Summary:


NtGdiCreateBitmap(>) 
 1 
NtOpenProcessToken(>) 
 2 
NtSetInformationThread(>) 
 8 
NtCreateEvent(>) 
 89 

NtGdiInit(>) 
 1 
NtQueryDefaultUILanguage(>) 
 2 
NtQueryInformationProcess(>) 
 9 
NtContinue(>) 
 97 

NtGdiQueryFontAssocInfo(>) 
 1 
NtSetInformationObject(>) 
 2 
NtQueryVirtualMemory(>) 
 9 
NtQuerySystemInformation(>) 
 121 

NtGdiSelectBitmap(>) 
 1 
NtUserGetProcessWindowStation(>) 
 2 
NtUnmapViewOfSection(>) 
 9 
NtResumeThread(>) 
 131 

NtOpenKeyedEvent(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtUserFindExistingCursorIcon(>) 
 9 
NtOpenKey(>) 
 133 

NtOpenSymbolicLinkObject(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtOpenThreadToken(>) 
 10 
NtQueryInformationThread(>) 
 140 

NtQueryInstallUILanguage(>) 
 1 
NtOpenProcessTokenEx(>) 
 3 
NtSetInformationFile(>) 
 10 
NtCreateThread(>) 
 153 

NtQueryObject(>) 
 1 
NtOpenThreadTokenEx(>) 
 3 
NtQuerySection(>) 
 13 
NtRequestWaitReplyPort(>) 
 166 

NtQueryPerformanceCounter(>) 
 1 
NtQueryDefaultLocale(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtTestAlert(>) 
 183 

NtQuerySymbolicLinkObject(>) 
 1 
NtReadFile(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtRegisterThreadTerminatePort(>) 
 186 

NtQuerySystemTime(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtCreateFile(>) 
 15 
NtDuplicateObject(>) 
 196 

NtRaiseException(>) 
 1 
NtWriteFile(>) 
 3 
NtSetValueKey(>) 
 15 
NtQueryValueKey(>) 
 251 

NtSetInformationProcess(>) 
 1 
NtCreateIoCompletion(>) 
 4 
NtCreateKey(>) 
 19 
NtProtectVirtualMemory(>) 
 252 

NtUserCallNoParam(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtOpenSection(>) 
 21 
NtClose(>) 
 313 

NtUserGetObjectInformation(>) 
 1 
NtConnectPort(>) 
 6 
NtOpenFile(>) 
 25 
NtAllocateVirtualMemory(>) 
 375 

NtUserGetThreadDesktop(>) 
 1 
NtCreateMutant(>) 
 6 
NtMapViewOfSection(>) 
 34 
NtSetEventBoostPriority(>) 
 702 

NtCallbackReturn(>) 
 2 
NtQueryVolumeInformationFile(>) 
 6 
NtDeviceIoControlFile(>) 
 36 
NtWaitForSingleObject(>) 
 970 

NtGdiCreateSolidBrush(>) 
 2 
NtQueryInformationToken(>) 
 7 
NtQueryAttributesFile(>) 
 40 

NtNotifyChangeKey(>) 
 2 
NtFsControlFile(>) 
 8 
NtFlushInstructionCache(>) 
 52 

