... (0x721e000), 4096, 4, ) == 0x0
 02851   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 648, {1252, 2108}, ) == 0x0
 02852   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff52000,Pid=1252,Tid=2108,}, 0x0, ) == 0x0
 02853   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0<\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0<\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0<\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0<\10\0\0" )  ) == 0x0
 02854   896   NtResumeThread  (648, ... 1, ) == 0x0
 02855   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 119668736, 1048576, ) == 0x0
 02856   896   NtAllocateVirtualMemory  (-1, 120709120, 0, 8192, 4096, 4, ... 120709120, 8192, ) == 0x0
 02857  2108   NtTestAlert  (... ) == 0x0
 02858  2108   NtContinue  (119668016, 1, ...
 02859  2108   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02860  2108   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02861   896   NtProtectVirtualMemory  (-1, (0x731e000), 4096, 260, ... (0x731e000), 4096, 4, ) == 0x0
 02862   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 2112}, ) == 0x0
 02863   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff51000,Pid=1252,Tid=2112,}, 0x0, ) == 0x0
 02864   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0@\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0@\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0@\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0@\10\0\0" )  ) == 0x0
 02865   896   NtResumeThread  (652, ... 1, ) == 0x0
 02866   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02867  2112   NtTestAlert  (... ) == 0x0
 02868  2112   NtContinue  (120716592, 1, ...
 02869  2112   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02870  2112   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02866   896   NtAllocateVirtualMemory  ... 120717312, 1048576, ) == 0x0
 02871   896   NtAllocateVirtualMemory  (-1, 121757696, 0, 8192, 4096, 4, ... 121757696, 8192, ) == 0x0
 02872   896   NtProtectVirtualMemory  (-1, (0x741e000), 4096, 260, ... (0x741e000), 4096, 4, ) == 0x0
 02873   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1252, 2116}, ) == 0x0
 02874   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff50000,Pid=1252,Tid=2116,}, 0x0, ) == 0x0
 02875   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0D\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0D\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0D\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0D\10\0\0" )  ) == 0x0
 02876   896   NtResumeThread  (656, ... 1, ) == 0x0
 02877   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 121765888, 1048576, ) == 0x0
 02878   896   NtAllocateVirtualMemory  (-1, 122806272, 0, 8192, 4096, 4, ... 122806272, 8192, ) == 0x0
 02879  2116   NtTestAlert  (... ) == 0x0
 02880  2116   NtContinue  (121765168, 1, ...
 02881  2116   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02882  2116   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02883   896   NtProtectVirtualMemory  (-1, (0x751e000), 4096, 260, ... (0x751e000), 4096, 4, ) == 0x0
 02884   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 660, {1252, 2120}, ) == 0x0
 02885   896   NtQueryInformationThread  (660, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4f000,Pid=1252,Tid=2120,}, 0x0, ) == 0x0
 02886   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0H\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0H\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0H\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0H\10\0\0" )  ) == 0x0
 02887   896   NtResumeThread  (660, ... 1, ) == 0x0
 02888   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02889  2120   NtAllocateVirtualMemory  (-1, 8880128, 0, 4096, 4096, 4, ... 8880128, 4096, ) == 0x0
 02890  2120   NtTestAlert  (... ) == 0x0
 02891  2120   NtContinue  (122813744, 1, ...
 02892  2120   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02893  2120   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02888   896   NtAllocateVirtualMemory  ... 122814464, 1048576, ) == 0x0
 02894   896   NtAllocateVirtualMemory  (-1, 123854848, 0, 8192, 4096, 4, ... 123854848, 8192, ) == 0x0
 02895   896   NtProtectVirtualMemory  (-1, (0x761e000), 4096, 260, ... (0x761e000), 4096, 4, ) == 0x0
 02896   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 2124}, ) == 0x0
 02897   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4e000,Pid=1252,Tid=2124,}, 0x0, ) == 0x0
 02898   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0L\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0L\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0L\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0L\10\0\0" )  ) == 0x0
 02899   896   NtResumeThread  (664, ... 1, ) == 0x0
 02900   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 123863040, 1048576, ) == 0x0
 02901   896   NtAllocateVirtualMemory  (-1, 124903424, 0, 8192, 4096, 4, ... 124903424, 8192, ) == 0x0
 02902  2124   NtTestAlert  (... ) == 0x0
 02903  2124   NtContinue  (123862320, 1, ...
 02904  2124   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02905  2124   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02906   896   NtProtectVirtualMemory  (-1, (0x771e000), 4096, 260, ... (0x771e000), 4096, 4, ) == 0x0
 02907   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1252, 2128}, ) == 0x0
 02908   896   NtQueryInformationThread  (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4d000,Pid=1252,Tid=2128,}, 0x0, ) == 0x0
 02909   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0P\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0P\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0P\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0P\10\0\0" )  ) == 0x0
 02910   896   NtResumeThread  (668, ... 1, ) == 0x0
 02911   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02912  2128   NtTestAlert  (... ) == 0x0
 02913  2128   NtContinue  (124910896, 1, ...
 02914  2128   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02915  2128   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02911   896   NtAllocateVirtualMemory  ... 124911616, 1048576, ) == 0x0
 02916   896   NtAllocateVirtualMemory  (-1, 125952000, 0, 8192, 4096, 4, ... 125952000, 8192, ) == 0x0
 02917   896   NtProtectVirtualMemory  (-1, (0x781e000), 4096, 260, ... (0x781e000), 4096, 4, ) == 0x0
 02918   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 672, {1252, 2132}, ) == 0x0
 02919   896   NtQueryInformationThread  (672, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4c000,Pid=1252,Tid=2132,}, 0x0, ) == 0x0
 02920   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0T\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0T\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0T\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0T\10\0\0" )  ) == 0x0
 02921   896   NtResumeThread  (672, ... 1, ) == 0x0
 02922   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 125960192, 1048576, ) == 0x0
 02923   896   NtAllocateVirtualMemory  (-1, 127000576, 0, 8192, 4096, 4, ... 127000576, 8192, ) == 0x0
 02924  2132   NtTestAlert  (... ) == 0x0
 02925  2132   NtContinue  (125959472, 1, ...
 02926  2132   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02927  2132   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02928   896   NtProtectVirtualMemory  (-1, (0x791e000), 4096, 260, ... (0x791e000), 4096, 4, ) == 0x0
 02929   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1252, 2136}, ) == 0x0
 02930   896   NtQueryInformationThread  (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4b000,Pid=1252,Tid=2136,}, 0x0, ) == 0x0
 02931   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0X\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0X\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0X\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0X\10\0\0" )  ) == 0x0
 02932   896   NtResumeThread  (676, ... 1, ) == 0x0
 02933   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02934  2136   NtTestAlert  (... ) == 0x0
 02935  2136   NtContinue  (127008048, 1, ...
 02936  2136   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02937  2136   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02933   896   NtAllocateVirtualMemory  ... 127008768, 1048576, ) == 0x0
 02938   896   NtAllocateVirtualMemory  (-1, 128049152, 0, 8192, 4096, 4, ... 128049152, 8192, ) == 0x0
 02939   896   NtProtectVirtualMemory  (-1, (0x7a1e000), 4096, 260, ... (0x7a1e000), 4096, 4, ) == 0x0
 02940   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 680, {1252, 2140}, ) == 0x0
 02941   896   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff4a000,Pid=1252,Tid=2140,}, 0x0, ) == 0x0
 02942   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\\10\0\0" )  ) == 0x0
 02943   896   NtResumeThread  (680, ... 1, ) == 0x0
 02944   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 128057344, 1048576, ) == 0x0
 02945   896   NtAllocateVirtualMemory  (-1, 129097728, 0, 8192, 4096, 4, ... 129097728, 8192, ) == 0x0
 02946  2140   NtTestAlert  (... ) == 0x0
 02947  2140   NtContinue  (128056624, 1, ...
 02948  2140   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02949  2140   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02950   896   NtProtectVirtualMemory  (-1, (0x7b1e000), 4096, 260, ... (0x7b1e000), 4096, 4, ) == 0x0
 02951   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 684, {1252, 2144}, ) == 0x0
 02952   896   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff49000,Pid=1252,Tid=2144,}, 0x0, ) == 0x0
 02953   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0`\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0`\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0`\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0`\10\0\0" )  ) == 0x0
 02954   896   NtResumeThread  (684, ... 1, ) == 0x0
 02955   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02956  2144   NtTestAlert  (... ) == 0x0
 02957  2144   NtContinue  (129105200, 1, ...
 02958  2144   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02959  2144   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02955   896   NtAllocateVirtualMemory  ... 129105920, 1048576, ) == 0x0
 02960   896   NtAllocateVirtualMemory  (-1, 130146304, 0, 8192, 4096, 4, ... 130146304, 8192, ) == 0x0
 02961   896   NtProtectVirtualMemory  (-1, (0x7c1e000), 4096, 260, ... (0x7c1e000), 4096, 4, ) == 0x0
 02962   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1252, 2148}, ) == 0x0
 02963   896   NtQueryInformationThread  (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff48000,Pid=1252,Tid=2148,}, 0x0, ) == 0x0
 02964   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0d\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0d\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0d\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0d\10\0\0" )  ) == 0x0
 02965   896   NtResumeThread  (688, ... 1, ) == 0x0
 02966   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 130154496, 1048576, ) == 0x0
 02967   896   NtAllocateVirtualMemory  (-1, 131194880, 0, 8192, 4096, 4, ... 131194880, 8192, ) == 0x0
 02968  2148   NtTestAlert  (... ) == 0x0
 02969  2148   NtContinue  (130153776, 1, ...
 02970  2148   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02971  2148   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02972   896   NtProtectVirtualMemory  (-1, (0x7d1e000), 4096, 260, ... (0x7d1e000), 4096, 4, ) == 0x0
 02973   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1252, 2152}, ) == 0x0
 02974   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff47000,Pid=1252,Tid=2152,}, 0x0, ) == 0x0
 02975   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0h\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0h\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0h\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0h\10\0\0" )  ) == 0x0
 02976   896   NtResumeThread  (692, ... 1, ) == 0x0
 02977   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02978  2152   NtTestAlert  (... ) == 0x0
 02979  2152   NtContinue  (131202352, 1, ...
 02980  2152   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02981  2152   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02977   896   NtAllocateVirtualMemory  ... 131203072, 1048576, ) == 0x0
 02982   896   NtAllocateVirtualMemory  (-1, 132243456, 0, 8192, 4096, 4, ... 132243456, 8192, ) == 0x0
 02983   896   NtProtectVirtualMemory  (-1, (0x7e1e000), 4096, 260, ... (0x7e1e000), 4096, 4, ) == 0x0
 02984   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 696, {1252, 2156}, ) == 0x0
 02985   896   NtQueryInformationThread  (696, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff46000,Pid=1252,Tid=2156,}, 0x0, ) == 0x0
 02986   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0l\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0l\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0l\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0l\10\0\0" )  ) == 0x0
 02987   896   NtResumeThread  (696, ... 1, ) == 0x0
 02988   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 132251648, 1048576, ) == 0x0
 02989   896   NtAllocateVirtualMemory  (-1, 133292032, 0, 8192, 4096, 4, ... 133292032, 8192, ) == 0x0
 02990  2156   NtTestAlert  (... ) == 0x0
 02991  2156   NtContinue  (132250928, 1, ...
 02992  2156   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02993  2156   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02994   896   NtProtectVirtualMemory  (-1, (0x7f1e000), 4096, 260, ... (0x7f1e000), 4096, 4, ) == 0x0
 02995   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 700, {1252, 2160}, ) == 0x0
 02996   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff45000,Pid=1252,Tid=2160,}, 0x0, ) == 0x0
 02997   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0p\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0p\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0p\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0p\10\0\0" )  ) == 0x0
 02998   896   NtResumeThread  (700, ... 1, ) == 0x0
 02999   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03000  2160   NtTestAlert  (... ) == 0x0
 03001  2160   NtContinue  (133299504, 1, ...
 03002  2160   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03003  2160   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02999   896   NtAllocateVirtualMemory  ... 133300224, 1048576, ) == 0x0
 03004   896   NtAllocateVirtualMemory  (-1, 134340608, 0, 8192, 4096, 4, ... 134340608, 8192, ) == 0x0
 03005   896   NtProtectVirtualMemory  (-1, (0x801e000), 4096, 260, ... (0x801e000), 4096, 4, ) == 0x0
 03006   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 2164}, ) == 0x0
 03007   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff44000,Pid=1252,Tid=2164,}, 0x0, ) == 0x0
 03008   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0t\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0t\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0t\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0t\10\0\0" )  ) == 0x0
 03009   896   NtResumeThread  (704, ... 1, ) == 0x0
 03010   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 134348800, 1048576, ) == 0x0
 03011   896   NtAllocateVirtualMemory  (-1, 135389184, 0, 8192, 4096, 4, ... 135389184, 8192, ) == 0x0
 03012  2164   NtTestAlert  (... ) == 0x0
 03013  2164   NtContinue  (134348080, 1, ...
 03014  2164   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03015  2164   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03016   896   NtProtectVirtualMemory  (-1, (0x811e000), 4096, 260, ... (0x811e000), 4096, 4, ) == 0x0
 03017   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 708, {1252, 2168}, ) == 0x0
 03018   896   NtQueryInformationThread  (708, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff43000,Pid=1252,Tid=2168,}, 0x0, ) == 0x0
 03019   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0x\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0x\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0x\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0x\10\0\0" )  ) == 0x0
 03020   896   NtResumeThread  (708, ... 1, ) == 0x0
 03021   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03022  2168   NtTestAlert  (... ) == 0x0
 03023  2168   NtContinue  (135396656, 1, ...
 03024  2168   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03025  2168   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03021   896   NtAllocateVirtualMemory  ... 135397376, 1048576, ) == 0x0
 03026   896   NtAllocateVirtualMemory  (-1, 136437760, 0, 8192, 4096, 4, ... 136437760, 8192, ) == 0x0
 03027   896   NtProtectVirtualMemory  (-1, (0x821e000), 4096, 260, ... (0x821e000), 4096, 4, ) == 0x0
 03028   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 712, {1252, 2172}, ) == 0x0
 03029   896   NtQueryInformationThread  (712, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff42000,Pid=1252,Tid=2172,}, 0x0, ) == 0x0
 03030   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0|\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0|\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0|\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0|\10\0\0" )  ) == 0x0
 03031   896   NtResumeThread  (712, ... 1, ) == 0x0
 03032   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 136445952, 1048576, ) == 0x0
 03033   896   NtAllocateVirtualMemory  (-1, 137486336, 0, 8192, 4096, 4, ... 137486336, 8192, ) == 0x0
 03034  2172   NtTestAlert  (... ) == 0x0
 03035  2172   NtContinue  (136445232, 1, ...