NtOpenDirectoryObject(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 94224, 4, ... (0x409000), 98304, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 98304, 128, ... (0x409000), 98304, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 94224, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x419010,}, 4, ... ) == 0x0
 00260   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00261   896   NtContinue  (1244400, 0, ...
 00262   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3276800, 4096, ) == 0x0
 00263   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00264   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtClose  (16, ... ) == 0x0
 00266   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00267   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00268   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00269   896   NtClose  (16, ... ) == 0x0
 00270   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00271   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00272   896   NtClose  (16, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00276   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00277   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00278   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00287   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00291   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00294   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00295   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00296   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00297   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00298   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00299   896   NtClose  (16, ... ) == 0x0
 00300   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00301   896   NtClose  (28, ... ) == 0x0
 00302   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00303   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00304   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00305   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00306   896   NtClose  (28, ... ) == 0x0
 00307   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x430000), 0x0, 110592, ) == 0x0
 00308   896   NtClose  (16, ... ) == 0x0
 00309   896   NtUnmapViewOfSection  (-1, 0x430000, ... ) == 0x0
 00310   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00311   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00312   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00313   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00314   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00315   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00316   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00318   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00319   896   NtClose  (36, ... ) == 0x0
 00320   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00321   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00322   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00323   896   NtClose  (36, ... ) == 0x0
 00324   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   896   NtClose  (32, ... ) == 0x0
 00326   896   NtClose  (16, ... ) == 0x0
 00327   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00328   896   NtClose  (28, ... ) == 0x0
 00329   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00330   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00331   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00332   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00333   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00334   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00335   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00336   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00337   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00338   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00339   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00340   896   NtClose  (28, ... ) == 0x0
 00341   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00342   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00343   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00344   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00345   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00346   896   NtClose  (28, ... ) == 0x0
 00347   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00348   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00349   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00350   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00351   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00352   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00353   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00355   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00356   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00358   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00359   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00360   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00362   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00364   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00365   896   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00366   896   NtClose  (28, ... ) == 0x0
 00367   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00368   896   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00369   896   NtClose  (28, ... ) == 0x0
 00370   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00371   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00372   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00373   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00374   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00375   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00376   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00377   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00378   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00379   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00380   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 16, ) }, ... 16, ) == 0x0
 00381   896   NtQueryValueKey  (16,  (16, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   896   NtClose  (16, ... ) == 0x0
 00383   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x430000), 0x0, 1060864, ) == 0x0
 00384   896   NtClose  (-2147482756, ... ) == 0x0
 00385   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 16, ) == 0x0
 00386   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00387   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00388   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00389   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00390   896   NtClose  (-2147482756, ... ) == 0x0
 00391   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5505024, 4096, ) == 0x0
 00392   896   NtFreeVirtualMemory  (-1, (0x540000), 4096, 32768, ... (0x540000), 4096, ) == 0x0
 00393   896   NtDuplicateObject  (-1, 32, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00394   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00395   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00396   896   NtClose  (-2147482756, ... ) == 0x0
 00397   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00398   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00399   896   NtClose  (-2147482756, ... ) == 0x0
 00400   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00401   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00402   896   NtUserCallNoParam  (24, ... ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  (0, ...
 00404   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5505024, 4096, ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00405   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00406   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00407   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00408   896   NtGdiCreateSolidBrush  (0, 0, ...
 00409   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8716288, 4096, ) == 0x0
 00408   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00410   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00411   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00412   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00413   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00414   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00415   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00416   896   NtClose  (44, ... ) == 0x0
 00417   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00418   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00419   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00420   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00421   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00422   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00423   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00424   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00425   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00426   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00427   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00428   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00429   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00430   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00431   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00432   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00433   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00434   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00435   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00436   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00437   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00438   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00439   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00440   896   NtCallbackReturn  (0, 0, 0, ...
 00441   896   NtGdiInit  (... ) == 0x1
 00442   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00443   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00444   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 8781824, 28672, ) == 0x0
 00445   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00447   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00448   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00449   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 48, ) == 0x0
 00450   896   NtQuerySection  (48, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00451   896   NtClose  (44, ... ) == 0x0
 00452   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00453   896   NtClose  (48, ... ) == 0x0
 00454   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 48, ) }, ... 48, ) == 0x0
 00455   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00456   896   NtClose  (48, ... ) == 0x0
 00457   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00458   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00459   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00460   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00461   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00462   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00463   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00465   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00466   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 48, {status=0x0, info=1}, ) }, 5, 96, ... 48, {status=0x0, info=1}, ) == 0x0
 00467   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 48, ... 44, ) == 0x0
 00468   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00469   896   NtClose  (48, ... ) == 0x0
 00470   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00471   896   NtClose  (44, ... ) == 0x0
 00472   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00473   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00474   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00475   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00476   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00477   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00478   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00479   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00480   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8847360, 65536, ) == 0x0
 00481   896   NtAllocateVirtualMemory  (-1, 8847360, 0, 4096, 4096, 4, ... 8847360, 4096, ) == 0x0
 00482   896   NtAllocateVirtualMemory  (-1, 8851456, 0, 8192, 4096, 4, ... 8851456, 8192, ) == 0x0
 00483   896   NtAllocateVirtualMemory  (-1, 8859648, 0, 4096, 4096, 4, ... 8859648, 4096, ) == 0x0
 00484   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00485   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x880000), 0x0, 12288, ) == 0x0
 00486   896   NtClose  (44, ... ) == 0x0
 00487   896   NtAllocateVirtualMemory  (-1, 8863744, 0, 4096, 4096, 4, ... 8863744, 4096, ) == 0x0
 00488   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00489   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00490   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00491   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00492   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00493   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00495   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00496   896   NtFreeVirtualMemory  (-1, (0x860000), 0, 32768, ... (0x860000), 28672, ) == 0x0
 00497   896   NtFreeVirtualMemory  (-1, (0x320144), 0, 32768, ... (0x320000), 4096, ) == 0x0
 00498   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00499   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00500   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00501   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 20480, 4096, 4, ... 3280896, 20480, ) == 0x0
 00502   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8978432, 1048576, ) == 0x0
 00503   896   NtAllocateVirtualMemory  (-1, 8978432, 0, 32768, 4096, 4, ... 8978432, 32768, ) == 0x0
 00504   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00505   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "Jobaka3"}, 0, ... 48, ) }, 0, ... 48, ) == 0x0
 00506   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00507   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00508   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00509   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00510   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Protocol_Catalog9"}, ... 60, ) }, ... 60, ) == 0x0
 00511   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00512   896   NtNotifyChangeKey  (60, 56, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00513   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00514   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00515   896   NtQueryValueKey  (60,  (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 00516   896   NtQueryValueKey  (60,  (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 00517   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Catalog_Entries"}, ... 64, ) }, ... 64, ) == 0x0
 00518   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00519   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000001"}, ... 68, ) }, ... 68, ) == 0x0
 00520   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00521   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00522   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00523   896   NtClose  (68, ... ) == 0x0
 00524   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000002"}, ... 68, ) }, ... 68, ) == 0x0
 00525   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00526   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00527   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00528   896   NtClose  (68, ... ) == 0x0
 00529   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000003"}, ... 68, ) }, ... 68, ) == 0x0
 00530   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00531   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00532   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00533   896   NtClose  (68, ... ) == 0x0
 00534   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000004"}, ... 68, ) }, ... 68, ) == 0x0
 00535   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00536   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00537   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00538   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00539   896   NtClose  (68, ... ) == 0x0
 00540   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000005"}, ... 68, ) }, ... 68, ) == 0x0
 00541   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00542   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00543   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00544   896   NtClose  (68, ... ) == 0x0
 00545   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000006"}, ... 68, ) }, ... 68, ) == 0x0
 00546   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00547   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00548   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00549   896   NtClose  (68, ... ) == 0x0
 00550   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000007"}, ... 68, ) }, ... 68, ) == 0x0
 00551   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00552   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00553   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00554   896   NtClose  (68, ... ) == 0x0
 00555   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000008"}, ... 68, ) }, ... 68, ) == 0x0
 00556   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00557   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00558   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00559   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00560   896   NtClose  (68, ... ) == 0x0
 00561   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000009"}, ... 68, ) }, ... 68, ) == 0x0
 00562   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00563   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00564   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00565   896   NtClose  (68, ... ) == 0x0
 00566   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000010"}, ... 68, ) }, ... 68, ) == 0x0
 00567   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00568   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00569   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00570   896   NtClose  (68, ... ) == 0x0
 00571   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000011"}, ... 68, ) }, ... 68, ) == 0x0
 00572   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00573   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00574   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00575   896   NtClose  (68, ... ) == 0x0
 00576   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000012"}, ... 68, ) }, ... 68, ) == 0x0
 00577   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00578   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00579   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00580   896   NtClose  (68, ... ) == 0x0
 00581   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000013"}, ... 68, ) }, ... 68, ) == 0x0
 00582   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00583   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00584   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00585   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00586   896   NtClose  (68, ... ) == 0x0
 00587   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000014"}, ... 68, ) }, ... 68, ) == 0x0
 00588   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00589   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00590   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00591   896   NtClose  (68, ... ) == 0x0
 00592   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000015"}, ... 68, ) }, ... 68, ) == 0x0
 00593   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00594   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00595   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00596   896   NtClose  (68, ... ) == 0x0
 00597   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000016"}, ... 68, ) }, ... 68, ) == 0x0
 00598   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00599   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00600   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00601   896   NtClose  (68, ... ) == 0x0
 00602   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000017"}, ... 68, ) }, ... 68, ) == 0x0
 00603   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00604   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00605   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00606   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00607   896   NtClose  (68, ... ) == 0x0
 00608   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000018"}, ... 68, ) }, ... 68, ) == 0x0
 00609   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00610   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00611   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00612   896   NtClose  (68, ... ) == 0x0
 00613   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000019"}, ... 68, ) }, ... 68, ) == 0x0
 00614   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00615   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00616   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00617   896   NtClose  (68, ... ) == 0x0
 00618   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000020"}, ... 68, ) }, ... 68, ) == 0x0
 00619   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00620   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00622   896   NtClose  (68, ... ) == 0x0
 00623   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000021"}, ... 68, ) }, ... 68, ) == 0x0
 00624   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00625   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00627   896   NtClose  (68, ... ) == 0x0
 00628   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000022"}, ... 68, ) }, ... 68, ) == 0x0
 00629   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00630   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00632   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 00633   896   NtClose  (68, ... ) == 0x0
 00634   896   NtClose  (64, ... ) == 0x0
 00635   896   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00636   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00637   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 68, ) }, ... 68, ) == 0x0
 00638   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00639   896   NtNotifyChangeKey  (68, 64, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00640   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00641   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00642   896   NtQueryValueKey  (68,  (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00643   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "Catalog_Entries"}, ... 72, ) }, ... 72, ) == 0x0
 00644   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000001"}, ... 76, ) }, ... 76, ) == 0x0
 00645   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00646   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00647   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00648   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00649   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00650   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00651   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00652   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00653   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00654   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00655   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00656   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00657   896   NtClose  (76, ... ) == 0x0
 00658   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000002"}, ... 76, ) }, ... 76, ) == 0x0
 00659   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00660   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00661   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00662   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00663   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00664   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00665   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00666   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00668   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00669   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00670   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00671   896   NtClose  (76, ... ) == 0x0
 00672   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000003"}, ... 76, ) }, ... 76, ) == 0x0
 00673   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00674   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00675   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00676   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00677   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00678   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00679   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00680   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00681   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00682   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00684   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   896   NtClose  (76, ... ) == 0x0
 00686   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000004"}, ... 76, ) }, ... 76, ) == 0x0
 00687   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00688   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00689   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00690   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00691   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00692   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00693   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 00694   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00695   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 00696   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   896   NtClose  (76, ... ) == 0x0
 00700   896   NtClose  (72, ... ) == 0x0
 00701   896   NtWaitForSingleObject  (64, 0, {0, 0}, ... ) == 0x102
 00702   896   NtClose  (52, ... ) == 0x0
 00703   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00704   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00705   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00706   896   NtQueryValueKey  (52,  (52, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00707   896   NtClose  (52, ... ) == 0x0
 00708   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00709   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 52, ) == 0x0
 00710   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) == 0x0
 00711   896   NtQueryInformationFile  (72, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 00712   896   NtQueryInformationFile  (72, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00713   896   NtQueryInformationFile  (72, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00714   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 8192, 4096, 4, ... 1359872, 8192, ) == 0x0
 00715   896   NtQueryInformationFile  (72, 1355896, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 00716   896   NtQueryInformationFile  (72, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00717   896   NtQueryInformationFile  (72, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 00718   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 00719   896   NtClose  (-2147482756, ... ) == 0x0
 00718   896   NtCreateFile  ... 76, {status=0x0, info=2}, ) == 0x0
 00720   896   NtQueryVolumeInformationFile  (76, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00721   896   NtQueryInformationFile  (76, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00722   896   NtQueryVolumeInformationFile  (72, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00723   896   NtQueryVolumeInformationFile  (72, 1239912, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00724   896   NtSetInformationFile  (76, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00725   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 72, ... 80, ) == 0x0
 00726   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x990000), {0, 0}, 90112, ) == 0x0
 00727   896   NtClose  (80, ... ) == 0x0
 00728   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0    \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0d\347\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 00729   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24592, 0x0, 0, ... {status=0x0, info=24592}, ) , 24592, 0x0, 0, ... {status=0x0, info=24592}, ) == 0x0
 00730   896   NtUnmapViewOfSection  (-1, 0x990000, ... ) == 0x0
 00731   896   NtSetInformationFile  (76, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 00732   896   NtClose  (72, ... ) == 0x0
 00733   896   NtClose  (76, ... ) == 0x0
 00734   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 76, ) }, ... 76, ) == 0x0
 00735   896   NtSetValueKey  (76,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 00736   896   NtSetInformationFile  (-2147482448, -135747792, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00737   896   NtSetInformationFile  (-2147482448, -135747884, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00738   896   NtSetInformationFile  (-2147482448, -135748192, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00739   896   NtSetInformationFile  (-2147482448, -135748288, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00735   896   NtSetValueKey  ... ) == 0x0