 03036  2172   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03037  2172   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03038   896   NtProtectVirtualMemory  (-1, (0x831e000), 4096, 260, ... (0x831e000), 4096, 4, ) == 0x0
 03039   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 716, {1252, 2176}, ) == 0x0
 03040   896   NtQueryInformationThread  (716, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff41000,Pid=1252,Tid=2176,}, 0x0, ) == 0x0
 03041   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\200\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\200\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\200\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\200\10\0\0" )  ) == 0x0
 03042   896   NtResumeThread  (716, ... 1, ) == 0x0
 03043   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03044  2176   NtTestAlert  (... ) == 0x0
 03045  2176   NtContinue  (137493808, 1, ...
 03046  2176   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03047  2176   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03043   896   NtAllocateVirtualMemory  ... 137494528, 1048576, ) == 0x0
 03048   896   NtAllocateVirtualMemory  (-1, 138534912, 0, 8192, 4096, 4, ... 138534912, 8192, ) == 0x0
 03049   896   NtProtectVirtualMemory  (-1, (0x841e000), 4096, 260, ... (0x841e000), 4096, 4, ) == 0x0
 03050   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 720, {1252, 2180}, ) == 0x0
 03051   896   NtQueryInformationThread  (720, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff40000,Pid=1252,Tid=2180,}, 0x0, ) == 0x0
 03052   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\204\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\204\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\204\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\204\10\0\0" )  ) == 0x0
 03053   896   NtResumeThread  (720, ... 1, ) == 0x0
 03054   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 138543104, 1048576, ) == 0x0
 03055   896   NtAllocateVirtualMemory  (-1, 139583488, 0, 8192, 4096, 4, ... 139583488, 8192, ) == 0x0
 03056  2180   NtTestAlert  (... ) == 0x0
 03057  2180   NtContinue  (138542384, 1, ...
 03058  2180   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03059  2180   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03060   896   NtProtectVirtualMemory  (-1, (0x851e000), 4096, 260, ... (0x851e000), 4096, 4, ) == 0x0
 03061   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 724, {1252, 2184}, ) == 0x0
 03062   896   NtQueryInformationThread  (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3f000,Pid=1252,Tid=2184,}, 0x0, ) == 0x0
 03063   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\210\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\210\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\210\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\210\10\0\0" )  ) == 0x0
 03064   896   NtResumeThread  (724, ... 1, ) == 0x0
 03065   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03066  2184   NtTestAlert  (... ) == 0x0
 03067  2184   NtContinue  (139590960, 1, ...
 03068  2184   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03069  2184   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03065   896   NtAllocateVirtualMemory  ... 139591680, 1048576, ) == 0x0
 03070   896   NtAllocateVirtualMemory  (-1, 140632064, 0, 8192, 4096, 4, ... 140632064, 8192, ) == 0x0
 03071   896   NtProtectVirtualMemory  (-1, (0x861e000), 4096, 260, ... (0x861e000), 4096, 4, ) == 0x0
 03072   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 728, {1252, 2188}, ) == 0x0
 03073   896   NtQueryInformationThread  (728, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3e000,Pid=1252,Tid=2188,}, 0x0, ) == 0x0
 03074   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\214\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\214\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\214\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\2\0\0\344\4\0\0\214\10\0\0" )  ) == 0x0
 03075   896   NtResumeThread  (728, ... 1, ) == 0x0
 03076   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 140640256, 1048576, ) == 0x0
 03077   896   NtAllocateVirtualMemory  (-1, 141680640, 0, 8192, 4096, 4, ... 141680640, 8192, ) == 0x0
 03078  2188   NtTestAlert  (... ) == 0x0
 03079  2188   NtContinue  (140639536, 1, ...
 03080  2188   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03081  2188   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03082   896   NtProtectVirtualMemory  (-1, (0x871e000), 4096, 260, ... (0x871e000), 4096, 4, ) == 0x0
 03083   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 732, {1252, 2192}, ) == 0x0
 03084   896   NtQueryInformationThread  (732, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3d000,Pid=1252,Tid=2192,}, 0x0, ) == 0x0
 03085   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\220\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\220\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\220\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0\220\10\0\0" )  ) == 0x0
 03086   896   NtResumeThread  (732, ... 1, ) == 0x0
 03087   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03088  2192   NtTestAlert  (... ) == 0x0
 03089  2192   NtContinue  (141688112, 1, ...
 03090  2192   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03091  2192   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03087   896   NtAllocateVirtualMemory  ... 141688832, 1048576, ) == 0x0
 03092   896   NtAllocateVirtualMemory  (-1, 142729216, 0, 8192, 4096, 4, ... 142729216, 8192, ) == 0x0
 03093   896   NtProtectVirtualMemory  (-1, (0x881e000), 4096, 260, ... (0x881e000), 4096, 4, ) == 0x0
 03094   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 736, {1252, 2196}, ) == 0x0
 03095   896   NtQueryInformationThread  (736, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3c000,Pid=1252,Tid=2196,}, 0x0, ) == 0x0
 03096   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\224\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\224\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\224\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\224\10\0\0" )  ) == 0x0
 03097   896   NtResumeThread  (736, ... 1, ) == 0x0
 03098   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 142737408, 1048576, ) == 0x0
 03099   896   NtAllocateVirtualMemory  (-1, 143777792, 0, 8192, 4096, 4, ... 143777792, 8192, ) == 0x0
 03100  2196   NtTestAlert  (... ) == 0x0
 03101  2196   NtContinue  (142736688, 1, ...
 03102  2196   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03103  2196   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03104   896   NtProtectVirtualMemory  (-1, (0x891e000), 4096, 260, ... (0x891e000), 4096, 4, ) == 0x0
 03105   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 740, {1252, 2200}, ) == 0x0
 03106   896   NtQueryInformationThread  (740, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3b000,Pid=1252,Tid=2200,}, 0x0, ) == 0x0
 03107   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\230\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\230\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\230\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\230\10\0\0" )  ) == 0x0
 03108   896   NtResumeThread  (740, ... 1, ) == 0x0
 03109   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03110  2200   NtTestAlert  (... ) == 0x0
 03111  2200   NtContinue  (143785264, 1, ...
 03112  2200   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03113  2200   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03109   896   NtAllocateVirtualMemory  ... 143785984, 1048576, ) == 0x0
 03114   896   NtAllocateVirtualMemory  (-1, 144826368, 0, 8192, 4096, 4, ... 144826368, 8192, ) == 0x0
 03115   896   NtProtectVirtualMemory  (-1, (0x8a1e000), 4096, 260, ... (0x8a1e000), 4096, 4, ) == 0x0
 03116   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 744, {1252, 2204}, ) == 0x0
 03117   896   NtQueryInformationThread  (744, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff3a000,Pid=1252,Tid=2204,}, 0x0, ) == 0x0
 03118   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\234\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\234\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81978, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\234\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\234\10\0\0" )  ) == 0x0
 03119   896   NtResumeThread  (744, ... 1, ) == 0x0
 03120   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 144834560, 1048576, ) == 0x0
 03121   896   NtAllocateVirtualMemory  (-1, 145874944, 0, 8192, 4096, 4, ... 145874944, 8192, ) == 0x0
 03122  2204   NtTestAlert  (... ) == 0x0
 03123  2204   NtContinue  (144833840, 1, ...
 03124  2204   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03125  2204   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03126   896   NtProtectVirtualMemory  (-1, (0x8b1e000), 4096, 260, ... (0x8b1e000), 4096, 4, ) == 0x0
 03127   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 748, {1252, 2208}, ) == 0x0
 03128   896   NtQueryInformationThread  (748, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff39000,Pid=1252,Tid=2208,}, 0x0, ) == 0x0
 03129   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81979, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81978, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\10\0\0" )  ) == 0x0
 03130   896   NtResumeThread  (748, ... 1, ) == 0x0
 03131   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03132  2208   NtTestAlert  (... ) == 0x0
 03133  2208   NtContinue  (145882416, 1, ...
 03134  2208   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03135  2208   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03131   896   NtAllocateVirtualMemory  ... 145883136, 1048576, ) == 0x0
 03136   896   NtAllocateVirtualMemory  (-1, 146923520, 0, 8192, 4096, 4, ... 146923520, 8192, ) == 0x0
 03137   896   NtProtectVirtualMemory  (-1, (0x8c1e000), 4096, 260, ... (0x8c1e000), 4096, 4, ) == 0x0
 03138   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 752, {1252, 2212}, ) == 0x0
 03139   896   NtQueryInformationThread  (752, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff38000,Pid=1252,Tid=2212,}, 0x0, ) == 0x0
 03140   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\244\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\244\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81979, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\244\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\2\0\0\344\4\0\0\244\10\0\0" )  ) == 0x0
 03141   896   NtResumeThread  (752, ... 1, ) == 0x0
 03142   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 146931712, 1048576, ) == 0x0
 03143   896   NtAllocateVirtualMemory  (-1, 147972096, 0, 8192, 4096, 4, ... 147972096, 8192, ) == 0x0
 03144  2212   NtTestAlert  (... ) == 0x0
 03145  2212   NtContinue  (146930992, 1, ...
 03146  2212   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03147  2212   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03148   896   NtProtectVirtualMemory  (-1, (0x8d1e000), 4096, 260, ... (0x8d1e000), 4096, 4, ) == 0x0
 03149   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 756, {1252, 2216}, ) == 0x0
 03150   896   NtQueryInformationThread  (756, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff37000,Pid=1252,Tid=2216,}, 0x0, ) == 0x0
 03151   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\250\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\250\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81981, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\250\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81981, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\2\0\0\344\4\0\0\250\10\0\0" )  ) == 0x0
 03152   896   NtResumeThread  (756, ... 1, ) == 0x0
 03153  2216   NtTestAlert  (... ) == 0x0
 03154  2216   NtContinue  (147979568, 1, ...
 03155  2216   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03156  2216   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0
 03157  2216   NtWaitForSingleObject  (216, 0, 0x0, ...
 03158   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 760, ) == 0x0
 03159   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 764, ) == 0x0
 03160   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03161   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 768, ) == 0x0
 03162   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03163   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03164   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243192,  (0xc0100080, {24, 0, 0x40, 0, 1243192, "\??\PIPE\InitShutdown"}, 0x0, 0, 3, 1, 64, 0, 0, ... 772, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 772, {status=0x0, info=1}, ) == 0x0
 03165   896   NtSetInformationFile  (772, 1243248, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03166   896   NtSetInformationFile  (772, 1243236, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03167   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03168   896   NtWriteFile  (772, 761, 0, 0,  (772, 761, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\300\340M\211U\15\323\21\243"\0\300O\243!\241\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) \0\300O\243!\241\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03169   896   NtReadFile  (772, 761, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=76},  (772, 761, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=76}, "\5\0\14\3\20\0\0\0L\0\0\0\1\0\0\0\270\20\270\20\234(\0\0\23\0\PIPE\InitShutdown\0\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03170   896   NtFsControlFile  (772, 761, 0x0, 0x0, 0x11c017,  (772, 761, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\36\0\0\0\1\0\0\0\6\0\0\0\0\0\1\0\330\376\22\0\370\37", 30, 1024, ... {status=0x103, info=76}, "\5\0\14\3\20\0\0\0L\0\0\0\1\0\0\0\270\20\270\20\234(\0\0\23\0\PIPE\InitShutdown\0\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 30, 1024, ... {status=0x103, info=76},  (772, 761, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\36\0\0\0\1\0\0\0\6\0\0\0\0\0\1\0\330\376\22\0\370\37", 30, 1024, ... {status=0x103, info=76}, "\5\0\14\3\20\0\0\0L\0\0\0\1\0\0\0\270\20\270\20\234(\0\0\23\0\PIPE\InitShutdown\0\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03171   896   NtWaitForSingleObject  (761, 0, 0x0, ...
 01593   928   NtOpenKey  ... 776, ) == 0x0
 03172   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03171   896   NtWaitForSingleObject  ... ) == 0x0
 03173   896   NtClose  (768, ... ) == 0x0
 03174   896   NtClose  (772, ... ) == 0x0
 03175   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03176   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 772, ) == 0x0
 03177   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03178   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03179   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243188,  (0xc0100080, {24, 0, 0x40, 0, 1243188, "\??\PIPE\winreg"}, 0x0, 0, 3, 1, 64, 0, 0, ... 768, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 768, {status=0x0, info=1}, ) == 0x0
 03180   896   NtSetInformationFile  (768, 1243244, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03181   896   NtSetInformationFile  (768, 1243232, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03182   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03183   896   NtWriteFile  (768, 761, 0, 0,  (768, 761, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\1\320\2143D"\3611\252\252\220\08\0\20\3\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) \3611\252\252\220\08\0\20\3\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03184   896   NtReadFile  (768, 761, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (768, 761, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\2019\0\0\15\0\PIPE\winreg\0\177\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03185   896   NtFsControlFile  (768, 761, 0x0, 0x0, 0x11c017,  (768, 761, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\36\0\0\0\1\0\0\0\6\0\0\0\0\0\31\0\314\376\22\0\370\37", 30, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\2019\0\0\15\0\PIPE\winreg\0\177\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 30, 1024, ... {status=0x103, info=68},  (768, 761, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\36\0\0\0\1\0\0\0\6\0\0\0\0\0\31\0\314\376\22\0\370\37", 30, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\2019\0\0\15\0\PIPE\winreg\0\177\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03186   896   NtWaitForSingleObject  (761, 0, 0x0, ...
 03187   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03188   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... }, ...
 01628   900   NtSetInformationThread  ... ) == 0x0
 01629   748   NtSetInformationThread  ... ) == 0x0
 01630  1732   NtSetInformationThread  ... ) == 0x0
 01641   428   NtSetInformationThread  ... ) == 0x0
 01775  1300   NtSetInformationThread  ... ) == 0x0
 01776   252   NtSetInformationThread  ... ) == 0x0
 02193  1328   NtSetInformationThread  ... ) == 0x0
 02208  1636   NtSetInformationThread  ... ) == 0x0
 02220   704   NtSetInformationThread  ... ) == 0x0
 02230  1152   NtSetInformationThread  ... ) == 0x0
 02242  1228   NtSetInformationThread  ... ) == 0x0
 02252   792   NtSetInformationThread  ... ) == 0x0
 02265  1484   NtSetInformationThread  ... ) == 0x0
 02275   888   NtSetInformationThread  ... ) == 0x0
 02287  1120   NtSetInformationThread  ... ) == 0x0
 02297   840   NtSetInformationThread  ... ) == 0x0
 02308   876   NtSetInformationThread  ... ) == 0x0
 02320  1104   NtSetInformationThread  ... ) == 0x0
 02330   860   NtSetInformationThread  ... ) == 0x0
 02342  1516   NtSetInformationThread  ... ) == 0x0
 02352   780   NtSetInformationThread  ... ) == 0x0
 02364   940   NtSetInformationThread  ... ) == 0x0
 02374  1268   NtSetInformationThread  ... ) == 0x0
 02386   644   NtSetInformationThread  ... ) == 0x0
 02396  1736   NtSetInformationThread  ... ) == 0x0
 02408   320   NtSetInformationThread  ... ) == 0x0
 02418   380   NtSetInformationThread  ... ) == 0x0
 02430  1332   NtSetInformationThread  ... ) == 0x0
 02440  1336   NtSetInformationThread  ... ) == 0x0
 02452  1808   NtSetInformationThread  ... ) == 0x0
 02462   468   NtSetInformationThread  ... ) == 0x0
 02474   752   NtSetInformationThread  ... ) == 0x0
 02484  1512   NtSetInformationThread  ... ) == 0x0
 02496  1380   NtSetInformationThread  ... ) == 0x0
 02506  1564   NtSetInformationThread  ... ) == 0x0
 02518   164   NtSetInformationThread  ... ) == 0x0
 02528   312   NtSetInformationThread  ... ) == 0x0
 02540  1964   NtSetInformationThread  ... ) == 0x0
 02550  1568   NtSetInformationThread  ... ) == 0x0
 03186   896   NtWaitForSingleObject  ... ) == 0x0
 02562  1624   NtSetInformationThread  ... ) == 0x0
 02572  1716   NtSetInformationThread  ... ) == 0x0
 02585  1440   NtSetInformationThread  ... ) == 0x0
 02595  1664   NtSetInformationThread  ... ) == 0x0
 02607  1972   NtSetInformationThread  ... ) == 0x0
 02617  1036   NtSetInformationThread  ... ) == 0x0
 02629  1248   NtSetInformationThread  ... ) == 0x0
 02639  1656   NtSetInformationThread  ... ) == 0x0
 02651   760   NtSetInformationThread  ... ) == 0x0
 02661   484   NtSetInformationThread  ... ) == 0x0
 02673  1580   NtSetInformationThread  ... ) == 0x0
 02683  1756   NtSetInformationThread  ... ) == 0x0
 02695  1304   NtSetInformationThread  ... ) == 0x0
 02705  2052   NtSetInformationThread  ... ) == 0x0
 02717  2056   NtSetInformationThread  ... ) == 0x0
 02728  2060   NtSetInformationThread  ... ) == 0x0
 02738  2064   NtSetInformationThread  ... ) == 0x0
 02750  2068   NtSetInformationThread  ... ) == 0x0
 02760  2072   NtSetInformationThread  ... ) == 0x0
 02772  2076   NtSetInformationThread  ... ) == 0x0
 02782  2080   NtSetInformationThread  ... ) == 0x0
 02794  2084   NtSetInformationThread  ... ) == 0x0
 02804  2088   NtSetInformationThread  ... ) == 0x0
 02815  2092   NtSetInformationThread  ... ) == 0x0
 02827  2096   NtSetInformationThread  ... ) == 0x0
 02837  2100   NtSetInformationThread  ... ) == 0x0
 02849  2104   NtSetInformationThread  ... ) == 0x0
 02860  2108   NtSetInformationThread  ... ) == 0x0
 02870  2112   NtSetInformationThread  ... ) == 0x0
 02882  2116   NtSetInformationThread  ... ) == 0x0
 02893  2120   NtSetInformationThread  ... ) == 0x0
 02905  2124   NtSetInformationThread  ... ) == 0x0
 02915  2128   NtSetInformationThread  ... ) == 0x0
 02927  2132   NtSetInformationThread  ... ) == 0x0
 02937  2136   NtSetInformationThread  ... ) == 0x0
 02949  2140   NtSetInformationThread  ... ) == 0x0
 02959  2144   NtSetInformationThread  ... ) == 0x0
 02971  2148   NtSetInformationThread  ... ) == 0x0
 02981  2152   NtSetInformationThread  ... ) == 0x0
 02993  2156   NtSetInformationThread  ... ) == 0x0
 03003  2160   NtSetInformationThread  ... ) == 0x0
 03015  2164   NtSetInformationThread  ... ) == 0x0
 03025  2168   NtSetInformationThread  ... ) == 0x0
 03037  2172   NtSetInformationThread  ... ) == 0x0
 03047  2176   NtSetInformationThread  ... ) == 0x0
 03059  2180   NtSetInformationThread  ... ) == 0x0
 03069  2184   NtSetInformationThread  ... ) == 0x0
 03081  2188   NtSetInformationThread  ... ) == 0x0
 03091  2192   NtSetInformationThread  ... ) == 0x0
 03103  2196   NtSetInformationThread  ... ) == 0x0
 03113  2200   NtSetInformationThread  ... ) == 0x0
 03125  2204   NtSetInformationThread  ... ) == 0x0
 03135  2208   NtSetInformationThread  ... ) == 0x0
 03147  2212   NtSetInformationThread  ... ) == 0x0
 03189   900   NtWaitForSingleObject  (216, 0, 0x0, ...
 03190   748   NtWaitForSingleObject  (216, 0, 0x0, ...
 03191  1732   NtWaitForSingleObject  (216, 0, 0x0, ...
 03192   428   NtWaitForSingleObject  (216, 0, 0x0, ...
 03193  1300   NtWaitForSingleObject  (216, 0, 0x0, ...
 03194   252   NtWaitForSingleObject  (216, 0, 0x0, ...
 03195  1328   NtWaitForSingleObject  (216, 0, 0x0, ...
 03196  1636   NtWaitForSingleObject  (216, 0, 0x0, ...
 03197   704   NtWaitForSingleObject  (216, 0, 0x0, ...
 03198  1152   NtWaitForSingleObject  (216, 0, 0x0, ...
 03199  1228   NtWaitForSingleObject  (216, 0, 0x0, ...
 03200   792   NtWaitForSingleObject  (216, 0, 0x0, ...
 03201  1484   NtWaitForSingleObject  (216, 0, 0x0, ...
 03202   888   NtWaitForSingleObject  (216, 0, 0x0, ...
 03203  1120   NtWaitForSingleObject  (216, 0, 0x0, ...
 03204   840   NtWaitForSingleObject  (216, 0, 0x0, ...
 03205   876   NtWaitForSingleObject  (216, 0, 0x0, ...
 03206  1104   NtWaitForSingleObject  (216, 0, 0x0, ...
 03207   860   NtWaitForSingleObject  (216, 0, 0x0, ...
 03208  1516   NtWaitForSingleObject  (216, 0, 0x0, ...
 03209   780   NtWaitForSingleObject  (216, 0, 0x0, ...
 03210   940   NtWaitForSingleObject  (216, 0, 0x0, ...
 03211  1268   NtWaitForSingleObject  (216, 0, 0x0, ...
 03212   644   NtWaitForSingleObject  (216, 0, 0x0, ...
 03213  1736   NtWaitForSingleObject  (216, 0, 0x0, ...
 03214   320   NtWaitForSingleObject  (216, 0, 0x0, ...
 03215   380   NtWaitForSingleObject  (216, 0, 0x0, ...
 03216  1332   NtWaitForSingleObject  (216, 0, 0x0, ...
 03217  1336   NtWaitForSingleObject  (216, 0, 0x0, ...
 03218  1808   NtWaitForSingleObject  (216, 0, 0x0, ...
 03219   468   NtWaitForSingleObject  (216, 0, 0x0, ...
 03220   752   NtWaitForSingleObject  (216, 0, 0x0, ...
 03221  1512   NtWaitForSingleObject  (216, 0, 0x0, ...
 03222  1380   NtWaitForSingleObject  (216, 0, 0x0, ...
 03223  1564   NtWaitForSingleObject  (216, 0, 0x0, ...
 03224   164   NtWaitForSingleObject  (216, 0, 0x0, ...
 03225   312   NtWaitForSingleObject  (216, 0, 0x0, ...
 03226  1964   NtWaitForSingleObject  (216, 0, 0x0, ...
 03227   896   NtClose  (772, ...
 03228  1568   NtWaitForSingleObject  (216, 0, 0x0, ...
 03229  1624   NtWaitForSingleObject  (216, 0, 0x0, ...
 03230  1716   NtWaitForSingleObject  (216, 0, 0x0, ...
 03231  1440   NtWaitForSingleObject  (216, 0, 0x0, ...
 03232  1664   NtWaitForSingleObject  (216, 0, 0x0, ...
 03233  1972   NtWaitForSingleObject  (216, 0, 0x0, ...
 03234  1036   NtWaitForSingleObject  (216, 0, 0x0, ...
 03235  1248   NtWaitForSingleObject  (216, 0, 0x0, ...
 03236  1656   NtWaitForSingleObject  (216, 0, 0x0, ...
 03237   760   NtWaitForSingleObject  (216, 0, 0x0, ...
 03238   484   NtWaitForSingleObject  (216, 0, 0x0, ...
 03239  1580   NtWaitForSingleObject  (216, 0, 0x0, ...
 03240  1756   NtWaitForSingleObject  (216, 0, 0x0, ...
 03241  1304   NtWaitForSingleObject  (216, 0, 0x0, ...
 03242  2052   NtWaitForSingleObject  (216, 0, 0x0, ...
 03243  2056   NtWaitForSingleObject  (216, 0, 0x0, ...
 03244  2060   NtWaitForSingleObject  (216, 0, 0x0, ...
 03245  2064   NtWaitForSingleObject  (216, 0, 0x0, ...
 03246  2068   NtWaitForSingleObject  (216, 0, 0x0, ...
 03247  2072   NtWaitForSingleObject  (216, 0, 0x0, ...
 03248  2076   NtWaitForSingleObject  (216, 0, 0x0, ...
 03249  2080   NtWaitForSingleObject  (216, 0, 0x0, ...
 03250  2084   NtWaitForSingleObject  (216, 0, 0x0, ...
 03251  2088   NtWaitForSingleObject  (216, 0, 0x0, ...
 03252  2092   NtWaitForSingleObject  (216, 0, 0x0, ...
 03253  2096   NtWaitForSingleObject  (216, 0, 0x0, ...
 03254  2100   NtWaitForSingleObject  (216, 0, 0x0, ...
 03255  2104   NtWaitForSingleObject  (216, 0, 0x0, ...
 03256  2108   NtWaitForSingleObject  (216, 0, 0x0, ...
 03257  2112   NtWaitForSingleObject  (216, 0, 0x0, ...
 03258  2116   NtWaitForSingleObject  (216, 0, 0x0, ...
 03259  2120   NtWaitForSingleObject  (216, 0, 0x0, ...
 03260  2124   NtWaitForSingleObject  (216, 0, 0x0, ...
 03261  2128   NtWaitForSingleObject  (216, 0, 0x0, ...
 03262  2132   NtWaitForSingleObject  (216, 0, 0x0, ...
 03263  2136   NtWaitForSingleObject  (216, 0, 0x0, ...
 03264  2140   NtWaitForSingleObject  (216, 0, 0x0, ...
 03265  2144   NtWaitForSingleObject  (216, 0, 0x0, ...
 03266  2148   NtWaitForSingleObject  (216, 0, 0x0, ...
 03267  2152   NtWaitForSingleObject  (216, 0, 0x0, ...
 03268  2156   NtWaitForSingleObject  (216, 0, 0x0, ...
 03269  2160   NtWaitForSingleObject  (216, 0, 0x0, ...
 03270  2164   NtWaitForSingleObject  (216, 0, 0x0, ...
 03271  2168   NtWaitForSingleObject  (216, 0, 0x0, ...
 03272  2172   NtWaitForSingleObject  (216, 0, 0x0, ...
 03273  2176   NtWaitForSingleObject  (216, 0, 0x0, ...
 03274  2180   NtWaitForSingleObject  (216, 0, 0x0, ...
 03275  2184   NtWaitForSingleObject  (216, 0, 0x0, ...
 03276  2188   NtWaitForSingleObject  (216, 0, 0x0, ...
 03277  2192   NtWaitForSingleObject  (216, 0, 0x0, ...
 03278  2196   NtWaitForSingleObject  (216, 0, 0x0, ...
 03279  2200   NtWaitForSingleObject  (216, 0, 0x0, ...
 03280  2204   NtWaitForSingleObject  (216, 0, 0x0, ...
 03281  2208   NtWaitForSingleObject  (216, 0, 0x0, ...
 03282  2212   NtWaitForSingleObject  (216, 0, 0x0, ...
 03227   896   NtClose  ... ) == 0x0
 03283   896   NtClose  (768, ... ) == 0x0
 03284   896   NtDelayExecution  (0, {-10000000, -1}, ...