 00740   896   NtClose  (76, ... ) == 0x0
 00741   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 76, ) }, 0, ... 76, ) == 0x0
 00742   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10027008, 1048576, ) == 0x0
 00743   896   NtAllocateVirtualMemory  (-1, 11067392, 0, 8192, 4096, 4, ... 11067392, 8192, ) == 0x0
 00744   896   NtProtectVirtualMemory  (-1, (0xa8e000), 4096, 260, ... (0xa8e000), 4096, 4, ) == 0x0
 00745   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 72, {1252, 2016}, ) == 0x0
 00746   896   NtQueryInformationThread  (72, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00747   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00748   896   NtResumeThread  (72, ... 1, ) == 0x0
 00749   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11075584, 1048576, ) == 0x0
 00750   896   NtAllocateVirtualMemory  (-1, 12115968, 0, 8192, 4096, 4, ... 12115968, 8192, ) == 0x0
 00751  2016   NtTestAlert  (... ) == 0x0
 00752  2016   NtContinue  (11074864, 1, ...
 00753  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00754  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 80, ) == 0x0
 00755  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00756  2016   NtAllocateVirtualMemory  (-1, 11063296, 0, 4096, 4096, 260, ...
 00757   896   NtProtectVirtualMemory  (-1, (0xb8e000), 4096, 260, ... (0xb8e000), 4096, 4, ) == 0x0
 00758   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 84, {1252, 596}, ) == 0x0
 00759   896   NtQueryInformationThread  (84, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=596,}, 0x0, ) == 0x0
 00760   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81838, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ) == 0x0
 00761   896   NtResumeThread  (84, ... 1, ) == 0x0
 00762   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00756  2016   NtAllocateVirtualMemory  ... 11063296, 4096, ) == 0x0
 00763   596   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00764  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11071988, ... }, 11071988, ...
 00763   596   NtCreateEvent  ... 88, ) == 0x0
 00764  2016   NtQueryAttributesFile  ... ) == 0x0
 00765   596   NtWaitForSingleObject  (88, 0, 0x0, ...
 00766  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00767  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 92, ... 96, ) == 0x0
 00768  2016   NtClose  (92, ... ) == 0x0
 00769  2016   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb90000), 0x0, 245760, ) == 0x0
 00770  2016   NtClose  (96, ...
 00762   896   NtAllocateVirtualMemory  ... 12386304, 1048576, ) == 0x0
 00771   896   NtAllocateVirtualMemory  (-1, 13426688, 0, 8192, 4096, 4, ... 13426688, 8192, ) == 0x0
 00772   896   NtProtectVirtualMemory  (-1, (0xcce000), 4096, 260, ... (0xcce000), 4096, 4, ) == 0x0
 00773   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 92, {1252, 376}, ) == 0x0
 00774   896   NtQueryInformationThread  (92, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=376,}, 0x0, ) == 0x0
 00775   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" )  ) == 0x0
 00770  2016   NtClose  ... ) == 0x0
 00776  2016   NtUnmapViewOfSection  (-1, 0xb90000, ... ) == 0x0
 00777  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11072296, ... ) }, 11072296, ... ) == 0x0
 00778  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00779   896   NtResumeThread  (92, ... 1, ) == 0x0
 00780   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13434880, 1048576, ) == 0x0
 00781   896   NtAllocateVirtualMemory  (-1, 14475264, 0, 8192, 4096, 4, ... 14475264, 8192, ) == 0x0
 00782   896   NtProtectVirtualMemory  (-1, (0xdce000), 4096, 260, ... (0xdce000), 4096, 4, ) == 0x0
 00783   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 100, {1252, 420}, ) == 0x0
 00784   896   NtQueryInformationThread  (100, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=420,}, 0x0, ) == 0x0
 00785  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ...
 00786   376   NtWaitForSingleObject  (88, 0, 0x0, ...
 00785  2016   NtCreateSection  ... 104, ) == 0x0
 00787  2016   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00788  2016   NtClose  (96, ... ) == 0x0
 00789  2016   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 00790  2016   NtClose  (104, ... ) == 0x0
 00791  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00792   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" )  ) == 0x0
 00793   896   NtResumeThread  (100, ... 1, ) == 0x0
 00794   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14483456, 1048576, ) == 0x0
 00795   896   NtAllocateVirtualMemory  (-1, 15523840, 0, 8192, 4096, 4, ... 15523840, 8192, ) == 0x0
 00796   896   NtProtectVirtualMemory  (-1, (0xece000), 4096, 260, ... (0xece000), 4096, 4, ) == 0x0
 00797   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00798  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ...
 00799   420   NtWaitForSingleObject  (88, 0, 0x0, ...
 00798  2016   NtProtectVirtualMemory  ... (0x71a51000), 4096, 4, ) == 0x0
 00800  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00801  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00802  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00803  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00797   896   NtCreateThread  ... 104, {1252, 384}, ) == 0x0
 00804   896   NtQueryInformationThread  (104, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 00805   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\0\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 00806   896   NtResumeThread  (104, ... 1, ) == 0x0
 00807   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15532032, 1048576, ) == 0x0
 00808   896   NtAllocateVirtualMemory  (-1, 16572416, 0, 8192, 4096, 4, ... 16572416, 8192, ) == 0x0
 00809  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 00810   384   NtWaitForSingleObject  (88, 0, 0x0, ...
 00809  2016   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 00811  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00812  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00813   896   NtProtectVirtualMemory  (-1, (0xfce000), 4096, 260, ... (0xfce000), 4096, 4, ) == 0x0
 00814   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 96, {1252, 1028}, ) == 0x0
 00815   896   NtQueryInformationThread  (96, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 00816  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00817  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00818  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00819  2016   NtSetEventBoostPriority  (88, ...
 00765   596   NtWaitForSingleObject  ... ) == 0x0
 00820   596   NtSetEventBoostPriority  (88, ...
 00786   376   NtWaitForSingleObject  ... ) == 0x0
 00821   376   NtSetEventBoostPriority  (88, ...
 00799   420   NtWaitForSingleObject  ... ) == 0x0
 00822   420   NtSetEventBoostPriority  (88, ...
 00810   384   NtWaitForSingleObject  ... ) == 0x0
 00823   384   NtTestAlert  (... ) == 0x0
 00822   420   NtSetEventBoostPriority  ... ) == 0x0
 00821   376   NtSetEventBoostPriority  ... ) == 0x0
 00820   596   NtSetEventBoostPriority  ... ) == 0x0
 00819  2016   NtSetEventBoostPriority  ... ) == 0x0
 00824   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\4\4\0\0" ...  ...
 00825   384   NtContinue  (15531312, 1, ...
 00826   420   NtTestAlert  (...
 00827   376   NtTestAlert  (...
 00828  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00824   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81842, 0}  ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 00829   384   NtRegisterThreadTerminatePort  (24, ...
 00826   420   NtTestAlert  ... ) == 0x0
 00827   376   NtTestAlert  ... ) == 0x0
 00828  2016   NtCreateEvent  ... 108, ) == 0x0
 00830   896   NtResumeThread  (96, ...
 00829   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 00831   420   NtContinue  (14482736, 1, ...
 00832   376   NtContinue  (13434160, 1, ...
 00833   596   NtTestAlert  (...
 00830   896   NtResumeThread  ... 1, ) == 0x0
 00834   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00835   420   NtRegisterThreadTerminatePort  (24, ...
 00836   376   NtRegisterThreadTerminatePort  (24, ...
 00833   596   NtTestAlert  ... ) == 0x0
 00837   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00834   384   NtDuplicateObject  ... 112, ) == 0x0
 00835   420   NtRegisterThreadTerminatePort  ... ) == 0x0
 00836   376   NtRegisterThreadTerminatePort  ... ) == 0x0
 00838   596   NtContinue  (12123440, 1, ...
 00839  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 00840  1028   NtWaitForSingleObject  (88, 0, 0x0, ...
 00841   384   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00842   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00843   376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00844   596   NtRegisterThreadTerminatePort  (24, ...
 00839  2016   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00837   896   NtAllocateVirtualMemory  ... 16580608, 1048576, ) == 0x0
 00841   384   NtWaitForSingleObject  ... ) == 0x102
 00842   420   NtDuplicateObject  ... 116, ) == 0x0
 00844   596   NtRegisterThreadTerminatePort  ... ) == 0x0
 00845  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11071908, ... }, 11071908, ...
 00846   896   NtAllocateVirtualMemory  (-1, 17620992, 0, 8192, 4096, 4, ...
 00847   384   NtAllocateVirtualMemory  (-1, 15519744, 0, 4096, 4096, 260, ...
 00848   420   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00849   596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00846   896   NtAllocateVirtualMemory  ... 17620992, 8192, ) == 0x0
 00847   384   NtAllocateVirtualMemory  ... 15519744, 4096, ) == 0x0
 00848   420   NtWaitForSingleObject  ... ) == 0x102
 00843   376   NtDuplicateObject  ... 120, ) == 0x0
 00850   896   NtProtectVirtualMemory  (-1, (0x10ce000), 4096, 260, ...
 00851   384   NtWaitForSingleObject  (88, 0, 0x0, ...
 00852   420   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00853   376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00850   896   NtProtectVirtualMemory  ... (0x10ce000), 4096, 4, ) == 0x0
 00852   420   NtCreateEvent  ... 124, ) == 0x0
 00853   376   NtWaitForSingleObject  ... ) == 0x102
 00854   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00849   596   NtDuplicateObject  ... 128, ) == 0x0
 00855   376   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00856   420   NtWaitForSingleObject  (124, 0, 0x0, ...
 00857   596   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00855   376   NtCreateEvent  ... 132, ) == 0x0
 00857   596   NtWaitForSingleObject  ... ) == 0x102
 00854   896   NtCreateThread  ... 136, {1252, 2012}, ) == 0x0
 00858   596   NtWaitForSingleObject  (124, 0, 0x0, ...
 00859   896   NtQueryInformationThread  (136, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 00860   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 00861   896   NtResumeThread  (136, ... 1, ) == 0x0
 00862   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17629184, 1048576, ) == 0x0
 00863   896   NtAllocateVirtualMemory  (-1, 18669568, 0, 8192, 4096, 4, ... 18669568, 8192, ) == 0x0
 00864   376   NtClose  (132, ...
 00865  2012   NtWaitForSingleObject  (88, 0, 0x0, ...
 00845  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864   376   NtClose  ... ) == 0x0
 00866  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11071908, ... }, 11071908, ...
 00867   376   NtWaitForSingleObject  (124, 0, 0x0, ...
 00866  2016   NtQueryAttributesFile  ... ) == 0x0
 00868  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 00869  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 132, ... 140, ) == 0x0
 00870  2016   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00871  2016   NtClose  (132, ... ) == 0x0
 00872  2016   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 00873   896   NtProtectVirtualMemory  (-1, (0x11ce000), 4096, 260, ... (0x11ce000), 4096, 4, ) == 0x0
 00874   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 132, {1252, 1168}, ) == 0x0
 00875   896   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 00876   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\220\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 00877   896   NtResumeThread  (132, ... 1, ) == 0x0
 00878   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00872  2016   NtMapViewOfSection  ... (0x662b0000), 0x0, 360448, ) == 0x0
 00879  1168   NtWaitForSingleObject  (88, 0, 0x0, ...
 00880  2016   NtClose  (140, ... ) == 0x0
 00881  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00882  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00883  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00884  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00878   896   NtAllocateVirtualMemory  ... 18677760, 1048576, ) == 0x0
 00885   896   NtAllocateVirtualMemory  (-1, 19718144, 0, 8192, 4096, 4, ... 19718144, 8192, ) == 0x0
 00886   896   NtProtectVirtualMemory  (-1, (0x12ce000), 4096, 260, ... (0x12ce000), 4096, 4, ) == 0x0
 00887   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 140, {1252, 1180}, ) == 0x0
 00888   896   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 00889   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\234\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\234\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 00890  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00891  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00892  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00893  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00894  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00895  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00896   896   NtResumeThread  (140, ... 1, ) == 0x0
 00897   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19726336, 1048576, ) == 0x0
 00898   896   NtAllocateVirtualMemory  (-1, 20766720, 0, 8192, 4096, 4, ... 20766720, 8192, ) == 0x0
 00899   896   NtProtectVirtualMemory  (-1, (0x13ce000), 4096, 260, ... (0x13ce000), 4096, 4, ) == 0x0
 00900   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 144, {1252, 928}, ) == 0x0
 00901   896   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 00902  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 00903  1180   NtWaitForSingleObject  (88, 0, 0x0, ...
 00902  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 00904  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00905  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00906  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00907  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00908  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00909   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 00910   896   NtResumeThread  (144, ... 1, ) == 0x0