 03188   928   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03285   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 768, ) }, ... 768, ) == 0x0
 03286   928   NtQueryValueKey  (768,  (768, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (768, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03287   928   NtClose  (768, ... ) == 0x0
 03288   928   NtQueryValueKey  (96,  (96, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03289   928   NtQueryValueKey  (96,  (96, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03290   928   NtQueryValueKey  (96,  (96, "IdnEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03291   928   NtQueryValueKey  (96,  (96, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03292   928   NtQueryValueKey  (96,  (96, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03293   928   NtQueryValueKey  (96,  (96, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03294   928   NtQueryValueKey  (96,  (96, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03295   928   NtQueryValueKey  (96,  (96, "DisableBasicOverClearChannel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03296   928   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03297   928   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03298   928   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03299   928   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 768, ) }, ... 768, ) == 0x0
 03300   928   NtQueryValueKey  (768,  (768, "Feature_ClientAuthCertFilter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03301   928   NtClose  (768, ... ) == 0x0
 03302   928   NtAllocateVirtualMemory  (-1, 20041728, 0, 4096, 4096, 260, ... 20041728, 4096, ) == 0x0
 03303   928   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03304   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 20049552, ... ) }, 20049552, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03305   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 20049552, ... ) }, 20049552, ... ) == 0x0
 03306   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 5, 96, ... 768, {status=0x0, info=1}, ) }, 5, 96, ... 768, {status=0x0, info=1}, ) == 0x0
 03307   928   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 768, ... 772, ) == 0x0
 03308   928   NtQuerySection  (772, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03309   928   NtClose  (768, ... ) == 0x0
 03310   928   NtMapViewOfSection  (772, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77fe0000), 0x0, 69632, ) == 0x0
 03311   928   NtClose  (772, ... ) == 0x0
 03312   928   NtProtectVirtualMemory  (-1, (0x77fe1000), 388, 4, ... (0x77fe1000), 4096, 32, ) == 0x0
 03313   928   NtProtectVirtualMemory  (-1, (0x77fe1000), 4096, 32, ... (0x77fe1000), 4096, 4, ) == 0x0
 03314   928   NtFlushInstructionCache  (-1, 2013138944, 388, ... ) == 0x0
 03315   928   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03316   928   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 772, ) == 0x0
 03317   928   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 768, ) == 0x0
 03318   928   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 780, ) }, ... 780, ) == 0x0
 03319   928   NtQueryEvent  (780, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 03320   928   NtClose  (780, ... ) == 0x0
 03321   928   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 20051124, 140, ... 780, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 20051124, 140, ... 780, 0x0, 0x0, 256, 140, ) == 0x0
 03322   928   NtRequestWaitReplyPort  (780, {28, 52, new_msg, 0, 0, 0, 0, 0}  (780, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\330\353\24\0" ... {188, 212, reply, 0, 1252, 928, 81983, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ... {188, 212, reply, 0, 1252, 928, 81983, 0}  (780, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\330\353\24\0" ... {188, 212, reply, 0, 1252, 928, 81983, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ) == 0x0
 03323   928   NtQueryValueKey  (96,  (96, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03324   928   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 784, ) }, ... 784, ) == 0x0
 03325   928   NtQueryValueKey  (784,  (784, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03326   928   NtClose  (784, ... ) == 0x0
 03327   928   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 784, ) }, ... 784, ) == 0x0
 03328   928   NtOpenKey  (0xf, {24, 100, 0x40, 0, 0,  (0xf, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 788, ) }, ... 788, ) == 0x0
 03329   928   NtOpenKey  (0x9, {24, 100, 0x40, 0, 0,  (0x9, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 792, ) }, ... 792, ) == 0x0
 03330   928   NtQueryValueKey  (792,  (792, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 03331   928   NtQueryValueKey  (792,  (792, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 03332   928   NtClose  (792, ... ) == 0x0
 03333   928   NtOpenKey  (0xf, {24, 788, 0x40, 0, 0,  (0xf, {24, 788, 0x40, 0, 0, "Content"}, ... 792, ) }, ... 792, ) == 0x0
 03334   928   NtQueryValueKey  (792,  (792, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03335   928   NtOpenKey  (0xf, {24, 784, 0x40, 0, 0,  (0xf, {24, 784, 0x40, 0, 0, "Content"}, ... 796, ) }, ... 796, ) == 0x0
 03336   928   NtQueryValueKey  (796,  (796, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (796, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03337   928   NtClose  (796, ... ) == 0x0
 03338   928   NtClose  (792, ... ) == 0x0
 03339   928   NtOpenKey  (0xf, {24, 788, 0x40, 0, 0,  (0xf, {24, 788, 0x40, 0, 0, "Content"}, ... 792, ) }, ... 792, ) == 0x0
 03340   928   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... 796, ) }, ... 796, ) == 0x0
 03341   928   NtMapViewOfSection  (796, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 03342   928   NtClose  (796, ... ) == 0x0
 03343   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03344   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03345   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03346   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03347   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03348   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03349   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03350   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03351   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03352   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03353   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03354   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03355   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03356   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03357   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03358   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03359   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03360   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03361   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03362   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03363   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03364   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 03365   928   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 03366   928   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 03367   928   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03368   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 796, ) }, ... 796, ) == 0x0
 03369   928   NtQueryValueKey  (796,  (796, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (796, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03370   928   NtAllocateVirtualMemory  (-1, 20037632, 0, 4096, 4096, 260, ... 20037632, 4096, ) == 0x0
 03371   928   NtClose  (796, ... ) == 0x0
 03372   928   NtQueryDefaultUILanguage  (20046148, ...
 03373   928   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03374   928   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481484, ) == 0x0
 03375   928   NtQueryInformationToken  (-2147481484, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03376   928   NtClose  (-2147481484, ... ) == 0x0
 03377   928   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481484, ) }, ... -2147481484, ) == 0x0
 03378   928   NtOpenKey  (0x80000000, {24, -2147481484, 0x240, 0, 0,  (0x80000000, {24, -2147481484, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03379   928   NtOpenKey  (0x80000000, {24, -2147481484, 0x640, 0, 0,  (0x80000000, {24, -2147481484, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481480, ) }, ... -2147481480, ) == 0x0
 03380   928   NtQueryValueKey  (-2147481480,  (-2147481480, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03381   928   NtClose  (-2147481480, ... ) == 0x0
 03382   928   NtClose  (-2147481484, ... ) == 0x0
 03372   928   NtQueryDefaultUILanguage  ... ) == 0x0
 03383   928   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... 796, {status=0x0, info=1}, ) }, 1, 96, ... 796, {status=0x0, info=1}, ) == 0x0
 03384   928   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 796, ... 800, ) == 0x0
 03385   928   NtMapViewOfSection  (800, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8d20000), 0x0, 8462336, ) == 0x0
 03386   928   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03387   928   NtAllocateVirtualMemory  (-1, 20033536, 0, 4096, 4096, 260, ... 20033536, 4096, ) == 0x0
 03388   928   NtQueryDefaultLocale  (1, 20044244, ... ) == 0x0
 03389   928   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03390   928   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 20045280, 1179817, 20045004}  (24, {128, 156, new_msg, 0, 2088850039, 20045280, 1179817, 20045004} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\34\3\0\0\377\377\377\377\0\0\0\0@ \365\10\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\324\3411\1\0\0\0\0" ... {128, 156, reply, 0, 1252, 928, 81984, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\34\3\0\0\377\377\377\377\0\0\0\0@ \365\10\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\324\3411\1\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 928, 81984, 0}  (24, {128, 156, new_msg, 0, 2088850039, 20045280, 1179817, 20045004} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\34\3\0\0\377\377\377\377\0\0\0\0@ \365\10\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\324\3411\1\0\0\0\0" ... {128, 156, reply, 0, 1252, 928, 81984, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\34\3\0\0\377\377\377\377\0\0\0\0@ \365\10\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\324\3411\1\0\0\0\0" )  ) == 0x0
 03391   928   NtClose  (796, ... ) == 0x0
 03392   928   NtClose  (800, ... ) == 0x0
 03393   928   NtUnmapViewOfSection  (-1, 0x8d20000, ... ) == 0x0
 03394   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03395   928   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03396   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03397   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03398   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 20043436, ... ) }, 20043436, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03399   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03400   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03401   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03402   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 20043500, ... ) }, 20043500, ... ) == 0x0
 03403   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 800, {status=0x0, info=1}, ) }, 3, 33, ... 800, {status=0x0, info=1}, ) == 0x0
 03404   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03405   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 796, {status=0x0, info=1}, ) }, 5, 96, ... 796, {status=0x0, info=1}, ) == 0x0
 03406   928   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 796, ... 804, ) == 0x0
 03407   928   NtClose  (796, ... ) == 0x0
 03408   928   NtMapViewOfSection  (804, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8d20000), 0x0, 1056768, ) == 0x0
 03409   928   NtClose  (804, ... ) == 0x0
 03410   928   NtUnmapViewOfSection  (-1, 0x8d20000, ... ) == 0x0
 03411   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 804, {status=0x0, info=1}, ) }, 5, 96, ... 804, {status=0x0, info=1}, ) == 0x0
 03412   928   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 804, ... 796, ) == 0x0
 03413   928   NtQuerySection  (796, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03414   928   NtClose  (804, ... ) == 0x0
 03415   928   NtMapViewOfSection  (796, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 03416   928   NtClose  (796, ... ) == 0x0
 03417   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03418   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03419   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03420   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03421   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03422   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03423   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03424   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03425   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03426   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03427   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03428   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03429   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03430   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03431   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03432   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03433   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03434   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03435   928   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 03436   928   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 03437   928   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 03438   928   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03439   928   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 20044980, ... ) , 42, 20044980, ... ) == 0x0
 03440   928   NtQueryDefaultUILanguage  (20043664, ...
 03441   928   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03442   928   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481484, ) == 0x0
 03443   928   NtQueryInformationToken  (-2147481484, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03444   928   NtClose  (-2147481484, ... ) == 0x0
 03445   928   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481484, ) }, ... -2147481484, ) == 0x0
 03446   928   NtOpenKey  (0x80000000, {24, -2147481484, 0x240, 0, 0,  (0x80000000, {24, -2147481484, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03447   928   NtOpenKey  (0x80000000, {24, -2147481484, 0x640, 0, 0,  (0x80000000, {24, -2147481484, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481480, ) }, ... -2147481480, ) == 0x0
 03448   928   NtQueryValueKey  (-2147481480,  (-2147481480, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03449   928   NtClose  (-2147481480, ... ) == 0x0
 03450   928   NtClose  (-2147481484, ... ) == 0x0
 03440   928   NtQueryDefaultUILanguage  ... ) == 0x0
 03451   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 20042504, ... ) }, 20042504, ... ) == 0x0
 03452   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 796, {status=0x0, info=1}, ) }, 5, 96, ... 796, {status=0x0, info=1}, ) == 0x0
 03453   928   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 796, ... 804, ) == 0x0
 03454   928   NtClose  (796, ... ) == 0x0
 03455   928   NtMapViewOfSection  (804, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xde0000), 0x0, 4096, ) == 0x0
 03456   928   NtClose  (804, ... ) == 0x0
 03457   928   NtUnmapViewOfSection  (-1, 0xde0000, ... ) == 0x0
 03458   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 20042100, ... ) }, 20042100, ... ) == 0x0
 03459   928   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 20042844,  (0x80100080, {24, 0, 0x40, 0, 20042844, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 804, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 804, {status=0x0, info=1}, ) == 0x0
 03460   928   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 804, ... 796, ) == 0x0
 03461   928   NtClose  (804, ... ) == 0x0
 03462   928   NtMapViewOfSection  (796, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xde0000), {0, 0}, 4096, ) == 0x0
 03463   928   NtClose  (796, ... ) == 0x0
 03464   928   NtUnmapViewOfSection  (-1, 0xde0000, ... ) == 0x0
 03465   928   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 796, {status=0x0, info=1}, ) }, 1, 96, ... 796, {status=0x0, info=1}, ) == 0x0
 03466   928   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 796, ... 804, ) == 0x0
 03467   928   NtMapViewOfSection  (804, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xde0000), 0x0, 4096, ) == 0x0
 03468   928   NtQueryInformationFile  (796, 20042496, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03469   928   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03470   928   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 20042796, 1179817, 20042520}  (24, {128, 156, new_msg, 0, 2088850039, 20042796, 1179817, 20042520} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1\34\3\0\0$\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0 \3301\1\0\0\0\0" ... {128, 156, reply, 0, 1252, 928, 81985, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1\34\3\0\0$\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0 \3301\1\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 928, 81985, 0}  (24, {128, 156, new_msg, 0, 2088850039, 20042796, 1179817, 20042520} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1\34\3\0\0$\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0 \3301\1\0\0\0\0" ... {128, 156, reply, 0, 1252, 928, 81985, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1\34\3\0\0$\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0 \3301\1\0\0\0\0" )  ) == 0x0
 03471   928   NtClose  (796, ... ) == 0x0
 03472   928   NtClose  (804, ... ) == 0x0
 03473   928   NtUnmapViewOfSection  (-1, 0xde0000, ... ) == 0x0
 03474   928   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03475   928   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 03476   928   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 804, ) == 0x0
 03477   928   NtCallbackReturn  (0, 0, 0, ...
 03478   928   NtUserGetThreadState  (18, ... ) == 0x1
 03479   928   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 03480   928   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 03481   928   NtUserGetDC  (0, ... ) == 0x1010051
 03482   928   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 03483   928   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 03484   928   NtUserSystemParametersInfo  (66, 12, 20044496, 0, ... ) == 0x1
 03485   928   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03486   928   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 796, ) == 0x0
 03487   928   NtQueryInformationToken  (796, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03488   928   NtClose  (796, ... ) == 0x0
 03489   928   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 796, ) }, ... 796, ) == 0x0
 03490   928   NtOpenProcessToken  (-1, 0x8, ... 808, ) == 0x0
 03491   928   NtAccessCheck  (1337328, 808, 0x1, 20044328, 20044380, 56, 20044360, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 03492   928   NtClose  (808, ... ) == 0x0
 03493   928   NtOpenKey  (0x20019, {24, 796, 0x40, 0, 0,  (0x20019, {24, 796, 0x40, 0, 0, "Control Panel\Desktop"}, ... 808, ) }, ... 808, ) == 0x0
 03494   928   NtQueryValueKey  (808,  (808, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03495   928   NtClose  (808, ... ) == 0x0
 03496   928   NtUserSystemParametersInfo  (41, 500, 20044524, 0, ... ) == 0x1
 03497   928   NtOpenProcessToken  (-1, 0x8, ... 808, ) == 0x0
 03498   928   NtAccessCheck  (1337328, 808, 0x1, 20044328, 20044380, 56, 20044360, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 03499   928   NtClose  (808, ... ) == 0x0
 03500   928   NtOpenKey  (0x20019, {24, 796, 0x40, 0, 0,  (0x20019, {24, 796, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 808, ) }, ... 808, ) == 0x0
 03501   928   NtQueryValueKey  (808,  (808, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03502   928   NtClose  (808, ... ) == 0x0
 03503   928   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 03504   928   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 03505   928   NtClose  (796, ... ) == 0x0
 03506   928   NtUserSystemParametersInfo  (4130, 0, 20045028, 0, ... ) == 0x1
 03507   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 796, ) }, ... 796, ) == 0x0
 03508   928   NtEnumerateValueKey  (796, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03509   928   NtClose  (796, ... ) == 0x0
 03510   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03511   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c03b
 03512   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c03d
 03513   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03514   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c03f
 03515   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03516   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c041
 03517   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03518   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c043
 03519   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c045
 03520   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03521   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c047
 03522   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03523   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c049
 03524   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03525   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c04b
 03526   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03527   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c04d
 03528   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03529   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c04f
 03530   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c051
 03531   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03532   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c053
 03533   928   NtUserFindExistingCursorIcon  (20044272, 20044288, 20044336, ... ) == 0x10011
 03534   928   NtUserRegisterClassExWOW  (20044216, 20044284, 20044300, 20044316, 0, 384, 0, ... ) == 0x81a2c055
 03535   928   NtUserFindExistingCursorIcon  (20044272, 20044288, 20044336, ... ) == 0x10011
 03536   928   NtUserRegisterClassExWOW  (20044216, 20044284, 20044300, 20044316, 0, 384, 0, ... ) == 0x81a2c057
 03537   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03538   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c059
 03539   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10013
 03540   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c05b
 03541   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03542   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c05d
 03543   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03544   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c05f
 03545   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03546   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c017
 03547   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03548   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c019
 03549   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10013
 03550   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c018
 03551   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03552   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c01a
 03553   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03554   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c01c
 03555   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03556   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c01e
 03557   928   NtUserFindExistingCursorIcon  (20044268, 20044284, 20044332, ... ) == 0x10011
 03558   928   NtUserRegisterClassExWOW  (20044268, 20044336, 20044352, 20044368, 0, 384, 0, ... ) == 0x81a2c01b
 03559   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03560   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c068
 03561   928   NtUserFindExistingCursorIcon  (20044276, 20044292, 20044340, ... ) == 0x10011
 03562   928   NtUserRegisterClassExWOW  (20044220, 20044288, 20044304, 20044320, 0, 384, 0, ... ) == 0x81a2c06a
 03563   928   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03564   928   NtCreateSemaphore  (0x1f0003, {24, 44, 0x80, 1331504, 0,  (0x1f0003, {24, 44, 0x80, 1331504, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 796, ) }, 0, 2147483647, ... 796, ) == STATUS_OBJECT_NAME_EXISTS
 03565   928   NtReleaseSemaphore  (796, 1, ... 0, ) == 0x0
 03566   928   NtWaitForSingleObject  (796, 0, {0, 0}, ... ) == 0x0
 03567   928   NtCreateKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 808, 2, ) }, 0, 0x0, 0, ... 808, 2, ) == 0x0
 03568   928   NtQueryValueKey  (808,  (808, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (808, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 03569   928   NtClose  (808, ... ) == 0x0
 03570   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 20049220, ... ) }, 20049220, ... ) == 0x0
 03571   928   NtCreateKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 808, 2, ) }, 0, 0x0, 0, ... 808, 2, ) == 0x0
 03572   928   NtSetValueKey  (808,  (808, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 0, 1,  (808, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 162, ... ) == 0x0
 03573   928   NtClose  (808, ... ) == 0x0
 03574   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 20049912, ... ) }, 20049912, ... ) == 0x0
 03575   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 20049120, ... ) }, 20049120, ... ) == 0x0
 03576   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 808, {status=0x0, info=1}, ) }, 7, 2113568, ... 808, {status=0x0, info=1}, ) == 0x0
 03577   928   NtSetInformationFile  (808, 20049092, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03578   928   NtClose  (808, ... ) == 0x0
 03579   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\desktop.ini"}, 20049116, ... ) }, 20049116, ... ) == 0x0
 03580   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 20049912, ... ) }, 20049912, ... ) == 0x0
 03581   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 20049120, ... ) }, 20049120, ... ) == 0x0
 03582   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 7, 2113568, ... 808, {status=0x0, info=1}, ) }, 7, 2113568, ... 808, {status=0x0, info=1}, ) == 0x0
 03583   928   NtSetInformationFile  (808, 20049092, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03584   928   NtClose  (808, ... ) == 0x0
 03585   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 20049116, ... ) }, 20049116, ... ) == 0x0
 03586   928   NtQueryValueKey  (792,  (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03587   928   NtQueryValueKey  (792,  (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03588   928   NtQueryValueKey  (792,  (792, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (792, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) }, 16, ) == 0x0
 03589   928   NtOpenKey  (0xf, {24, 788, 0x40, 0, 0,  (0xf, {24, 788, 0x40, 0, 0, "Cookies"}, ... 808, ) }, ... 808, ) == 0x0
 03590   928   NtQueryValueKey  (808,  (808, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03591   928   NtOpenKey  (0xf, {24, 784, 0x40, 0, 0,  (0xf, {24, 784, 0x40, 0, 0, "Cookies"}, ... 812, ) }, ... 812, ) == 0x0
 03592   928   NtQueryValueKey  (812,  (812, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (812, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03593   928   NtClose  (812, ... ) == 0x0
 03594   928   NtClose  (808, ... ) == 0x0
 03595   928   NtClose  (792, ... ) == 0x0
 03596   928   NtOpenKey  (0xf, {24, 788, 0x40, 0, 0,  (0xf, {24, 788, 0x40, 0, 0, "Cookies"}, ... 792, ) }, ... 792, ) == 0x0
 03597   928   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03598   928   NtReleaseSemaphore  (796, 1, ... 0, ) == 0x0
 03599   928   NtWaitForSingleObject  (796, 0, {0, 0}, ... ) == 0x0
 03600   928   NtCreateKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 808, 2, ) }, 0, 0x0, 0, ... 808, 2, ) == 0x0
 03601   928   NtQueryValueKey  (808,  (808, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (808, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 03602   928   NtClose  (808, ... ) == 0x0
 03603   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 20049220, ... ) }, 20049220, ... ) == 0x0
 03604   928   NtCreateKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 808, 2, ) }, 0, 0x0, 0, ... 808, 2, ) == 0x0
 03605   928   NtSetValueKey  (808,  (808, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 0, 1,  (808, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 98, ... ) == 0x0
 03606   928   NtClose  (808, ... ) == 0x0
 03607   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 20049912, ... ) }, 20049912, ... ) == 0x0
 03608   928   NtQueryValueKey  (792,  (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 03609   928   NtQueryValueKey  (792,  (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 03610   928   NtQueryValueKey  (792,  (792, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (792, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 03611   928   NtOpenKey  (0xf, {24, 788, 0x40, 0, 0,  (0xf, {24, 788, 0x40, 0, 0, "History"}, ... 808, ) }, ... 808, ) == 0x0
 03612   928   NtQueryValueKey  (808,  (808, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03613   928   NtOpenKey  (0xf, {24, 784, 0x40, 0, 0,  (0xf, {24, 784, 0x40, 0, 0, "History"}, ... 812, ) }, ... 812, ) == 0x0
 03614   928   NtQueryValueKey  (812,  (812, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (812, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03615   928   NtClose  (812, ... ) == 0x0
 03616   928   NtClose  (808, ... ) == 0x0
 03617   928   NtClose  (792, ... ) == 0x0
 03618   928   NtOpenKey  (0xf, {24, 788, 0x40, 0, 0,  (0xf, {24, 788, 0x40, 0, 0, "History"}, ... 792, ) }, ... 792, ) == 0x0
 03619   928   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03620   928   NtReleaseSemaphore  (796, 1, ... 0, ) == 0x0
 03621   928   NtWaitForSingleObject  (796, 0, {0, 0}, ... ) == 0x0
 03622   928   NtCreateKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 808, 2, ) }, 0, 0x0, 0, ... 808, 2, ) == 0x0
 03623   928   NtQueryValueKey  (808,  (808, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (808, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 03624   928   NtClose  (808, ... ) == 0x0
 03625   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 20049220, ... ) }, 20049220, ... ) == 0x0
 03626   928   NtCreateKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 808, 2, ) }, 0, 0x0, 0, ... 808, 2, ) == 0x0
 03627   928   NtSetValueKey  (808,  (808, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 0, 1,  (808, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 128, ... ) == 0x0
 03628   928   NtClose  (808, ... ) == 0x0
 03629   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 20049912, ... ) }, 20049912, ... ) == 0x0
 03630   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 20049120, ... ) }, 20049120, ... ) == 0x0
 03631   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 7, 2113568, ... 808, {status=0x0, info=1}, ) }, 7, 2113568, ... 808, {status=0x0, info=1}, ) == 0x0
 03632   928   NtSetInformationFile  (808, 20049092, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03633   928   NtClose  (808, ... ) == 0x0
 03634   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\desktop.ini"}, 20049116, ... ) }, 20049116, ... ) == 0x0
 03635   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 20049912, ... ) }, 20049912, ... ) == 0x0
 03636   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 20049120, ... ) }, 20049120, ... ) == 0x0
 03637   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 7, 2113568, ... 808, {status=0x0, info=1}, ) }, 7, 2113568, ... 808, {status=0x0, info=1}, ) == 0x0
 03638   928   NtSetInformationFile  (808, 20049092, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03639   928   NtClose  (808, ... ) == 0x0
 03640   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 20049116, ... ) }, 20049116, ... ) == 0x0
 03641   928   NtQueryValueKey  (792,  (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 03642   928   NtQueryValueKey  (792,  (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (792, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 03643   928   NtQueryValueKey  (792,  (792, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (792, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 03644   928   NtClose  (792, ... ) == 0x0
 03645   928   NtClose  (788, ... ) == 0x0
 03646   928   NtClose  (784, ... ) == 0x0
 03647   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\_!MSFTHISTORY!_"}, ... 784, ) }, ... 784, ) == 0x0
 03648   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!temporary internet files!content.ie5!"}, ... 788, ) }, ... 788, ) == 0x0
 03649   928   NtWaitForSingleObject  (788, 0, 0x0, ... ) == 0x0
 03650   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 20051220, ... ) }, 20051220, ... ) == 0x0
 03651   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 792, {status=0x0, info=1}, ) }, 7, 2113568, ... 792, {status=0x0, info=1}, ) == 0x0
 03652   928   NtSetInformationFile  (792, 20051196, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03653   928   NtClose  (792, ... ) == 0x0
 03654   928   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 20051136,  (0xc0100080, {24, 0, 0x40, 0, 20051136, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 792, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 792, {status=0x0, info=1}, ) == 0x0
 03655   928   NtSetInformationFile  (792, 20051188, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03656   928   NtQueryInformationFile  (792, 20051188, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03657   928   NtOpenSection  (0x2, {24, 44, 0x0, 0, 0,  (0x2, {24, 44, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_Temporary Internet Files_Content.IE5_index.dat_802816"}, ... 808, ) }, ... 808, ) == 0x0
 03658   928   NtMapViewOfSection  (808, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x8d20000), {0, 0}, 802816, ) == 0x0
 03659   928   NtReleaseMutant  (788, ... 0x0, ) == 0x0
 03660   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!cookies!"}, ... 812, ) }, ... 812, ) == 0x0
 03661   928   NtWaitForSingleObject  (812, 0, 0x0, ... ) == 0x0
 03662   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 20051220, ... ) }, 20051220, ... ) == 0x0
 03663   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 7, 2113568, ... 816, {status=0x0, info=1}, ) }, 7, 2113568, ... 816, {status=0x0, info=1}, ) == 0x0
 03664   928   NtSetInformationFile  (816, 20051196, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03665   928   NtClose  (816, ... ) == 0x0
 03666   928   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 20051136,  (0xc0100080, {24, 0, 0x40, 0, 20051136, "\??\C:\Documents and Settings\Martim Carbone\Cookies\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 816, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 816, {status=0x0, info=1}, ) == 0x0
 03667   928   NtSetInformationFile  (816, 20051188, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03668   928   NtQueryInformationFile  (816, 20051188, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03669   928   NtOpenSection  (0x2, {24, 44, 0x0, 0, 0,  (0x2, {24, 44, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Cookies_index.dat_32768"}, ... 820, ) }, ... 820, ) == 0x0
 03670   928   NtMapViewOfSection  (820, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xde0000), {0, 0}, 32768, ) == 0x0
 03671   928   NtReleaseMutant  (812, ... 0x0, ) == 0x0
 03672   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!history!history.ie5!"}, ... 824, ) }, ... 824, ) == 0x0
 03673   928   NtWaitForSingleObject  (824, 0, 0x0, ... ) == 0x0
 03674   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 20051220, ... ) }, 20051220, ... ) == 0x0
 03675   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 828, {status=0x0, info=1}, ) }, 7, 2113568, ... 828, {status=0x0, info=1}, ) == 0x0
 03676   928   NtSetInformationFile  (828, 20051196, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03677   928   NtClose  (828, ... ) == 0x0
 03678   928   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 20051136,  (0xc0100080, {24, 0, 0x40, 0, 20051136, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 828, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 828, {status=0x0, info=1}, ) == 0x0
 03679   928   NtSetInformationFile  (828, 20051188, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03680   928   NtQueryInformationFile  (828, 20051188, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03681   928   NtOpenSection  (0x2, {24, 44, 0x0, 0, 0,  (0x2, {24, 44, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_History_History.IE5_index.dat_81920"}, ... 832, ) }, ... 832, ) == 0x0
 03682   928   NtMapViewOfSection  (832, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xe00000), {0, 0}, 81920, ) == 0x0
 03683   928   NtReleaseMutant  (824, ... 0x0, ) == 0x0
 03684   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 20050796, ... ) }, 20050796, ... ) == 0x0
 03685   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 836, {status=0x0, info=1}, ) }, 7, 2113568, ... 836, {status=0x0, info=1}, ) == 0x0
 03686   928   NtSetInformationFile  (836, 20050768, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03687   928   NtClose  (836, ... ) == 0x0
 03688   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 20050792, ... ) }, 20050792, ... ) == 0x0
 03689   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 20050796, ... ) }, 20050796, ... ) == 0x0
 03690   928   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 836, {status=0x0, info=1}, ) }, 7, 2113568, ... 836, {status=0x0, info=1}, ) == 0x0
 03691   928   NtSetInformationFile  (836, 20050768, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03692   928   NtClose  (836, ... ) == 0x0
 03693   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 20050792, ... ) }, 20050792, ... ) == 0x0
 03694   928   NtWaitForSingleObject  (788, 0, 0x0, ... ) == 0x0
 03695   928   NtReleaseMutant  (788, ... 0x0, ) == 0x0
 03696   928   NtOpenKey  (0xf, {24, 100, 0x40, 0, 0,  (0xf, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 836, ) }, ... 836, ) == 0x0