 00911   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 20774912, 1048576, ) == 0x0
 00912   896   NtAllocateVirtualMemory  (-1, 21815296, 0, 8192, 4096, 4, ... 21815296, 8192, ) == 0x0
 00913   896   NtProtectVirtualMemory  (-1, (0x14ce000), 4096, 260, ... (0x14ce000), 4096, 4, ) == 0x0
 00914   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00915  2016   NtSetEventBoostPriority  (88, ...
 00916   928   NtWaitForSingleObject  (88, 0, 0x0, ...
 00840  1028   NtWaitForSingleObject  ... ) == 0x0
 00915  2016   NtSetEventBoostPriority  ... ) == 0x0
 00917  1028   NtSetEventBoostPriority  (88, ...
 00851   384   NtWaitForSingleObject  ... ) == 0x0
 00918   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15526864, ... ) }, 15526864, ... ) == 0x0
 00917  1028   NtSetEventBoostPriority  ... ) == 0x0
 00919  2016   NtWaitForSingleObject  (88, 0, 0x0, ...
 00914   896   NtCreateThread  ... 148, {1252, 428}, ) == 0x0
 00920   384   NtSetEventBoostPriority  (88, ...
 00921   896   NtQueryInformationThread  (148, Basic, 28, ...
 00865  2012   NtWaitForSingleObject  ... ) == 0x0
 00920   384   NtSetEventBoostPriority  ... ) == 0x0
 00922  2012   NtSetEventBoostPriority  (88, ...
 00921   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 00879  1168   NtWaitForSingleObject  ... ) == 0x0
 00922  2012   NtSetEventBoostPriority  ... ) == 0x0
 00923   384   NtWaitForSingleObject  (88, 0, 0x0, ...
 00924  1168   NtSetEventBoostPriority  (88, ...
 00925   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\254\1\0\0" ...  ...
 00926  1028   NtTestAlert  (...
 00903  1180   NtWaitForSingleObject  ... ) == 0x0
 00924  1168   NtSetEventBoostPriority  ... ) == 0x0
 00925   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81847, 0}  ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 00927  1180   NtSetEventBoostPriority  (88, ...
 00926  1028   NtTestAlert  ... ) == 0x0
 00928  2012   NtTestAlert  (...
 00929  1168   NtTestAlert  (...
 00916   928   NtWaitForSingleObject  ... ) == 0x0
 00927  1180   NtSetEventBoostPriority  ... ) == 0x0
 00930  1028   NtContinue  (16579888, 1, ...
 00928  2012   NtTestAlert  ... ) == 0x0
 00931   928   NtSetEventBoostPriority  (88, ...
 00929  1168   NtTestAlert  ... ) == 0x0
 00932   896   NtResumeThread  (148, ...
 00933  1028   NtRegisterThreadTerminatePort  (24, ...
 00919  2016   NtWaitForSingleObject  ... ) == 0x0
 00931   928   NtSetEventBoostPriority  ... ) == 0x0
 00934  2012   NtContinue  (17628464, 1, ...
 00935  1168   NtContinue  (18677040, 1, ...
 00932   896   NtResumeThread  ... 1, ) == 0x0
 00936  2016   NtSetEventBoostPriority  (88, ...
 00933  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 00937  1180   NtTestAlert  (...
 00938   428   NtWaitForSingleObject  (88, 0, 0x0, ...
 00939  2012   NtRegisterThreadTerminatePort  (24, ...
 00940  1168   NtRegisterThreadTerminatePort  (24, ...
 00923   384   NtWaitForSingleObject  ... ) == 0x0
 00936  2016   NtSetEventBoostPriority  ... ) == 0x0
 00941   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00942  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00937  1180   NtTestAlert  ... ) == 0x0
 00939  2012   NtRegisterThreadTerminatePort  ... ) == 0x0
 00943   384   NtSetEventBoostPriority  (88, ...
 00940  1168   NtRegisterThreadTerminatePort  ... ) == 0x0
 00944   928   NtTestAlert  (...
 00941   896   NtAllocateVirtualMemory  ... 21823488, 1048576, ) == 0x0
 00945  2016   NtWaitForSingleObject  (88, 0, 0x0, ...
 00946  1180   NtContinue  (19725616, 1, ...
 00938   428   NtWaitForSingleObject  ... ) == 0x0
 00943   384   NtSetEventBoostPriority  ... ) == 0x0
 00947  2012   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00948  1168   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00944   928   NtTestAlert  ... ) == 0x0
 00949   896   NtAllocateVirtualMemory  (-1, 22863872, 0, 8192, 4096, 4, ...
 00950   428   NtSetEventBoostPriority  (88, ...
 00951  1180   NtRegisterThreadTerminatePort  (24, ...
 00942  1028   NtDuplicateObject  ... 152, ) == 0x0
 00952   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00947  2012   NtDuplicateObject  ... 156, ) == 0x0
 00953   928   NtContinue  (20774192, 1, ...
 00945  2016   NtWaitForSingleObject  ... ) == 0x0
 00950   428   NtSetEventBoostPriority  ... ) == 0x0
 00949   896   NtAllocateVirtualMemory  ... 22863872, 8192, ) == 0x0
 00951  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 00954  1028   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00952   384   NtCreateEvent  ... 160, ) == 0x0
 00955  2012   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00956  2016   NtQuerySystemInformation  (Basic, 44, ...
 00957   928   NtRegisterThreadTerminatePort  (24, ...
 00948  1168   NtDuplicateObject  ... 164, ) == 0x0
 00958   428   NtTestAlert  (...
 00959  1180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00954  1028   NtWaitForSingleObject  ... ) == 0x102
 00960   384   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 00956  2016   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00955  2012   NtWaitForSingleObject  ... ) == 0x102
 00957   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 00961  1168   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00958   428   NtTestAlert  ... ) == 0x0
 00962   896   NtProtectVirtualMemory  (-1, (0x15ce000), 4096, 260, ...
 00963  1028   NtWaitForSingleObject  (124, 0, 0x0, ...
 00964  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... }, ...
 00960   384   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00965  2012   NtWaitForSingleObject  (124, 0, 0x0, ...
 00966   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00961  1168   NtWaitForSingleObject  ... ) == 0x102
 00967   428   NtContinue  (21822768, 1, ...
 00962   896   NtProtectVirtualMemory  ... (0x15ce000), 4096, 4, ) == 0x0
 00959  1180   NtDuplicateObject  ... 168, ) == 0x0
 00968   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 15526968, ... }, 15526968, ...
 00964  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00969  1168   NtWaitForSingleObject  (124, 0, 0x0, ...
 00970   428   NtRegisterThreadTerminatePort  (24, ...
 00971   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00972  1180   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00973  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... }, ...
 00970   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 00971   896   NtCreateThread  ... 172, {1252, 1732}, ) == 0x0
 00972  1180   NtWaitForSingleObject  ... ) == 0x102
 00973  2016   NtOpenKey  ... 176, ) == 0x0
 00974   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00975   896   NtQueryInformationThread  (172, Basic, 28, ...
 00976  1180   NtWaitForSingleObject  (124, 0, 0x0, ...
 00977  2016   NtQueryValueKey  (176,  (176, "MaxRpcSize", Partial, 144, ... , Partial, 144, ...
 00966   928   NtDuplicateObject  ... 180, ) == 0x0
 00975   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 00977  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00978   928   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00974   428   NtDuplicateObject  ... 184, ) == 0x0
 00979  2016   NtClose  (176, ...
 00978   928   NtWaitForSingleObject  ... ) == 0x102
 00980   428   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00981   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\304\6\0\0" ...  ...
 00982   928   NtWaitForSingleObject  (124, 0, 0x0, ...
 00980   428   NtWaitForSingleObject  ... ) == 0x102
 00981   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81848, 0}  ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 00983   428   NtWaitForSingleObject  (124, 0, 0x0, ...
 00984   896   NtResumeThread  (172, ... 1, ) == 0x0
 00985   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22872064, 1048576, ) == 0x0
 00986   896   NtAllocateVirtualMemory  (-1, 23912448, 0, 8192, 4096, 4, ... 23912448, 8192, ) == 0x0
 00987   896   NtProtectVirtualMemory  (-1, (0x16ce000), 4096, 260, ... (0x16ce000), 4096, 4, ) == 0x0
 00988   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00979  2016   NtClose  ... ) == 0x0
 00989  1732   NtWaitForSingleObject  (88, 0, 0x0, ...
 00990  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00991  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
 00992  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 188, ) == 0x0
 00993  2016   NtQuerySystemTime  (... {1417579164, 29929616}, ) == 0x0
 00994  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 192, ) == 0x0
 00995  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... }, ...
 00988   896   NtCreateThread  ... 196, {1252, 748}, ) == 0x0
 00996   896   NtQueryInformationThread  (196, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 00997   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\354\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 00998   896   NtResumeThread  (196, ... 1, ) == 0x0
 00999   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 23920640, 1048576, ) == 0x0
 01000   896   NtAllocateVirtualMemory  (-1, 24961024, 0, 8192, 4096, 4, ... 24961024, 8192, ) == 0x0
 00995  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01001   748   NtWaitForSingleObject  (88, 0, 0x0, ...
 00968   384   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01002  2016   NtQuerySystemInformation  (Performance, 312, ...
 01003   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 15526968, ... }, 15526968, ...
 01002  2016   NtQuerySystemInformation  ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01003   384   NtQueryAttributesFile  ... ) == 0x0
 01004  2016   NtQueryInformationProcess  (-1, QuotaLimits, 32, ...
 01005   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... }, 5, 96, ...
 01004  2016   NtQueryInformationProcess  ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01006   896   NtProtectVirtualMemory  (-1, (0x17ce000), 4096, 260, ...
 01007  2016   NtQueryInformationProcess  (-1, VmCounters, 44, ...
 01006   896   NtProtectVirtualMemory  ... (0x17ce000), 4096, 4, ) == 0x0
 01005   384   NtOpenFile  ... 200, {status=0x0, info=1}, ) == 0x0
 01008   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01009   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 200, ...
 01008   896   NtCreateThread  ... 204, {1252, 900}, ) == 0x0
 01009   384   NtCreateSection  ... 208, ) == 0x0
 01010   896   NtQueryInformationThread  (204, Basic, 28, ...
 01011   384   NtQuerySection  (208, Image, 48, ...
 01010   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 01011   384   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01007  2016   NtQueryInformationProcess  ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01012   384   NtClose  (200, ...
 01013  2016   NtWaitForSingleObject  (88, 0, 0x0, ...
 01014   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 01015   896   NtResumeThread  (204, ... 1, ) == 0x0
 01016   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24969216, 1048576, ) == 0x0
 01017   896   NtAllocateVirtualMemory  (-1, 26009600, 0, 8192, 4096, 4, ... 26009600, 8192, ) == 0x0
 01018   896   NtProtectVirtualMemory  (-1, (0x18ce000), 4096, 260, ... (0x18ce000), 4096, 4, ) == 0x0
 01019   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01012   384   NtClose  ... ) == 0x0
 01020   900   NtWaitForSingleObject  (88, 0, 0x0, ...
 01021   384   NtMapViewOfSection  (208, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 01022   384   NtClose  (208, ... ) == 0x0
 01023   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01024   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01025   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01026   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ...
 01019   896   NtCreateThread  ... 208, {1252, 1388}, ) == 0x0
 01027   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 01028   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 01029   896   NtResumeThread  (208, ... 1, ) == 0x0
 01030   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26017792, 1048576, ) == 0x0
 01031   896   NtAllocateVirtualMemory  (-1, 27058176, 0, 8192, 4096, 4, ... 27058176, 8192, ) == 0x0
 01026   384   NtProtectVirtualMemory  ... (0x76f21000), 4096, 32, ) == 0x0
 01032  1388   NtWaitForSingleObject  (88, 0, 0x0, ...
 01033   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01034   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01035   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01036   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01037   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01038   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ...
 01039   896   NtProtectVirtualMemory  (-1, (0x19ce000), 4096, 260, ... (0x19ce000), 4096, 4, ) == 0x0
 01040   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 200, {1252, 2036}, ) == 0x0
 01041   896   NtQueryInformationThread  (200, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 01042   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0\364\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 01043   896   NtResumeThread  (200, ... 1, ) == 0x0
 01044   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01038   384   NtProtectVirtualMemory  ... (0x76f21000), 4096, 32, ) == 0x0
 01045  2036   NtWaitForSingleObject  (88, 0, 0x0, ...
 01046   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01047   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01048   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01049   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01050   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01051   384   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ...
 01044   896   NtAllocateVirtualMemory  ... 27066368, 1048576, ) == 0x0
 01052   896   NtAllocateVirtualMemory  (-1, 28106752, 0, 8192, 4096, 4, ... 28106752, 8192, ) == 0x0
 01053   896   NtProtectVirtualMemory  (-1, (0x1ace000), 4096, 260, ... (0x1ace000), 4096, 4, ) == 0x0
 01054   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 212, {1252, 1372}, ) == 0x0
 01055   896   NtQueryInformationThread  (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 01056   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 01051   384   NtProtectVirtualMemory  ... (0x76f21000), 4096, 32, ) == 0x0
 01057   384   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01058   384   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01059   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01060   384   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 216, 2, ) }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 216, 2, ) , 0, ... 216, 2, ) == 0x0
 01061   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 220, ) }, ... 220, ) == 0x0
 01062   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01063   896   NtResumeThread  (212, ... 1, ) == 0x0
 01064   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28114944, 1048576, ) == 0x0
 01065   896   NtAllocateVirtualMemory  (-1, 29155328, 0, 8192, 4096, 4, ... 29155328, 8192, ) == 0x0