 03697   928   NtOpenKey  (0xf, {24, 836, 0x40, 0, 0,  (0xf, {24, 836, 0x40, 0, 0, "Extensible Cache"}, ... 840, ) }, ... 840, ) == 0x0
 03698   928   NtClose  (836, ... ) == 0x0
 03699   928   NtWaitForSingleObject  (784, 0, {-600000000, -1}, ... ) == 0x0
 03700   928   NtEnumerateKey  (840, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name= (840, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name="feedplat"}, 32, ) }, 32, ) == 0x0
 03701   928   NtOpenKey  (0xf, {24, 840, 0x40, 0, 0,  (0xf, {24, 840, 0x40, 0, 0, "feedplat"}, ... 836, ) }, ... 836, ) == 0x0
 03702   928   NtQueryValueKey  (836,  (836, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03703   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03704   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 03705   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03706   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 03707   928   NtQueryValueKey  (836,  (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 03708   928   NtQueryValueKey  (836,  (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 03709   928   NtQueryValueKey  (836,  (836, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 03710   928   NtQueryValueKey  (836,  (836, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03711   928   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 03712   928   NtClose  (836, ... ) == 0x0
 03713   928   NtEnumerateKey  (840, 1, Basic, 288, ... {LastWrite={0x450668aa,0x1c8b090}, TitleIdx=0, Name= (840, 1, Basic, 288, ... {LastWrite={0x450668aa,0x1c8b090}, TitleIdx=0, Name="MSHist012008050720080508"}, 64, ) }, 64, ) == 0x0
 03714   928   NtOpenKey  (0xf, {24, 840, 0x40, 0, 0,  (0xf, {24, 840, 0x40, 0, 0, "MSHist012008050720080508"}, ... 836, ) }, ... 836, ) == 0x0
 03715   928   NtQueryValueKey  (836,  (836, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03716   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03717   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (836, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) }, 160, ) == 0x0
 03718   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03719   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (836, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0\0\0"}, 160, ) }, 160, ) == 0x0
 03720   928   NtQueryValueKey  (836,  (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 03721   928   NtQueryValueKey  (836,  (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\05\00\07\02\00\00\08\00\05\00\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 03722   928   NtQueryValueKey  (836,  (836, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 03723   928   NtQueryValueKey  (836,  (836, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 03724   928   NtClose  (836, ... ) == 0x0
 03725   928   NtEnumerateKey  (840, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name= (840, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name="UserData"}, 32, ) }, 32, ) == 0x0
 03726   928   NtOpenKey  (0xf, {24, 840, 0x40, 0, 0,  (0xf, {24, 840, 0x40, 0, 0, "UserData"}, ... 836, ) }, ... 836, ) == 0x0
 03727   928   NtQueryValueKey  (836,  (836, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03728   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03729   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 03730   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03731   928   NtQueryValueKey  (836,  (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (836, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 03732   928   NtQueryValueKey  (836,  (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 03733   928   NtQueryValueKey  (836,  (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (836, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 03734   928   NtQueryValueKey  (836,  (836, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) }, 16, ) == 0x0
 03735   928   NtQueryValueKey  (836,  (836, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) }, 16, ) == 0x0
 03736   928   NtClose  (836, ... ) == 0x0
 03737   928   NtEnumerateKey  (840, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03738   928   NtReleaseMutant  (784, ... 0x0, ) == 0x0
 03739   928   NtClose  (840, ... ) == 0x0
 03740   928   NtWaitForSingleObject  (788, 0, 0x0, ... ) == 0x0
 03741   928   NtReleaseMutant  (788, ... 0x0, ) == 0x0
 03742   928   NtWaitForSingleObject  (788, 0, 0x0, ... ) == 0x0
 03743   928   NtReleaseMutant  (788, ... 0x0, ) == 0x0
 03744   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03745   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03746   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03747   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03748   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03749   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03750   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03751   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 840, ) }, ... 840, ) == 0x0
 03752   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03753   928   NtOpenKey  (0x1, {24, 840, 0x40, 0, 0,  (0x1, {24, 840, 0x40, 0, 0, "RETRY_HEADERONLYPOST_ONCONNECTIONRESET"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03754   928   NtClose  (840, ... ) == 0x0
 03755   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03756   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03757   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 840, ) }, ... 840, ) == 0x0
 03758   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03759   928   NtOpenKey  (0x1, {24, 840, 0x40, 0, 0,  (0x1, {24, 840, 0x40, 0, 0, "FEATURE_BUFFERBREAKING_818408"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03760   928   NtClose  (840, ... ) == 0x0
 03761   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03762   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03763   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 840, ) }, ... 840, ) == 0x0
 03764   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03765   928   NtOpenKey  (0x1, {24, 840, 0x40, 0, 0,  (0x1, {24, 840, 0x40, 0, 0, "FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03766   928   NtClose  (840, ... ) == 0x0
 03767   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03768   928   NtQueryValueKey  (96,  (96, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03769   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03770   928   NtQueryValueKey  (840,  (840, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03771   928   NtClose  (840, ... ) == 0x0
 03772   928   NtQueryValueKey  (96,  (96, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03773   928   NtQueryValueKey  (96,  (96, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03774   928   NtQueryValueKey  (96,  (96, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03775   928   NtQueryValueKey  (96,  (96, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03776   928   NtQueryValueKey  (96,  (96, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03777   928   NtQueryValueKey  (96,  (96, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03778   928   NtQueryValueKey  (96,  (96, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03779   928   NtQueryValueKey  (96,  (96, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03780   928   NtQueryValueKey  (96,  (96, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03781   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03782   928   NtQueryValueKey  (840,  (840, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03783   928   NtClose  (840, ... ) == 0x0
 03784   928   NtQueryValueKey  (96,  (96, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03785   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03786   928   NtQueryValueKey  (840,  (840, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03787   928   NtClose  (840, ... ) == 0x0
 03788   928   NtQueryValueKey  (96,  (96, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03789   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03790   928   NtQueryValueKey  (840,  (840, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03791   928   NtClose  (840, ... ) == 0x0
 03792   928   NtQueryValueKey  (96,  (96, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03793   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03794   928   NtQueryValueKey  (840,  (840, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03795   928   NtClose  (840, ... ) == 0x0
 03796   928   NtQueryValueKey  (96,  (96, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03797   928   NtQueryValueKey  (96,  (96, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03798   928   NtQueryValueKey  (96,  (96, "CertCacheNoValidate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03799   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 840, ) }, ... 840, ) == 0x0
 03800   928   NtQueryValueKey  (840,  (840, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03801   928   NtClose  (840, ... ) == 0x0
 03802   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03803   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03804   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03805   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 840, ) }, ... 840, ) == 0x0
 03806   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 836, ) }, ... 836, ) == 0x0
 03807   928   NtQueryValueKey  (836,  (836, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03808   928   NtQueryValueKey  (840,  (840, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03809   928   NtClose  (840, ... ) == 0x0
 03810   928   NtClose  (836, ... ) == 0x0
 03811   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03812   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03813   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 836, ) }, ... 836, ) == 0x0
 03814   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03815   928   NtOpenKey  (0x1, {24, 836, 0x40, 0, 0,  (0x1, {24, 836, 0x40, 0, 0, "FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03816   928   NtClose  (836, ... ) == 0x0
 03817   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03818   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03819   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 836, ) }, ... 836, ) == 0x0
 03820   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03821   928   NtOpenKey  (0x1, {24, 836, 0x40, 0, 0,  (0x1, {24, 836, 0x40, 0, 0, "FEATURE_USE_CNAME_FOR_SPN_KB911149"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03822   928   NtClose  (836, ... ) == 0x0
 03823   928   NtQueryValueKey  (96,  (96, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03824   928   NtQueryValueKey  (96,  (96, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03825   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03826   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03827   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 836, ) }, ... 836, ) == 0x0
 03828   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03829   928   NtOpenKey  (0x1, {24, 836, 0x40, 0, 0,  (0x1, {24, 836, 0x40, 0, 0, "FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03830   928   NtClose  (836, ... ) == 0x0
 03831   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03832   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03833   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 836, ) }, ... 836, ) == 0x0
 03834   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03835   928   NtOpenKey  (0x1, {24, 836, 0x40, 0, 0,  (0x1, {24, 836, 0x40, 0, 0, "FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"}, ... 840, ) }, ... 840, ) == 0x0
 03836   928   NtQueryValueKey  (840,  (840, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03837   928   NtQueryValueKey  (840,  (840, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03838   928   NtClose  (840, ... ) == 0x0
 03839   928   NtClose  (836, ... ) == 0x0
 03840   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03841   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03842   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 836, ) }, ... 836, ) == 0x0
 03843   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03844   928   NtOpenKey  (0x1, {24, 836, 0x40, 0, 0,  (0x1, {24, 836, 0x40, 0, 0, "FEATURE_DIGEST_NO_EXTRAS_IN_URI"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03845   928   NtClose  (836, ... ) == 0x0
 03846   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03847   928   NtQueryValueKey  (836,  (836, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (836, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03848   928   NtClose  (836, ... ) == 0x0
 03849   928   NtQueryValueKey  (96,  (96, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03850   928   NtQueryValueKey  (96,  (96, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03851   928   NtQueryValueKey  (96,  (96, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03852   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03853   928   NtQueryValueKey  (836,  (836, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03854   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03855   928   NtQueryValueKey  (840,  (840, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03856   928   NtClose  (836, ... ) == 0x0
 03857   928   NtClose  (840, ... ) == 0x0
 03858   928   NtQueryValueKey  (96,  (96, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03859   928   NtQueryValueKey  (96,  (96, "BypassFtpTimeCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03860   928   NtQueryValueKey  (96,  (96, "ReleaseSocketDuringAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03861   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03862   928   NtQueryValueKey  (840,  (840, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03863   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03864   928   NtQueryValueKey  (836,  (836, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03865   928   NtClose  (840, ... ) == 0x0
 03866   928   NtClose  (836, ... ) == 0x0
 03867   928   NtQueryValueKey  (96,  (96, "WpadSearchAllDomains", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03868   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03869   928   NtQueryValueKey  (836,  (836, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03870   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03871   928   NtQueryValueKey  (840,  (840, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03872   928   NtClose  (836, ... ) == 0x0
 03873   928   NtClose  (840, ... ) == 0x0
 03874   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03875   928   NtQueryValueKey  (840,  (840, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03876   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03877   928   NtQueryValueKey  (836,  (836, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03878   928   NtClose  (840, ... ) == 0x0
 03879   928   NtClose  (836, ... ) == 0x0
 03880   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03881   928   NtQueryValueKey  (836,  (836, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03882   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03883   928   NtQueryValueKey  (840,  (840, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03884   928   NtClose  (836, ... ) == 0x0
 03885   928   NtClose  (840, ... ) == 0x0
 03886   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03887   928   NtQueryValueKey  (840,  (840, "EnableHttpTrace", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03888   928   NtClose  (840, ... ) == 0x0
 03889   928   NtOpenKey  (0x1, {24, 100, 0x40, 0, 0,  (0x1, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 840, ) }, ... 840, ) == 0x0
 03890   928   NtQueryValueKey  (840,  (840, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03891   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03892   928   NtQueryValueKey  (836,  (836, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03893   928   NtClose  (840, ... ) == 0x0
 03894   928   NtClose  (836, ... ) == 0x0
 03895   928   NtQueryValueKey  (96,  (96, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03896   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03897   928   NtQueryValueKey  (836,  (836, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03898   928   NtClose  (836, ... ) == 0x0
 03899   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 836, ) }, ... 836, ) == 0x0
 03900   928   NtQueryValueKey  (836,  (836, "ShareCredsWithWinHttp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03901   928   NtClose  (836, ... ) == 0x0
 03902   928   NtQueryValueKey  (96,  (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 03903   928   NtQueryValueKey  (96,  (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 03904   928   NtQueryValueKey  (96,  (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 03905   928   NtQueryValueKey  (96,  (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 03906   928   NtQueryValueKey  (96,  (96, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03907   928   NtQueryValueKey  (96,  (96, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03908   928   NtQueryValueKey  (96,  (96, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03909   928   NtQueryValueKey  (96,  (96, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03910   928   NtQueryValueKey  (96,  (96, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03911   928   NtQueryValueKey  (96,  (96, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03912   928   NtQueryValueKey  (96,  (96, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03913   928   NtQueryValueKey  (96,  (96, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03914   928   NtQueryValueKey  (96,  (96, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03915   928   NtQueryValueKey  (96,  (96, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03916   928   NtQueryValueKey  (96,  (96, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03917   928   NtQueryValueKey  (96,  (96, "WarnOnHTTPSToHTTPRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03918   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\WininetStartupMutex"}, ... 836, ) }, ... 836, ) == 0x0
 03919   928   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 840, ) == 0x0
 03920   928   NtQueryValueKey  (96,  (96, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03921   928   NtWaitForSingleObject  (788, 0, 0x0, ... ) == 0x0
 03922   928   NtReleaseMutant  (788, ... 0x0, ) == 0x0
 03923   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\WininetConnectionMutex"}, ... 844, ) }, ... 844, ) == 0x0
 03924   928   NtOpenMutant  (0x100000, {24, 44, 0x0, 0, 0,  (0x100000, {24, 44, 0x0, 0, 0, "Local\WininetProxyRegistryMutex"}, ... 848, ) }, ... 848, ) == 0x0
 03925   928   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 852, ) == 0x0
 03926   928   NtQueryValueKey  (96,  (96, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03927   928   NtQueryValueKey  (96,  (96, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03928   928   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 856, ) == 0x0
 03929   928   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 860, ) }, ... 860, ) == 0x0
 03930   928   NtQueryValueKey  (860,  (860, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (860, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 03931   928   NtQueryValueKey  (860,  (860, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (860, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 03932   928   NtClose  (860, ... ) == 0x0
 03933   928   NtQueryValueKey  (96,  (96, "TruncateFileName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03934   928   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 03935   928   NtQueryValueKey  (96,  (96, "BadProxyExpiresTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03936   928   NtSetEventBoostPriority  (216, ...
 01563   384   NtWaitForSingleObject  ... ) == 0x0
 03937   384   NtSetEventBoostPriority  (216, ...
 01570  1028   NtWaitForSingleObject  ... ) == 0x0
 03938  1028   NtSetEventBoostPriority  (216, ...
 01572  2012   NtWaitForSingleObject  ... ) == 0x0
 03939  2012   NtSetEventBoostPriority  (216, ...
 01573  1168   NtWaitForSingleObject  ... ) == 0x0
 03940  1168   NtSetEventBoostPriority  (216, ...
 01574  1180   NtWaitForSingleObject  ... ) == 0x0
 03941  1180   NtSetEventBoostPriority  (216, ...
 01632  1388   NtWaitForSingleObject  ... ) == 0x0
 03942  1388   NtSetEventBoostPriority  (216, ...
 01665  2036   NtWaitForSingleObject  ... ) == 0x0
 03943  2036   NtSetEventBoostPriority  (216, ...
 01681  1372   NtWaitForSingleObject  ... ) == 0x0
 03944  1372   NtSetEventBoostPriority  (216, ...
 01695  1600   NtWaitForSingleObject  ... ) == 0x0
 03945  1600   NtSetEventBoostPriority  (216, ...
 01714  1948   NtWaitForSingleObject  ... ) == 0x0
 03946  1948   NtSetEventBoostPriority  (216, ...
 01777  1096   NtWaitForSingleObject  ... ) == 0x0
 03947  1096   NtSetEventBoostPriority  (216, ...
 01804  1708   NtWaitForSingleObject  ... ) == 0x0
 03948  1708   NtSetEventBoostPriority  (216, ...
 01810  1024   NtWaitForSingleObject  ... ) == 0x0
 03949  1024   NtSetEventBoostPriority  (216, ...
 01831  1324   NtWaitForSingleObject  ... ) == 0x0
 03950  1324   NtSetEventBoostPriority  (216, ...
 01856  1776   NtWaitForSingleObject  ... ) == 0x0
 03951  1776   NtSetEventBoostPriority  (216, ...
 01877   500   NtWaitForSingleObject  ... ) == 0x0
 03952   500   NtSetEventBoostPriority  (216, ...
 01890   248   NtWaitForSingleObject  ... ) == 0x0
 03953   248   NtSetEventBoostPriority  (216, ...
 01919  1884   NtWaitForSingleObject  ... ) == 0x0
 03954  1884   NtSetEventBoostPriority  (216, ...
 01935  1308   NtWaitForSingleObject  ... ) == 0x0
 03955  1308   NtSetEventBoostPriority  (216, ...
 01949  1676   NtWaitForSingleObject  ... ) == 0x0
 03956  1676   NtSetEventBoostPriority  (216, ...
 01967  1620   NtWaitForSingleObject  ... ) == 0x0
 03957  1620   NtSetEventBoostPriority  (216, ...
 01997  1296   NtWaitForSingleObject  ... ) == 0x0
 03958  1296   NtSetEventBoostPriority  (216, ...
 02012   440   NtWaitForSingleObject  ... ) == 0x0
 03959   440   NtSetEventBoostPriority  (216, ...
 02029  1588   NtWaitForSingleObject  ... ) == 0x0
 03960  1588   NtSetEventBoostPriority  (216, ...
 02037  2044   NtWaitForSingleObject  ... ) == 0x0
 03961  2044   NtSetEventBoostPriority  (216, ...
 02058   588   NtWaitForSingleObject  ... ) == 0x0
 03962   588   NtSetEventBoostPriority  (216, ...
 02087  1652   NtWaitForSingleObject  ... ) == 0x0
 03963  1652   NtSetEventBoostPriority  (216, ...
 02103  1376   NtWaitForSingleObject  ... ) == 0x0
 03964  1376   NtSetEventBoostPriority  (216, ...
 02113  1436   NtWaitForSingleObject  ... ) == 0x0
 03965  1436   NtSetEventBoostPriority  (216, ...
 02140  1368   NtWaitForSingleObject  ... ) == 0x0
 03966  1368   NtSetEventBoostPriority  (216, ...
 02148   724   NtWaitForSingleObject  ... ) == 0x0
 03967   724   NtSetEventBoostPriority  (216, ...
 02181  1276   NtWaitForSingleObject  ... ) == 0x0
 03968  1276   NtSetEventBoostPriority  (216, ...
 02184   220   NtWaitForSingleObject  ... ) == 0x0
 03969   220   NtSetEventBoostPriority  (216, ...
 03157  2216   NtWaitForSingleObject  ... ) == 0x0
 03970  2216   NtSetEventBoostPriority  (216, ...
 03189   900   NtWaitForSingleObject  ... ) == 0x0
 03971   900   NtSetEventBoostPriority  (216, ...
 03190   748   NtWaitForSingleObject  ... ) == 0x0
 03972   748   NtSetEventBoostPriority  (216, ...
 03191  1732   NtWaitForSingleObject  ... ) == 0x0
 03973  1732   NtSetEventBoostPriority  (216, ...
 03192   428   NtWaitForSingleObject  ... ) == 0x0
 03974   428   NtSetEventBoostPriority  (216, ...
 03193  1300   NtWaitForSingleObject  ... ) == 0x0
 03975  1300   NtSetEventBoostPriority  (216, ...
 03194   252   NtWaitForSingleObject  ... ) == 0x0
 03976   252   NtSetEventBoostPriority  (216, ...
 03195  1328   NtWaitForSingleObject  ... ) == 0x0
 03977  1328   NtSetEventBoostPriority  (216, ...
 03196  1636   NtWaitForSingleObject  ... ) == 0x0
 03978  1636   NtSetEventBoostPriority  (216, ...
 03197   704   NtWaitForSingleObject  ... ) == 0x0
 03979   704   NtSetEventBoostPriority  (216, ...
 03198  1152   NtWaitForSingleObject  ... ) == 0x0
 03980  1152   NtSetEventBoostPriority  (216, ...
 03199  1228   NtWaitForSingleObject  ... ) == 0x0
 03981  1228   NtSetEventBoostPriority  (216, ...
 03200   792   NtWaitForSingleObject  ... ) == 0x0
 03982   792   NtSetEventBoostPriority  (216, ...
 03201  1484   NtWaitForSingleObject  ... ) == 0x0
 03983  1484   NtSetEventBoostPriority  (216, ...
 03202   888   NtWaitForSingleObject  ... ) == 0x0
 03984   888   NtSetEventBoostPriority  (216, ...
 03203  1120   NtWaitForSingleObject  ... ) == 0x0
 03985  1120   NtSetEventBoostPriority  (216, ...
 03204   840   NtWaitForSingleObject  ... ) == 0x0
 03986   840   NtSetEventBoostPriority  (216, ...
 03205   876   NtWaitForSingleObject  ... ) == 0x0
 03987   876   NtSetEventBoostPriority  (216, ...
 03206  1104   NtWaitForSingleObject  ... ) == 0x0
 03988  1104   NtSetEventBoostPriority  (216, ...
 03207   860   NtWaitForSingleObject  ... ) == 0x0
 03989   860   NtSetEventBoostPriority  (216, ...
 03208  1516   NtWaitForSingleObject  ... ) == 0x0
 03990  1516   NtSetEventBoostPriority  (216, ...
 03209   780   NtWaitForSingleObject  ... ) == 0x0
 03991   780   NtSetEventBoostPriority  (216, ...
 03210   940   NtWaitForSingleObject  ... ) == 0x0
 03992   940   NtSetEventBoostPriority  (216, ...
 03211  1268   NtWaitForSingleObject  ... ) == 0x0
 03993  1268   NtSetEventBoostPriority  (216, ...
 03212   644   NtWaitForSingleObject  ... ) == 0x0
 03994   644   NtSetEventBoostPriority  (216, ...
 03213  1736   NtWaitForSingleObject  ... ) == 0x0
 03995  1736   NtSetEventBoostPriority  (216, ...
 03214   320   NtWaitForSingleObject  ... ) == 0x0
 03996   320   NtSetEventBoostPriority  (216, ...
 03215   380   NtWaitForSingleObject  ... ) == 0x0
 03997   380   NtSetEventBoostPriority  (216, ...
 03216  1332   NtWaitForSingleObject  ... ) == 0x0
 03998  1332   NtSetEventBoostPriority  (216, ...
 03217  1336   NtWaitForSingleObject  ... ) == 0x0
 03999  1336   NtSetEventBoostPriority  (216, ...
 03218  1808   NtWaitForSingleObject  ... ) == 0x0
 04000  1808   NtSetEventBoostPriority  (216, ...
 03219   468   NtWaitForSingleObject  ... ) == 0x0
 04001   468   NtSetEventBoostPriority  (216, ...
 03220   752   NtWaitForSingleObject  ... ) == 0x0
 04002   752   NtSetEventBoostPriority  (216, ...
 03221  1512   NtWaitForSingleObject  ... ) == 0x0
 04003  1512   NtSetEventBoostPriority  (216, ...
 03222  1380   NtWaitForSingleObject  ... ) == 0x0
 04004  1380   NtSetEventBoostPriority  (216, ...
 03223  1564   NtWaitForSingleObject  ... ) == 0x0
 04005  1564   NtSetEventBoostPriority  (216, ...
 03224   164   NtWaitForSingleObject  ... ) == 0x0
 04006   164   NtSetEventBoostPriority  (216, ...
 03225   312   NtWaitForSingleObject  ... ) == 0x0
 04007   312   NtSetEventBoostPriority  (216, ...
 03226  1964   NtWaitForSingleObject  ... ) == 0x0
 04008  1964   NtSetEventBoostPriority  (216, ...
 03228  1568   NtWaitForSingleObject  ... ) == 0x0
 04009  1568   NtSetEventBoostPriority  (216, ...
 03229  1624   NtWaitForSingleObject  ... ) == 0x0
 04010  1624   NtSetEventBoostPriority  (216, ...
 03230  1716   NtWaitForSingleObject  ... ) == 0x0
 04011  1716   NtSetEventBoostPriority  (216, ...
 03231  1440   NtWaitForSingleObject  ... ) == 0x0
 04012  1440   NtSetEventBoostPriority  (216, ...
 03232  1664   NtWaitForSingleObject  ... ) == 0x0
 04013  1664   NtSetEventBoostPriority  (216, ...
 03233  1972   NtWaitForSingleObject  ... ) == 0x0
 04014  1972   NtSetEventBoostPriority  (216, ...
 03234  1036   NtWaitForSingleObject  ... ) == 0x0
 04015  1036   NtSetEventBoostPriority  (216, ...
 03235  1248   NtWaitForSingleObject  ... ) == 0x0
 04016  1248   NtSetEventBoostPriority  (216, ...
 03236  1656   NtWaitForSingleObject  ... ) == 0x0
 04017  1656   NtSetEventBoostPriority  (216, ...
 03237   760   NtWaitForSingleObject  ... ) == 0x0
 04018   760   NtSetEventBoostPriority  (216, ...
 03238   484   NtWaitForSingleObject  ... ) == 0x0
 04019   484   NtSetEventBoostPriority  (216, ...
 03239  1580   NtWaitForSingleObject  ... ) == 0x0
 04020  1580   NtSetEventBoostPriority  (216, ...
 03240  1756   NtWaitForSingleObject  ... ) == 0x0
 04021  1756   NtSetEventBoostPriority  (216, ...
 03241  1304   NtWaitForSingleObject  ... ) == 0x0
 04022  1304   NtSetEventBoostPriority  (216, ...
 03242  2052   NtWaitForSingleObject  ... ) == 0x0
 04023  2052   NtSetEventBoostPriority  (216, ...
 03243  2056   NtWaitForSingleObject  ... ) == 0x0
 04024  2056   NtSetEventBoostPriority  (216, ...
 03244  2060   NtWaitForSingleObject  ... ) == 0x0
 04025  2060   NtSetEventBoostPriority  (216, ...
 03245  2064   NtWaitForSingleObject  ... ) == 0x0
 04026  2064   NtSetEventBoostPriority  (216, ...
 03246  2068   NtWaitForSingleObject  ... ) == 0x0
 04027  2068   NtSetEventBoostPriority  (216, ...
 03247  2072   NtWaitForSingleObject  ... ) == 0x0
 04028  2072   NtSetEventBoostPriority  (216, ...
 03248  2076   NtWaitForSingleObject  ... ) == 0x0
 04029  2076   NtSetEventBoostPriority  (216, ...
 03249  2080   NtWaitForSingleObject  ... ) == 0x0
 04030  2080   NtSetEventBoostPriority  (216, ...
 03250  2084   NtWaitForSingleObject  ... ) == 0x0
 04031  2084   NtSetEventBoostPriority  (216, ...
 03251  2088   NtWaitForSingleObject  ... ) == 0x0
 04032  2088   NtSetEventBoostPriority  (216, ...
 03252  2092   NtWaitForSingleObject  ... ) == 0x0
 04033  2092   NtSetEventBoostPriority  (216, ...
 03253  2096   NtWaitForSingleObject  ... ) == 0x0
 04034  2096   NtSetEventBoostPriority  (216, ...
 03254  2100   NtWaitForSingleObject  ... ) == 0x0
 04035  2100   NtSetEventBoostPriority  (216, ...
 03255  2104   NtWaitForSingleObject  ... ) == 0x0
 04036  2104   NtSetEventBoostPriority  (216, ...
 03256  2108   NtWaitForSingleObject  ... ) == 0x0
 04037  2108   NtSetEventBoostPriority  (216, ...
 03257  2112   NtWaitForSingleObject  ... ) == 0x0
 04038  2112   NtSetEventBoostPriority  (216, ...
 03258  2116   NtWaitForSingleObject  ... ) == 0x0
 04039  2116   NtSetEventBoostPriority  (216, ...
 03259  2120   NtWaitForSingleObject  ... ) == 0x0
 04040  2120   NtSetEventBoostPriority  (216, ...
 03260  2124   NtWaitForSingleObject  ... ) == 0x0
 04041  2124   NtSetEventBoostPriority  (216, ...
 03261  2128   NtWaitForSingleObject  ... ) == 0x0
 04042  2128   NtSetEventBoostPriority  (216, ...
 03262  2132   NtWaitForSingleObject  ... ) == 0x0
 04043  2132   NtSetEventBoostPriority  (216, ...
 03263  2136   NtWaitForSingleObject  ... ) == 0x0
 04044  2136   NtSetEventBoostPriority  (216, ...
 03264  2140   NtWaitForSingleObject  ... ) == 0x0
 04045  2140   NtSetEventBoostPriority  (216, ...
 03265  2144   NtWaitForSingleObject  ... ) == 0x0
 04046  2144   NtSetEventBoostPriority  (216, ...
 03266  2148   NtWaitForSingleObject  ... ) == 0x0
 04047  2148   NtSetEventBoostPriority  (216, ...
 03267  2152   NtWaitForSingleObject  ... ) == 0x0
 04048  2152   NtSetEventBoostPriority  (216, ...
 03268  2156   NtWaitForSingleObject  ... ) == 0x0
 04049  2156   NtSetEventBoostPriority  (216, ...