 01066   896   NtProtectVirtualMemory  (-1, (0x1bce000), 4096, 260, ... (0x1bce000), 4096, 4, ) == 0x0
 01067   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 224, {1252, 1600}, ) == 0x0
 01068   896   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 01062   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01069  1372   NtWaitForSingleObject  (88, 0, 0x0, ...
 01070   384   NtQueryValueKey  (220,  (220, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01071   384   NtQueryValueKey  (216,  (216, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01072   384   NtQueryValueKey  (220,  (220, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01073   384   NtQueryValueKey  (216,  (216, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01074   384   NtQueryValueKey  (220,  (220, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01075   384   NtQueryValueKey  (216,  (216, "PrioritizeRecordData", Partial, 144, ... , Partial, 144, ...
 01076   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 01077   896   NtResumeThread  (224, ... 1, ) == 0x0
 01078   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29163520, 1048576, ) == 0x0
 01079   896   NtAllocateVirtualMemory  (-1, 30203904, 0, 8192, 4096, 4, ... 30203904, 8192, ) == 0x0
 01080   896   NtProtectVirtualMemory  (-1, (0x1cce000), 4096, 260, ... (0x1cce000), 4096, 4, ) == 0x0
 01081   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01075   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01082  1600   NtWaitForSingleObject  (88, 0, 0x0, ...
 01083   384   NtQueryValueKey  (220,  (220, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01084   384   NtQueryValueKey  (216,  (216, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01085   384   NtQueryValueKey  (220,  (220, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01086   384   NtQueryValueKey  (220,  (220, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087   384   NtQueryValueKey  (220,  (220, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01088   384   NtQueryValueKey  (220,  (220, "FilterClusterIp", Partial, 144, ... , Partial, 144, ...
 01081   896   NtCreateThread  ... 228, {1252, 1948}, ) == 0x0
 01089   896   NtQueryInformationThread  (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 01090   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\234\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 01091   896   NtResumeThread  (228, ... 1, ) == 0x0
 01092   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30212096, 1048576, ) == 0x0
 01093   896   NtAllocateVirtualMemory  (-1, 31252480, 0, 8192, 4096, 4, ... 31252480, 8192, ) == 0x0
 01088   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01094  1948   NtWaitForSingleObject  (88, 0, 0x0, ...
 01095   384   NtQueryValueKey  (220,  (220, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01096   384   NtQueryValueKey  (220,  (220, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01097   384   NtQueryValueKey  (220,  (220, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01098   384   NtQueryValueKey  (220,  (220, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01099   384   NtQueryValueKey  (220,  (220, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01100   384   NtQueryValueKey  (216,  (216, "DisableDynamicUpdate", Partial, 144, ... , Partial, 144, ...
 01101   896   NtProtectVirtualMemory  (-1, (0x1dce000), 4096, 260, ... (0x1dce000), 4096, 4, ) == 0x0
 01102   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 232, {1252, 252}, ) == 0x0
 01103   896   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 01104   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\374\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 01105   896   NtResumeThread  (232, ... 1, ) == 0x0
 01106   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01100   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01107   252   NtWaitForSingleObject  (88, 0, 0x0, ...
 01108   384   NtQueryValueKey  (220,  (220, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01109   384   NtQueryValueKey  (220,  (220, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01110   384   NtQueryValueKey  (216,  (216, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01111   384   NtQueryValueKey  (220,  (220, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01112   384   NtQueryValueKey  (216,  (216, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01113   384   NtQueryValueKey  (220,  (220, "RegisterWanAdapters", Partial, 144, ... , Partial, 144, ...
 01106   896   NtAllocateVirtualMemory  ... 31260672, 1048576, ) == 0x0
 01114   896   NtAllocateVirtualMemory  (-1, 32301056, 0, 8192, 4096, 4, ... 32301056, 8192, ) == 0x0
 01115   896   NtProtectVirtualMemory  (-1, (0x1ece000), 4096, 260, ... (0x1ece000), 4096, 4, ) == 0x0
 01116   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 236, {1252, 1300}, ) == 0x0
 01117   896   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 01118   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\24\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 01113   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01119   384   NtQueryValueKey  (216,  (216, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01120   384   NtQueryValueKey  (220,  (220, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01121   384   NtQueryValueKey  (216,  (216, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01122   384   NtQueryValueKey  (220,  (220, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01123   384   NtQueryValueKey  (216,  (216, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01124   384   NtQueryValueKey  (220,  (220, "RegistrationMaxAddressCount", Partial, 144, ... , Partial, 144, ...
 01125   896   NtResumeThread  (236, ... 1, ) == 0x0
 01126   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32309248, 1048576, ) == 0x0
 01127   896   NtAllocateVirtualMemory  (-1, 33349632, 0, 8192, 4096, 4, ... 33349632, 8192, ) == 0x0
 01128   896   NtProtectVirtualMemory  (-1, (0x1fce000), 4096, 260, ... (0x1fce000), 4096, 4, ) == 0x0
 01129   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 240, {1252, 1096}, ) == 0x0
 01130   896   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 01124   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01131  1300   NtWaitForSingleObject  (88, 0, 0x0, ...
 01132   384   NtQueryValueKey  (216,  (216, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01133   384   NtQueryValueKey  (220,  (220, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134   384   NtQueryValueKey  (216,  (216, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01135   384   NtQueryValueKey  (220,  (220, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01136   384   NtQueryValueKey  (220,  (220, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01137   384   NtQueryValueKey  (220,  (220, "DnsTest", Partial, 144, ... , Partial, 144, ...
 01138   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0H\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0H\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 01139   896   NtResumeThread  (240, ... 1, ) == 0x0
 01140   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 33357824, 1048576, ) == 0x0
 01141   896   NtAllocateVirtualMemory  (-1, 34398208, 0, 8192, 4096, 4, ... 34398208, 8192, ) == 0x0
 01142   896   NtProtectVirtualMemory  (-1, (0x20ce000), 4096, 260, ... (0x20ce000), 4096, 4, ) == 0x0
 01143   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01137   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01144  1096   NtWaitForSingleObject  (88, 0, 0x0, ...
 01145   384   NtQueryValueKey  (220,  (220, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01146   384   NtQueryValueKey  (220,  (220, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01147   384   NtQueryValueKey  (220,  (220, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01148   384   NtQueryValueKey  (220,  (220, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01149   384   NtQueryValueKey  (220,  (220, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01150   384   NtQueryValueKey  (220,  (220, "MaxCachedSockets", Partial, 144, ... , Partial, 144, ...
 01143   896   NtCreateThread  ... 244, {1252, 1708}, ) == 0x0
 01151   896   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 01152   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\254\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\254\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 01153   896   NtResumeThread  (244, ... 1, ) == 0x0
 01154   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 34406400, 1048576, ) == 0x0
 01155   896   NtAllocateVirtualMemory  (-1, 35446784, 0, 8192, 4096, 4, ... 35446784, 8192, ) == 0x0
 01150   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01156  1708   NtWaitForSingleObject  (88, 0, 0x0, ...
 01157   384   NtQueryValueKey  (220,  (220, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01158   384   NtQueryValueKey  (220,  (220, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01159   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 248, ) }, ... 248, ) == 0x0
 01160   384   NtQueryValueKey  (248,  (248, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01161   384   NtClose  (248, ... ) == 0x0
 01162   384   NtClose  (216, ...
 01163   896   NtProtectVirtualMemory  (-1, (0x21ce000), 4096, 260, ... (0x21ce000), 4096, 4, ) == 0x0
 01164   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 248, {1252, 1024}, ) == 0x0
 01165   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 01166   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 01167   896   NtResumeThread  (248, ... 1, ) == 0x0
 01168   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01162   384   NtClose  ... ) == 0x0
 01169  1024   NtWaitForSingleObject  (88, 0, 0x0, ...
 01170   384   NtClose  (220, ... ) == 0x0
 01171   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 220, ) }, ... 220, ) == 0x0
 01172   384   NtQueryValueKey  (220,  (220, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01173   384   NtQueryValueKey  (220,  (220, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01174   384   NtQueryValueKey  (220,  (220, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01175   384   NtClose  (220, ...
 01168   896   NtAllocateVirtualMemory  ... 35454976, 1048576, ) == 0x0
 01176   896   NtAllocateVirtualMemory  (-1, 36495360, 0, 8192, 4096, 4, ... 36495360, 8192, ) == 0x0
 01177   896   NtProtectVirtualMemory  (-1, (0x22ce000), 4096, 260, ... (0x22ce000), 4096, 4, ) == 0x0
 01178   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 216, {1252, 1324}, ) == 0x0
 01179   896   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa0000,Pid=1252,Tid=1324,}, 0x0, ) == 0x0
 01180   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0,\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0,\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0,\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0,\5\0\0" )  ) == 0x0
 01175   384   NtClose  ... ) == 0x0
 01181   384   NtSetEventBoostPriority  (88, ...
 00989  1732   NtWaitForSingleObject  ... ) == 0x0
 01182  1732   NtSetEventBoostPriority  (88, ...
 01001   748   NtWaitForSingleObject  ... ) == 0x0
 01183   748   NtSetEventBoostPriority  (88, ...
 01013  2016   NtWaitForSingleObject  ... ) == 0x0
 01184  2016   NtSetEventBoostPriority  (88, ...
 01020   900   NtWaitForSingleObject  ... ) == 0x0
 01185   900   NtSetEventBoostPriority  (88, ...
 01032  1388   NtWaitForSingleObject  ... ) == 0x0
 01186  1388   NtSetEventBoostPriority  (88, ...
 01045  2036   NtWaitForSingleObject  ... ) == 0x0
 01187  2036   NtSetEventBoostPriority  (88, ...
 01069  1372   NtWaitForSingleObject  ... ) == 0x0
 01188  1372   NtSetEventBoostPriority  (88, ...
 01082  1600   NtWaitForSingleObject  ... ) == 0x0
 01189  1600   NtSetEventBoostPriority  (88, ...
 01094  1948   NtWaitForSingleObject  ... ) == 0x0
 01190  1948   NtSetEventBoostPriority  (88, ...
 01107   252   NtWaitForSingleObject  ... ) == 0x0
 01191   252   NtSetEventBoostPriority  (88, ...
 01131  1300   NtWaitForSingleObject  ... ) == 0x0
 01192  1300   NtSetEventBoostPriority  (88, ...
 01144  1096   NtWaitForSingleObject  ... ) == 0x0
 01193  1096   NtSetEventBoostPriority  (88, ...
 01156  1708   NtWaitForSingleObject  ... ) == 0x0
 01194  1708   NtSetEventBoostPriority  (88, ...
 01169  1024   NtWaitForSingleObject  ... ) == 0x0
 01195  1024   NtTestAlert  (... ) == 0x0
 01194  1708   NtSetEventBoostPriority  ... ) == 0x0
 01193  1096   NtSetEventBoostPriority  ... ) == 0x0
 01192  1300   NtSetEventBoostPriority  ... ) == 0x0
 01191   252   NtSetEventBoostPriority  ... ) == 0x0
 01190  1948   NtSetEventBoostPriority  ... ) == 0x0
 01189  1600   NtSetEventBoostPriority  ... ) == 0x0
 01188  1372   NtSetEventBoostPriority  ... ) == 0x0
 01187  2036   NtSetEventBoostPriority  ... ) == 0x0
 01186  1388   NtSetEventBoostPriority  ... ) == 0x0
 01185   900   NtSetEventBoostPriority  ... ) == 0x0
 01184  2016   NtSetEventBoostPriority  ... ) == 0x0
 01183   748   NtSetEventBoostPriority  ... ) == 0x0
 01182  1732   NtSetEventBoostPriority  ... ) == 0x0
 01181   384   NtSetEventBoostPriority  ... ) == 0x0
 01196   896   NtResumeThread  (216, ...
 01197  1024   NtContinue  (35454256, 1, ...
 01198  1708   NtTestAlert  (...
 01199  1096   NtTestAlert  (...
 01200  1300   NtTestAlert  (...
 01201   252   NtTestAlert  (...
 01202  1948   NtTestAlert  (...
 01203  1600   NtTestAlert  (...
 01204  1372   NtTestAlert  (...
 01205  2036   NtTestAlert  (...
 01206  1388   NtTestAlert  (...
 01207   900   NtTestAlert  (...
 01208  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01209   748   NtTestAlert  (...
 01210   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01196   896   NtResumeThread  ... 1, ) == 0x0
 01211  1024   NtRegisterThreadTerminatePort  (24, ...
 01198  1708   NtTestAlert  ... ) == 0x0
 01199  1096   NtTestAlert  ... ) == 0x0
 01200  1300   NtTestAlert  ... ) == 0x0
 01201   252   NtTestAlert  ... ) == 0x0
 01202  1948   NtTestAlert  ... ) == 0x0
 01203  1600   NtTestAlert  ... ) == 0x0
 01204  1372   NtTestAlert  ... ) == 0x0
 01205  2036   NtTestAlert  ... ) == 0x0
 01206  1388   NtTestAlert  ... ) == 0x0
 01207   900   NtTestAlert  ... ) == 0x0
 01208  2016   NtCreateEvent  ... 220, ) == 0x0
 01209   748   NtTestAlert  ... ) == 0x0
 01210   384   NtCreateEvent  ... 252, ) == 0x0
 01212   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01211  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 01213  1708   NtContinue  (34405680, 1, ...
 01214  1096   NtContinue  (33357104, 1, ...
 01215  1300   NtContinue  (32308528, 1, ...
 01216   252   NtContinue  (31259952, 1, ...
 01217  1948   NtContinue  (30211376, 1, ...
 01218  1600   NtContinue  (29162800, 1, ...
 01219  1372   NtContinue  (28114224, 1, ...
 01220  2036   NtContinue  (27065648, 1, ...
 01221  1388   NtContinue  (26017072, 1, ...
 01222   900   NtContinue  (24968496, 1, ...
 01223  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01224   748   NtContinue  (23919920, 1, ...
 01225   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01212   896   NtAllocateVirtualMemory  ... 36503552, 1048576, ) == 0x0
 01226  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01227  1708   NtRegisterThreadTerminatePort  (24, ...
 01228  1096   NtRegisterThreadTerminatePort  (24, ...
 01229  1300   NtRegisterThreadTerminatePort  (24, ...
 01230   252   NtRegisterThreadTerminatePort  (24, ...
 01231  1948   NtRegisterThreadTerminatePort  (24, ...
 01232  1600   NtRegisterThreadTerminatePort  (24, ...
 01233  1372   NtRegisterThreadTerminatePort  (24, ...
 01234  2036   NtRegisterThreadTerminatePort  (24, ...
 01235  1388   NtRegisterThreadTerminatePort  (24, ...
 01236   900   NtRegisterThreadTerminatePort  (24, ...
 01223  2016   NtDuplicateObject  ... 256, ) == 0x0
 01237   748   NtRegisterThreadTerminatePort  (24, ...
 01238  1732   NtTestAlert  (...
 01239  1324   NtAllocateVirtualMemory  (-1, 8867840, 0, 4096, 4096, 4, ...
 01240   896   NtAllocateVirtualMemory  (-1, 37543936, 0, 8192, 4096, 4, ...
 01226  1024   NtDuplicateObject  ... 260, ) == 0x0
 01227  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 01228  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 01229  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 01230   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 01231  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01232  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 01233  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 01234  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01235  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 01236   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 01241  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01237   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 01238  1732   NtTestAlert  ... ) == 0x0
 01239  1324   NtAllocateVirtualMemory  ... 8867840, 4096, ) == 0x0
 01240   896   NtAllocateVirtualMemory  ... 37543936, 8192, ) == 0x0
 01242  1024   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01243  1708   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01244  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01245  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01246   252   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ...
 01247  1948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01248  1600   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01249  1372   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01250  2036   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01251  1388   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01252   900   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01241  2016   NtOpenKey  ... 264, ) == 0x0
 01253   748   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01254  1732   NtContinue  (22871344, 1, ...
 01255  1324   NtTestAlert  (...
 01225   384   NtDuplicateObject  ... 268, ) == 0x0
 01256   896   NtProtectVirtualMemory  (-1, (0x23ce000), 4096, 260, ...
 01242  1024   NtWaitForSingleObject  ... ) == 0x102
 01243  1708   NtDuplicateObject  ... 272, ) == 0x0
 01244  1096   NtDuplicateObject  ... 276, ) == 0x0
 01245  1300   NtDuplicateObject  ... 280, ) == 0x0
 01246   252   NtAllocateVirtualMemory  ... 1368064, 4096, ) == 0x0
 01247  1948   NtCreateEvent  ... 284, ) == 0x0
 01248  1600   NtCreateEvent  ... 288, ) == 0x0
 01249  1372   NtCreateEvent  ... 292, ) == 0x0
 01250  2036   NtCreateEvent  ... 296, ) == 0x0
 01251  1388   NtCreateEvent  ... 300, ) == 0x0
 01252   900   NtCreateEvent  ... 304, ) == 0x0
 01257  2016   NtQueryValueKey  (264,  (264, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01258  1732   NtRegisterThreadTerminatePort  (24, ...
 01255  1324   NtTestAlert  ... ) == 0x0
 01259   384   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01256   896   NtProtectVirtualMemory  ... (0x23ce000), 4096, 4, ) == 0x0
 01260  1024   NtWaitForSingleObject  (124, 0, 0x0, ...
 01261  1708   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01262  1096   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01263  1300   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01264   252   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01265  1948   NtWaitForSingleObject  (284, 0, 0x0, ...
 01266  1600   NtClose  (288, ...
 01267  1372   NtClose  (292, ...
 01268  2036   NtClose  (296, ...
 01269  1388   NtClose  (300, ...
 01270   900   NtClose  (304, ...
 01257  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01258  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 01271  1324   NtContinue  (36502832, 1, ...
 01259   384   NtCreateEvent  ... 308, ) == 0x0
 01272   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01261  1708   NtCreateEvent  ... 312, ) == 0x0
 01262  1096   NtCreateEvent  ... 316, ) == 0x0
 01263  1300   NtCreateEvent  ... 320, ) == 0x0
 01264   252   NtCreateEvent  ... 324, ) == 0x0
 01266  1600   NtClose  ... ) == 0x0
 01267  1372   NtClose  ... ) == 0x0
 01268  2036   NtClose  ... ) == 0x0
 01269  1388   NtClose  ... ) == 0x0
 01270   900   NtClose  ... ) == 0x0
 01273  2016   NtClose  (264, ...
 01274  1732   NtWaitForSingleObject  (284, 0, 0x0, ...
 01253   748   NtCreateEvent  ... 304, ) == 0x0
 01275   384   NtClose  (308, ...
 01272   896   NtCreateThread  ... 300, {1252, 1776}, ) == 0x0
 01276  1708   NtClose  (312, ...
 01277  1096   NtClose  (316, ...
 01278  1300   NtClose  (320, ...
 01279   252   NtClose  (324, ...
 01280  1600   NtWaitForSingleObject  (284, 0, 0x0, ...
 01281  1372   NtWaitForSingleObject  (284, 0, 0x0, ...
 01282  2036   NtWaitForSingleObject  (284, 0, 0x0, ...
 01283  1388   NtWaitForSingleObject  (284, 0, 0x0, ...
 01284   900   NtWaitForSingleObject  (284, 0, 0x0, ...
 01273  2016   NtClose  ... ) == 0x0
 01285  1324   NtRegisterThreadTerminatePort  (24, ...
 01286   748   NtClose  (304, ...
 01275   384   NtClose  ... ) == 0x0
 01287   896   NtQueryInformationThread  (300, Basic, 28, ...
 01276  1708   NtClose  ... ) == 0x0
 01277  1096   NtClose  ... ) == 0x0
 01278  1300   NtClose  ... ) == 0x0
 01279   252   NtClose  ... ) == 0x0
 01288  2016   NtWaitForSingleObject  (284, 0, 0x0, ...
 01285  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 01286   748   NtClose  ... ) == 0x0
 01289   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 01287   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 01290  1708   NtWaitForSingleObject  (284, 0, 0x0, ...
 01291  1096   NtWaitForSingleObject  (284, 0, 0x0, ...
 01292  1300   NtWaitForSingleObject  (284, 0, 0x0, ...
 01293   252   NtSetEventBoostPriority  (284, ...
 01294  1324   NtWaitForSingleObject  (284, 0, 0x0, ...
 01295   748   NtWaitForSingleObject  (284, 0, 0x0, ...
 01296   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 01297   896   NtResumeThread  (300, ... 1, ) == 0x0
 01298   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 37552128, 1048576, ) == 0x0
 01299   896   NtAllocateVirtualMemory  (-1, 38592512, 0, 8192, 4096, 4, ... 38592512, 8192, ) == 0x0
 01300   896   NtProtectVirtualMemory  (-1, (0x24ce000), 4096, 260, ... (0x24ce000), 4096, 4, ) == 0x0
 01301   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01265  1948   NtWaitForSingleObject  ... ) == 0x0
 01293   252   NtSetEventBoostPriority  ... ) == 0x0
 01302  1776   NtTestAlert  (...
 01303  1948   NtSetEventBoostPriority  (284, ...
 01304   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01302  1776   NtTestAlert  ... ) == 0x0
 01280  1600   NtWaitForSingleObject  ... ) == 0x0
 01303  1948   NtSetEventBoostPriority  ... ) == 0x0
 01304   252   NtDuplicateObject  ... 304, ) == 0x0
 01305  1600   NtSetEventBoostPriority  (284, ...
 01306  1776   NtContinue  (37551408, 1, ...
 01301   896   NtCreateThread  ... 324, {1252, 500}, ) == 0x0
 01281  1372   NtWaitForSingleObject  ... ) == 0x0
 01305  1600   NtSetEventBoostPriority  ... ) == 0x0
 01307   252   NtWaitForSingleObject  (284, 0, 0x0, ...
 01308  1776   NtRegisterThreadTerminatePort  (24, ...
 01309  1372   NtSetEventBoostPriority  (284, ...
 01310   896   NtQueryInformationThread  (324, Basic, 28, ...
 01311  1948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01282  2036   NtWaitForSingleObject  ... ) == 0x0
 01309  1372   NtSetEventBoostPriority  ... ) == 0x0
 01308  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 01310   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 01312  2036   NtSetEventBoostPriority  (284, ...
 01311  1948   NtDuplicateObject  ... 320, ) == 0x0
 01313  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01314  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01283  1388   NtWaitForSingleObject  ... ) == 0x0
 01312  2036   NtSetEventBoostPriority  ... ) == 0x0
 01315   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\1\0\0\344\4\0\0\364\1\0\0" ...  ...
 01316  1948   NtWaitForSingleObject  (284, 0, 0x0, ...
 01313  1600   NtDuplicateObject  ... 316, ) == 0x0
 01317  1388   NtSetEventBoostPriority  (284, ...
 01314  1372   NtDuplicateObject  ... 312, ) == 0x0
 01318  1776   NtWaitForSingleObject  (284, 0, 0x0, ...
 01315   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81863, 0}  ... {28, 56, reply, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 01284   900   NtWaitForSingleObject  ... ) == 0x0
 01317  1388   NtSetEventBoostPriority  ... ) == 0x0
 01319  1600   NtWaitForSingleObject  (284, 0, 0x0, ...
 01320  1372   NtWaitForSingleObject  (284, 0, 0x0, ...
 01321  2036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01322   900   NtSetEventBoostPriority  (284, ...
 01323   896   NtResumeThread  (324, ...
 01288  2016   NtWaitForSingleObject  ... ) == 0x0
 01322   900   NtSetEventBoostPriority  ... ) == 0x0
 01321  2036   NtDuplicateObject  ... 308, ) == 0x0
 01324  2016   NtSetEventBoostPriority  (284, ...
 01323   896   NtResumeThread  ... 1, ) == 0x0
 01325  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01274  1732   NtWaitForSingleObject  ... ) == 0x0
 01324  2016   NtSetEventBoostPriority  ... ) == 0x0
 01326  2036   NtWaitForSingleObject  (284, 0, 0x0, ...
 01327   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01328  1732   NtSetEventBoostPriority  (284, ...
 01325  1388   NtDuplicateObject  ... 264, ) == 0x0
 01329   900   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01330   500   NtTestAlert  (...
 01289   384   NtWaitForSingleObject  ... ) == 0x0
 01327   896   NtAllocateVirtualMemory  ... 38600704, 1048576, ) == 0x0
 01331  1388   NtWaitForSingleObject  (284, 0, 0x0, ...
 01329   900   NtDuplicateObject  ... 296, ) == 0x0
 01330   500   NtTestAlert  ... ) == 0x0
 01332   384   NtSetEventBoostPriority  (284, ...
 01333   896   NtAllocateVirtualMemory  (-1, 39641088, 0, 8192, 4096, 4, ...
 01334   900   NtWaitForSingleObject  (284, 0, 0x0, ...
 01335   500   NtContinue  (38599984, 1, ...
 01290  1708   NtWaitForSingleObject  ... ) == 0x0
 01333   896   NtAllocateVirtualMemory  ... 39641088, 8192, ) == 0x0
 01336   500   NtRegisterThreadTerminatePort  (24, ...
 01337  1708   NtSetEventBoostPriority  (284, ...
 01332   384   NtSetEventBoostPriority  ... ) == 0x0
 01328  1732   NtSetEventBoostPriority  ... ) == 0x0
 01338  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01336   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 01291  1096   NtWaitForSingleObject  ... ) == 0x0
 01339   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 01340  1732   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01338  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01337  1708   NtSetEventBoostPriority  ... ) == 0x0
 01341   896   NtProtectVirtualMemory  (-1, (0x25ce000), 4096, 260, ...
 01342  1096   NtSetEventBoostPriority  (284, ...
 01340  1732   NtDuplicateObject  ... 292, ) == 0x0
 01343  2016   NtOpenThreadToken  (-2, 0x20008, 1, ...
 01344  1708   NtWaitForSingleObject  (284, 0, 0x0, ...
 01341   896   NtProtectVirtualMemory  ... (0x25ce000), 4096, 4, ) == 0x0
 01292  1300   NtWaitForSingleObject  ... ) == 0x0
 01342  1096   NtSetEventBoostPriority  ... ) == 0x0
 01345   500   NtWaitForSingleObject  (284, 0, 0x0, ...
 01343  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01346   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01347  1300   NtSetEventBoostPriority  (284, ...
 01348  1096   NtWaitForSingleObject  (284, 0, 0x0, ...
 01349  2016   NtWaitForSingleObject  (284, 0, 0x0, ...
 01346   896   NtCreateThread  ... 288, {1252, 248}, ) == 0x0
 01294  1324   NtWaitForSingleObject  ... ) == 0x0
 01350   896   NtQueryInformationThread  (288, Basic, 28, ...
 01351  1324   NtSetEventBoostPriority  (284, ...
 01350   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 01295   748   NtWaitForSingleObject  ... ) == 0x0
 01351  1324   NtSetEventBoostPriority  ... ) == 0x0
 01347  1300   NtSetEventBoostPriority  ... ) == 0x0
 01352  1732   NtWaitForSingleObject  (284, 0, 0x0, ...
 01353   748   NtSetEventBoostPriority  (284, ...
 01354   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\370\0\0\0" ...  ...
 01355  1300   NtWaitForSingleObject  (284, 0, 0x0, ...
 01307   252   NtWaitForSingleObject  ... ) == 0x0
 01353   748   NtSetEventBoostPriority  ... ) == 0x0
 01354   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81864, 0}  ... {28, 56, reply, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 01356   252   NtSetEventBoostPriority  (284, ...
 01357  1324   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01316  1948   NtWaitForSingleObject  ... ) == 0x0
 01356   252   NtSetEventBoostPriority  ... ) == 0x0
 01358   896   NtResumeThread  (288, ...
 01359  1948   NtSetEventBoostPriority  (284, ...
 01357  1324   NtDuplicateObject  ... 328, ) == 0x0
 01360   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01318  1776   NtWaitForSingleObject  ... ) == 0x0
 01359  1948   NtSetEventBoostPriority  ... ) == 0x0
 01358   896   NtResumeThread  ... 1, ) == 0x0
 01361  1324   NtWaitForSingleObject  (284, 0, 0x0, ...
 01362  1776   NtSetEventBoostPriority  (284, ...
 01360   748   NtDuplicateObject  ... 332, ) == 0x0
 01363   252   NtWaitForSingleObject  (284, 0, 0x0, ...
 01364   248   NtTestAlert  (...
 01365   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01319  1600   NtWaitForSingleObject  ... ) == 0x0
 01362  1776   NtSetEventBoostPriority  ... ) == 0x0
 01366   748   NtWaitForSingleObject  (284, 0, 0x0, ...
 01364   248   NtTestAlert  ... ) == 0x0
 01367  1948   NtWaitForSingleObject  (284, 0, 0x0, ...
 01368  1600   NtSetEventBoostPriority  (284, ...
 01369  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01370   248   NtContinue  (39648560, 1, ...
 01320  1372   NtWaitForSingleObject  ... ) == 0x0
 01368  1600   NtSetEventBoostPriority  ... ) == 0x0
 01365   896   NtAllocateVirtualMemory  ... 39649280, 1048576, ) == 0x0
 01371  1372   NtSetEventBoostPriority  (284, ...