 03269  2160   NtWaitForSingleObject  ... ) == 0x0
 04050  2160   NtSetEventBoostPriority  (216, ...
 03270  2164   NtWaitForSingleObject  ... ) == 0x0
 04051  2164   NtSetEventBoostPriority  (216, ...
 03271  2168   NtWaitForSingleObject  ... ) == 0x0
 04052  2168   NtSetEventBoostPriority  (216, ...
 03272  2172   NtWaitForSingleObject  ... ) == 0x0
 04053  2172   NtSetEventBoostPriority  (216, ...
 03273  2176   NtWaitForSingleObject  ... ) == 0x0
 04054  2176   NtSetEventBoostPriority  (216, ...
 03274  2180   NtWaitForSingleObject  ... ) == 0x0
 04055  2180   NtSetEventBoostPriority  (216, ...
 03275  2184   NtWaitForSingleObject  ... ) == 0x0
 04056  2184   NtSetEventBoostPriority  (216, ...
 03276  2188   NtWaitForSingleObject  ... ) == 0x0
 04057  2188   NtSetEventBoostPriority  (216, ...
 03277  2192   NtWaitForSingleObject  ... ) == 0x0
 04058  2192   NtSetEventBoostPriority  (216, ...
 03278  2196   NtWaitForSingleObject  ... ) == 0x0
 04059  2196   NtSetEventBoostPriority  (216, ...
 03279  2200   NtWaitForSingleObject  ... ) == 0x0
 04060  2200   NtSetEventBoostPriority  (216, ...
 03280  2204   NtWaitForSingleObject  ... ) == 0x0
 04061  2204   NtSetEventBoostPriority  (216, ...
 03281  2208   NtWaitForSingleObject  ... ) == 0x0
 04062  2208   NtSetEventBoostPriority  (216, ...
 03282  2212   NtWaitForSingleObject  ... ) == 0x0
 04063  2212   NtWaitForSingleObject  (848, 0, 0x0, ...
 04062  2208   NtSetEventBoostPriority  ... ) == 0x0
 04061  2204   NtSetEventBoostPriority  ... ) == 0x0
 04060  2200   NtSetEventBoostPriority  ... ) == 0x0
 04059  2196   NtSetEventBoostPriority  ... ) == 0x0
 04058  2192   NtSetEventBoostPriority  ... ) == 0x0
 04057  2188   NtSetEventBoostPriority  ... ) == 0x0
 04056  2184   NtSetEventBoostPriority  ... ) == 0x0
 04055  2180   NtSetEventBoostPriority  ... ) == 0x0
 04054  2176   NtSetEventBoostPriority  ... ) == 0x0
 04053  2172   NtSetEventBoostPriority  ... ) == 0x0
 04052  2168   NtSetEventBoostPriority  ... ) == 0x0
 04051  2164   NtSetEventBoostPriority  ... ) == 0x0
 04050  2160   NtSetEventBoostPriority  ... ) == 0x0
 04049  2156   NtSetEventBoostPriority  ... ) == 0x0
 04048  2152   NtSetEventBoostPriority  ... ) == 0x0
 04047  2148   NtSetEventBoostPriority  ... ) == 0x0
 04046  2144   NtSetEventBoostPriority  ... ) == 0x0
 04045  2140   NtSetEventBoostPriority  ... ) == 0x0
 04044  2136   NtSetEventBoostPriority  ... ) == 0x0
 04043  2132   NtSetEventBoostPriority  ... ) == 0x0
 04042  2128   NtSetEventBoostPriority  ... ) == 0x0
 04041  2124   NtSetEventBoostPriority  ... ) == 0x0
 04040  2120   NtSetEventBoostPriority  ... ) == 0x0
 04039  2116   NtSetEventBoostPriority  ... ) == 0x0
 04038  2112   NtSetEventBoostPriority  ... ) == 0x0
 04037  2108   NtSetEventBoostPriority  ... ) == 0x0
 04036  2104   NtSetEventBoostPriority  ... ) == 0x0
 04035  2100   NtSetEventBoostPriority  ... ) == 0x0
 04034  2096   NtSetEventBoostPriority  ... ) == 0x0
 04033  2092   NtSetEventBoostPriority  ... ) == 0x0
 04032  2088   NtSetEventBoostPriority  ... ) == 0x0
 04031  2084   NtSetEventBoostPriority  ... ) == 0x0
 04030  2080   NtSetEventBoostPriority  ... ) == 0x0
 04029  2076   NtSetEventBoostPriority  ... ) == 0x0
 04028  2072   NtSetEventBoostPriority  ... ) == 0x0
 04027  2068   NtSetEventBoostPriority  ... ) == 0x0
 04026  2064   NtSetEventBoostPriority  ... ) == 0x0
 04025  2060   NtSetEventBoostPriority  ... ) == 0x0
 04024  2056   NtSetEventBoostPriority  ... ) == 0x0
 04023  2052   NtSetEventBoostPriority  ... ) == 0x0
 04022  1304   NtSetEventBoostPriority  ... ) == 0x0
 04021  1756   NtSetEventBoostPriority  ... ) == 0x0
 04020  1580   NtSetEventBoostPriority  ... ) == 0x0
 04019   484   NtSetEventBoostPriority  ... ) == 0x0
 04018   760   NtSetEventBoostPriority  ... ) == 0x0
 04017  1656   NtSetEventBoostPriority  ... ) == 0x0
 04016  1248   NtSetEventBoostPriority  ... ) == 0x0
 04015  1036   NtSetEventBoostPriority  ... ) == 0x0
 04014  1972   NtSetEventBoostPriority  ... ) == 0x0
 04013  1664   NtSetEventBoostPriority  ... ) == 0x0
 04012  1440   NtSetEventBoostPriority  ... ) == 0x0
 04011  1716   NtSetEventBoostPriority  ... ) == 0x0
 04010  1624   NtSetEventBoostPriority  ... ) == 0x0
 04009  1568   NtSetEventBoostPriority  ... ) == 0x0
 04008  1964   NtSetEventBoostPriority  ... ) == 0x0
 04007   312   NtSetEventBoostPriority  ... ) == 0x0
 04006   164   NtSetEventBoostPriority  ... ) == 0x0
 04005  1564   NtSetEventBoostPriority  ... ) == 0x0
 04004  1380   NtSetEventBoostPriority  ... ) == 0x0
 04003  1512   NtSetEventBoostPriority  ... ) == 0x0
 04002   752   NtSetEventBoostPriority  ... ) == 0x0
 04001   468   NtSetEventBoostPriority  ... ) == 0x0
 04000  1808   NtSetEventBoostPriority  ... ) == 0x0
 03999  1336   NtSetEventBoostPriority  ... ) == 0x0
 03998  1332   NtSetEventBoostPriority  ... ) == 0x0
 03997   380   NtSetEventBoostPriority  ... ) == 0x0
 03996   320   NtSetEventBoostPriority  ... ) == 0x0
 03995  1736   NtSetEventBoostPriority  ... ) == 0x0
 03994   644   NtSetEventBoostPriority  ... ) == 0x0
 03993  1268   NtSetEventBoostPriority  ... ) == 0x0
 03992   940   NtSetEventBoostPriority  ... ) == 0x0
 03991   780   NtSetEventBoostPriority  ... ) == 0x0
 03990  1516   NtSetEventBoostPriority  ... ) == 0x0
 03989   860   NtSetEventBoostPriority  ... ) == 0x0
 03988  1104   NtSetEventBoostPriority  ... ) == 0x0
 03987   876   NtSetEventBoostPriority  ... ) == 0x0
 03986   840   NtSetEventBoostPriority  ... ) == 0x0
 03985  1120   NtSetEventBoostPriority  ... ) == 0x0
 03984   888   NtSetEventBoostPriority  ... ) == 0x0
 03983  1484   NtSetEventBoostPriority  ... ) == 0x0
 03982   792   NtSetEventBoostPriority  ... ) == 0x0
 03981  1228   NtSetEventBoostPriority  ... ) == 0x0
 03980  1152   NtSetEventBoostPriority  ... ) == 0x0
 03979   704   NtSetEventBoostPriority  ... ) == 0x0
 03978  1636   NtSetEventBoostPriority  ... ) == 0x0
 03977  1328   NtSetEventBoostPriority  ... ) == 0x0
 03976   252   NtSetEventBoostPriority  ... ) == 0x0
 03975  1300   NtSetEventBoostPriority  ... ) == 0x0
 03974   428   NtSetEventBoostPriority  ... ) == 0x0
 03973  1732   NtSetEventBoostPriority  ... ) == 0x0
 03972   748   NtSetEventBoostPriority  ... ) == 0x0
 03971   900   NtSetEventBoostPriority  ... ) == 0x0
 03969   220   NtSetEventBoostPriority  ... ) == 0x0
 03968  1276   NtSetEventBoostPriority  ... ) == 0x0
 03967   724   NtSetEventBoostPriority  ... ) == 0x0
 03966  1368   NtSetEventBoostPriority  ... ) == 0x0
 03965  1436   NtSetEventBoostPriority  ... ) == 0x0
 03964  1376   NtSetEventBoostPriority  ... ) == 0x0
 03963  1652   NtSetEventBoostPriority  ... ) == 0x0
 03962   588   NtSetEventBoostPriority  ... ) == 0x0
 03961  2044   NtSetEventBoostPriority  ... ) == 0x0
 03960  1588   NtSetEventBoostPriority  ... ) == 0x0
 03959   440   NtSetEventBoostPriority  ... ) == 0x0
 03958  1296   NtSetEventBoostPriority  ... ) == 0x0
 03957  1620   NtSetEventBoostPriority  ... ) == 0x0
 03956  1676   NtSetEventBoostPriority  ... ) == 0x0
 03955  1308   NtSetEventBoostPriority  ... ) == 0x0
 03954  1884   NtSetEventBoostPriority  ... ) == 0x0
 03953   248   NtSetEventBoostPriority  ... ) == 0x0
 03952   500   NtSetEventBoostPriority  ... ) == 0x0
 03951  1776   NtSetEventBoostPriority  ... ) == 0x0
 03950  1324   NtSetEventBoostPriority  ... ) == 0x0
 03949  1024   NtSetEventBoostPriority  ... ) == 0x0
 03948  1708   NtSetEventBoostPriority  ... ) == 0x0
 03947  1096   NtSetEventBoostPriority  ... ) == 0x0
 03946  1948   NtSetEventBoostPriority  ... ) == 0x0
 03945  1600   NtSetEventBoostPriority  ... ) == 0x0
 03944  1372   NtSetEventBoostPriority  ... ) == 0x0
 03943  2036   NtSetEventBoostPriority  ... ) == 0x0
 03942  1388   NtSetEventBoostPriority  ... ) == 0x0
 03937   384   NtSetEventBoostPriority  ... ) == 0x0
 03970  2216   NtSetEventBoostPriority  ... ) == 0x0
 03941  1180   NtSetEventBoostPriority  ... ) == 0x0
 03940  1168   NtSetEventBoostPriority  ... ) == 0x0
 03939  2012   NtSetEventBoostPriority  ... ) == 0x0
 03938  1028   NtSetEventBoostPriority  ... ) == 0x0
 03936   928   NtSetEventBoostPriority  ... ) == 0x0
 04063  2212   NtWaitForSingleObject  ... ) == 0x0
 04064  2208   NtWaitForSingleObject  (848, 0, 0x0, ...
 04065  2204   NtWaitForSingleObject  (848, 0, 0x0, ...
 04066  2200   NtWaitForSingleObject  (848, 0, 0x0, ...
 04067  2196   NtWaitForSingleObject  (848, 0, 0x0, ...
 04068  2192   NtWaitForSingleObject  (848, 0, 0x0, ...
 04069  2188   NtWaitForSingleObject  (848, 0, 0x0, ...
 04070  2184   NtWaitForSingleObject  (848, 0, 0x0, ...
 04071  2180   NtWaitForSingleObject  (848, 0, 0x0, ...
 04072  2176   NtWaitForSingleObject  (848, 0, 0x0, ...
 04073  2172   NtWaitForSingleObject  (848, 0, 0x0, ...
 04074  2168   NtWaitForSingleObject  (848, 0, 0x0, ...
 04075  2164   NtWaitForSingleObject  (848, 0, 0x0, ...
 04076  2160   NtWaitForSingleObject  (848, 0, 0x0, ...
 04077  2156   NtWaitForSingleObject  (848, 0, 0x0, ...
 04078  2152   NtWaitForSingleObject  (848, 0, 0x0, ...
 04079  2148   NtWaitForSingleObject  (848, 0, 0x0, ...
 04080  2144   NtWaitForSingleObject  (848, 0, 0x0, ...
 04081  2140   NtWaitForSingleObject  (848, 0, 0x0, ...
 04082  2136   NtWaitForSingleObject  (848, 0, 0x0, ...
 04083  2132   NtWaitForSingleObject  (848, 0, 0x0, ...
 04084  2128   NtWaitForSingleObject  (848, 0, 0x0, ...
 04085  2124   NtWaitForSingleObject  (848, 0, 0x0, ...
 04086  2120   NtWaitForSingleObject  (848, 0, 0x0, ...
 04087  2116   NtWaitForSingleObject  (848, 0, 0x0, ...
 04088  2112   NtWaitForSingleObject  (848, 0, 0x0, ...
 04089  2108   NtWaitForSingleObject  (848, 0, 0x0, ...
 04090  2104   NtWaitForSingleObject  (848, 0, 0x0, ...
 04091  2100   NtWaitForSingleObject  (848, 0, 0x0, ...
 04092  2096   NtWaitForSingleObject  (848, 0, 0x0, ...
 04093  2092   NtWaitForSingleObject  (848, 0, 0x0, ...
 04094  2088   NtWaitForSingleObject  (848, 0, 0x0, ...
 04095  2084   NtWaitForSingleObject  (848, 0, 0x0, ...
 04096  2080   NtWaitForSingleObject  (848, 0, 0x0, ...
 04097  2076   NtWaitForSingleObject  (848, 0, 0x0, ...
 04098  2072   NtWaitForSingleObject  (848, 0, 0x0, ...
 04099  2068   NtWaitForSingleObject  (848, 0, 0x0, ...
 04100  2064   NtWaitForSingleObject  (848, 0, 0x0, ...
 04101  2060   NtWaitForSingleObject  (848, 0, 0x0, ...
 04102  2056   NtWaitForSingleObject  (848, 0, 0x0, ...
 04103  2052   NtWaitForSingleObject  (848, 0, 0x0, ...