 01372   248   NtRegisterThreadTerminatePort  (24, ...
 01369  1776   NtDuplicateObject  ... 336, ) == 0x0
 01326  2036   NtWaitForSingleObject  ... ) == 0x0
 01371  1372   NtSetEventBoostPriority  ... ) == 0x0
 01373   896   NtAllocateVirtualMemory  (-1, 40689664, 0, 8192, 4096, 4, ...
 01372   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 01374  2036   NtSetEventBoostPriority  (284, ...
 01375  1776   NtWaitForSingleObject  (284, 0, 0x0, ...
 01376  1600   NtWaitForSingleObject  (284, 0, 0x0, ...
 01373   896   NtAllocateVirtualMemory  ... 40689664, 8192, ) == 0x0
 01377  1372   NtWaitForSingleObject  (284, 0, 0x0, ...
 01331  1388   NtWaitForSingleObject  ... ) == 0x0
 01374  2036   NtSetEventBoostPriority  ... ) == 0x0
 01378   896   NtProtectVirtualMemory  (-1, (0x26ce000), 4096, 260, ...
 01379  1388   NtSetEventBoostPriority  (284, ...
 01380   248   NtWaitForSingleObject  (284, 0, 0x0, ...
 01334   900   NtWaitForSingleObject  ... ) == 0x0
 01379  1388   NtSetEventBoostPriority  ... ) == 0x0
 01378   896   NtProtectVirtualMemory  ... (0x26ce000), 4096, 4, ) == 0x0
 01381   900   NtSetEventBoostPriority  (284, ...
 01382  2036   NtWaitForSingleObject  (284, 0, 0x0, ...
 01339   384   NtWaitForSingleObject  ... ) == 0x0
 01381   900   NtSetEventBoostPriority  ... ) == 0x0
 01383   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01384   384   NtSetEventBoostPriority  (284, ...
 01385  1388   NtWaitForSingleObject  (284, 0, 0x0, ...
 01386   900   NtWaitForSingleObject  (284, 0, 0x0, ...
 01344  1708   NtWaitForSingleObject  ... ) == 0x0
 01384   384   NtSetEventBoostPriority  ... ) == 0x0
 01387  1708   NtSetEventBoostPriority  (284, ...
 01383   896   NtCreateThread  ... 340, {1252, 1884}, ) == 0x0
 01345   500   NtWaitForSingleObject  ... ) == 0x0
 01387  1708   NtSetEventBoostPriority  ... ) == 0x0
 01388   500   NtSetEventBoostPriority  (284, ...
 01389   896   NtQueryInformationThread  (340, Basic, 28, ...
 01390   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 01348  1096   NtWaitForSingleObject  ... ) == 0x0
 01388   500   NtSetEventBoostPriority  ... ) == 0x0
 01389   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 01391  1096   NtSetEventBoostPriority  (284, ...
 01392   500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01349  2016   NtWaitForSingleObject  ... ) == 0x0
 01391  1096   NtSetEventBoostPriority  ... ) == 0x0
 01393   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0\\7\0\0" ...  ...
 01394  1708   NtWaitForSingleObject  (284, 0, 0x0, ...
 01395  2016   NtSetEventBoostPriority  (284, ...
 01392   500   NtDuplicateObject  ... 344, ) == 0x0
 01393   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81865, 0}  ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 01352  1732   NtWaitForSingleObject  ... ) == 0x0
 01395  2016   NtSetEventBoostPriority  ... ) == 0x0
 01396   500   NtWaitForSingleObject  (284, 0, 0x0, ...
 01397  1096   NtWaitForSingleObject  (284, 0, 0x0, ...
 01398  1732   NtSetEventBoostPriority  (284, ...
 01399   896   NtResumeThread  (340, ...
 01355  1300   NtWaitForSingleObject  ... ) == 0x0
 01398  1732   NtSetEventBoostPriority  ... ) == 0x0
 01400  1300   NtSetEventBoostPriority  (284, ...
 01399   896   NtResumeThread  ... 1, ) == 0x0
 01361  1324   NtWaitForSingleObject  ... ) == 0x0
 01400  1300   NtSetEventBoostPriority  ... ) == 0x0
 01401  1732   NtWaitForSingleObject  (284, 0, 0x0, ...
 01402  1324   NtSetEventBoostPriority  (284, ...
 01403   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01404  2016   NtWaitForSingleObject  (284, 0, 0x0, ...
 01405  1884   NtTestAlert  (...
 01406  1300   NtWaitForSingleObject  (284, 0, 0x0, ...
 01363   252   NtWaitForSingleObject  ... ) == 0x0
 01402  1324   NtSetEventBoostPriority  ... ) == 0x0
 01403   896   NtAllocateVirtualMemory  ... 40697856, 1048576, ) == 0x0
 01405  1884   NtTestAlert  ... ) == 0x0
 01407   252   NtSetEventBoostPriority  (284, ...
 01408   896   NtAllocateVirtualMemory  (-1, 41738240, 0, 8192, 4096, 4, ...
 01366   748   NtWaitForSingleObject  ... ) == 0x0
 01407   252   NtSetEventBoostPriority  ... ) == 0x0
 01409  1884   NtContinue  (40697136, 1, ...
 01410   748   NtSetEventBoostPriority  (284, ...
 01408   896   NtAllocateVirtualMemory  ... 41738240, 8192, ) == 0x0
 01411   252   NtWaitForSingleObject  (284, 0, 0x0, ...
 01367  1948   NtWaitForSingleObject  ... ) == 0x0
 01410   748   NtSetEventBoostPriority  ... ) == 0x0
 01412  1884   NtRegisterThreadTerminatePort  (24, ...
 01413  1324   NtWaitForSingleObject  (284, 0, 0x0, ...
 01414   896   NtProtectVirtualMemory  (-1, (0x27ce000), 4096, 260, ...
 01415  1948   NtSetEventBoostPriority  (284, ...
 01412  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 01375  1776   NtWaitForSingleObject  ... ) == 0x0
 01415  1948   NtSetEventBoostPriority  ... ) == 0x0
 01414   896   NtProtectVirtualMemory  ... (0x27ce000), 4096, 4, ) == 0x0
 01416   748   NtWaitForSingleObject  (284, 0, 0x0, ...
 01417  1776   NtSetEventBoostPriority  (284, ...
 01418  1948   NtWaitForSingleObject  (284, 0, 0x0, ...
 01419   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01376  1600   NtWaitForSingleObject  ... ) == 0x0
 01417  1776   NtSetEventBoostPriority  ... ) == 0x0
 01420  1884   NtWaitForSingleObject  (284, 0, 0x0, ...
 01421  1600   NtSetEventBoostPriority  (284, ...
 01419   896   NtCreateThread  ... 348, {1252, 1308}, ) == 0x0
 01377  1372   NtWaitForSingleObject  ... ) == 0x0
 01421  1600   NtSetEventBoostPriority  ... ) == 0x0
 01422  1372   NtSetEventBoostPriority  (284, ...
 01423   896   NtQueryInformationThread  (348, Basic, 28, ...
 01380   248   NtWaitForSingleObject  ... ) == 0x0
 01422  1372   NtSetEventBoostPriority  ... ) == 0x0
 01424  1600   NtWaitForSingleObject  (284, 0, 0x0, ...
 01425   248   NtSetEventBoostPriority  (284, ...
 01423   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 01426  1372   NtWaitForSingleObject  (284, 0, 0x0, ...
 01427  1776   NtWaitForSingleObject  (284, 0, 0x0, ...
 01382  2036   NtWaitForSingleObject  ... ) == 0x0
 01425   248   NtSetEventBoostPriority  ... ) == 0x0
 01428   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\0\34\5\0\0" ...  ...
 01429  2036   NtSetEventBoostPriority  (284, ...
 01430   248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01385  1388   NtWaitForSingleObject  ... ) == 0x0
 01429  2036   NtSetEventBoostPriority  ... ) == 0x0
 01428   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81866, 0}  ... {28, 56, reply, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 01431  1388   NtSetEventBoostPriority  (284, ...
 01432  2036   NtWaitForSingleObject  (284, 0, 0x0, ...
 01386   900   NtWaitForSingleObject  ... ) == 0x0
 01431  1388   NtSetEventBoostPriority  ... ) == 0x0
 01433   896   NtResumeThread  (348, ...
 01430   248   NtDuplicateObject  ... 352, ) == 0x0
 01434   900   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ...
 01435  1388   NtWaitForSingleObject  (284, 0, 0x0, ...
 01433   896   NtResumeThread  ... 1, ) == 0x0
 01434   900   NtAllocateVirtualMemory  ... 1372160, 4096, ) == 0x0
 01436   248   NtWaitForSingleObject  (284, 0, 0x0, ...
 01437  1308   NtTestAlert  (...
 01438   900   NtSetEventBoostPriority  (284, ...
 01439   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01437  1308   NtTestAlert  ... ) == 0x0
 01390   384   NtWaitForSingleObject  ... ) == 0x0
 01438   900   NtSetEventBoostPriority  ... ) == 0x0
 01440  1308   NtContinue  (41745712, 1, ...
 01441   384   NtSetEventBoostPriority  (284, ...
 01442   900   NtWaitForSingleObject  (284, 0, 0x0, ...
 01443  1308   NtRegisterThreadTerminatePort  (24, ...
 01394  1708   NtWaitForSingleObject  ... ) == 0x0
 01441   384   NtSetEventBoostPriority  ... ) == 0x0
 01444  1708   NtSetEventBoostPriority  (284, ...
 01443  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 01396   500   NtWaitForSingleObject  ... ) == 0x0
 01444  1708   NtSetEventBoostPriority  ... ) == 0x0
 01445   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 01439   896   NtAllocateVirtualMemory  ... 41746432, 1048576, ) == 0x0
 01446   500   NtSetEventBoostPriority  (284, ...
 01447  1708   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01448  1308   NtWaitForSingleObject  (284, 0, 0x0, ...
 01397  1096   NtWaitForSingleObject  ... ) == 0x0
 01446   500   NtSetEventBoostPriority  ... ) == 0x0
 01449   896   NtAllocateVirtualMemory  (-1, 42786816, 0, 8192, 4096, 4, ...
 01450  1096   NtSetEventBoostPriority  (284, ...
 01447  1708   NtCreateEvent  ... 356, ) == 0x0
 01404  2016   NtWaitForSingleObject  ... ) == 0x0
 01450  1096   NtSetEventBoostPriority  ... ) == 0x0
 01449   896   NtAllocateVirtualMemory  ... 42786816, 8192, ) == 0x0
 01451  2016   NtSetEventBoostPriority  (284, ...
 01452  1708   NtWaitForSingleObject  (356, 0, 0x0, ...
 01453  1096   NtWaitForSingleObject  (356, 0, 0x0, ...
 01406  1300   NtWaitForSingleObject  ... ) == 0x0
 01451  2016   NtSetEventBoostPriority  ... ) == 0x0
 01454   896   NtProtectVirtualMemory  (-1, (0x28ce000), 4096, 260, ...
 01455   500   NtWaitForSingleObject  (284, 0, 0x0, ...
 01456  1300   NtSetEventBoostPriority  (284, ...
 01457  2016   NtSetEventBoostPriority  (356, ...
 01454   896   NtProtectVirtualMemory  ... (0x28ce000), 4096, 4, ) == 0x0
 01401  1732   NtWaitForSingleObject  ... ) == 0x0
 01456  1300   NtSetEventBoostPriority  ... ) == 0x0
 01458  1732   NtSetEventBoostPriority  (284, ...
 01459   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01411   252   NtWaitForSingleObject  ... ) == 0x0
 01460  1300   NtWaitForSingleObject  (356, 0, 0x0, ...
 01458  1732   NtSetEventBoostPriority  ... ) == 0x0
 01452  1708   NtWaitForSingleObject  ... ) == 0x0
 01457  2016   NtSetEventBoostPriority  ... ) == 0x0
 01461   252   NtSetEventBoostPriority  (284, ...
 01459   896   NtCreateThread  ... 360, {1252, 1676}, ) == 0x0
 01462  1732   NtWaitForSingleObject  (356, 0, 0x0, ...
 01463  1708   NtWaitForSingleObject  (284, 0, 0x0, ...
 01464  2016   NtWaitForSingleObject  (356, 0, 0x0, ...
 01413  1324   NtWaitForSingleObject  ... ) == 0x0
 01465   896   NtQueryInformationThread  (360, Basic, 28, ...
 01466  1324   NtSetEventBoostPriority  (284, ...
 01465   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 01416   748   NtWaitForSingleObject  ... ) == 0x0
 01466  1324   NtSetEventBoostPriority  ... ) == 0x0
 01467   748   NtSetEventBoostPriority  (284, ...
 01468   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\214\6\0\0" ...  ...
 01418  1948   NtWaitForSingleObject  ... ) == 0x0
 01467   748   NtSetEventBoostPriority  ... ) == 0x0
 01469  1324   NtWaitForSingleObject  (356, 0, 0x0, ...
 01470  1948   NtSetEventBoostPriority  (284, ...
 01468   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81867, 0}  ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 01471   748   NtWaitForSingleObject  (356, 0, 0x0, ...
 01461   252   NtSetEventBoostPriority  ... ) == 0x0
 01420  1884   NtWaitForSingleObject  ... ) == 0x0
 01470  1948   NtSetEventBoostPriority  ... ) == 0x0
 01472   896   NtResumeThread  (360, ...
 01473   252   NtWaitForSingleObject  (356, 0, 0x0, ...
 01474  1884   NtSetEventBoostPriority  (284, ...
 01475  1948   NtWaitForSingleObject  (356, 0, 0x0, ...
 01472   896   NtResumeThread  ... 1, ) == 0x0
 01424  1600   NtWaitForSingleObject  ... ) == 0x0
 01474  1884   NtSetEventBoostPriority  ... ) == 0x0
 01476  1600   NtSetEventBoostPriority  (284, ...
 01477   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01427  1776   NtWaitForSingleObject  ... ) == 0x0
 01478  1884   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01477   896   NtAllocateVirtualMemory  ... 42795008, 1048576, ) == 0x0
 01479  1776   NtSetEventBoostPriority  (284, ...
 01476  1600   NtSetEventBoostPriority  ... ) == 0x0
 01480  1676   NtTestAlert  (...
 01481   896   NtAllocateVirtualMemory  (-1, 43835392, 0, 8192, 4096, 4, ...
 01426  1372   NtWaitForSingleObject  ... ) == 0x0
 01479  1776   NtSetEventBoostPriority  ... ) == 0x0
 01482  1600   NtWaitForSingleObject  (284, 0, 0x0, ...
 01480  1676   NtTestAlert  ... ) == 0x0
 01483  1372   NtSetEventBoostPriority  (284, ...
 01481   896   NtAllocateVirtualMemory  ... 43835392, 8192, ) == 0x0
 01484  1776   NtWaitForSingleObject  (284, 0, 0x0, ...
 01432  2036   NtWaitForSingleObject  ... ) == 0x0
 01485  1676   NtContinue  (42794288, 1, ...
 01483  1372   NtSetEventBoostPriority  ... ) == 0x0
 01478  1884   NtDuplicateObject  ... 364, ) == 0x0
 01486   896   NtProtectVirtualMemory  (-1, (0x29ce000), 4096, 260, ...
 01487  2036   NtSetEventBoostPriority  (284, ...
 01488  1676   NtRegisterThreadTerminatePort  (24, ...
 01489  1372   NtWaitForSingleObject  (284, 0, 0x0, ...
 01490  1884   NtWaitForSingleObject  (284, 0, 0x0, ...
 01486   896   NtProtectVirtualMemory  ... (0x29ce000), 4096, 4, ) == 0x0
 01436   248   NtWaitForSingleObject  ... ) == 0x0
 01488  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 01491   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01492   248   NtSetEventBoostPriority  (284, ...
 01487  2036   NtSetEventBoostPriority  ... ) == 0x0
 01491   896   NtCreateThread  ... 368, {1252, 1620}, ) == 0x0
 01435  1388   NtWaitForSingleObject  ... ) == 0x0
 01492   248   NtSetEventBoostPriority  ... ) == 0x0
 01493  2036   NtWaitForSingleObject  (284, 0, 0x0, ...
 01494  1388   NtSetEventBoostPriority  (284, ...
 01495   896   NtQueryInformationThread  (368, Basic, 28, ...
 01496  1676   NtWaitForSingleObject  (284, 0, 0x0, ...
 01442   900   NtWaitForSingleObject  ... ) == 0x0
 01495   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 01497   900   NtSetEventBoostPriority  (284, ...
 01494  1388   NtSetEventBoostPriority  ... ) == 0x0
 01498   248   NtWaitForSingleObject  (356, 0, 0x0, ...
 01445   384   NtWaitForSingleObject  ... ) == 0x0
 01497   900   NtSetEventBoostPriority  ... ) == 0x0
 01499  1388   NtWaitForSingleObject  (284, 0, 0x0, ...
 01500   384   NtSetEventBoostPriority  (284, ...
 01501   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0T\6\0\0" ...  ...
 01448  1308   NtWaitForSingleObject  ... ) == 0x0
 01501   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81868, 0}  ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 01502  1308   NtSetEventBoostPriority  (284, ...
 01503   896   NtResumeThread  (368, ...
 01455   500   NtWaitForSingleObject  ... ) == 0x0
 01502  1308   NtSetEventBoostPriority  ... ) == 0x0
 01504   500   NtSetEventBoostPriority  (284, ...
 01503   896   NtResumeThread  ... 1, ) == 0x0
 01463  1708   NtWaitForSingleObject  ... ) == 0x0
 01504   500   NtSetEventBoostPriority  ... ) == 0x0
 01505  1308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01506  1708   NtSetEventBoostPriority  (284, ...
 01507   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01508   500   NtWaitForSingleObject  (284, 0, 0x0, ...
 01500   384   NtSetEventBoostPriority  ... ) == 0x0
 01509   900   NtWaitForSingleObject  (356, 0, 0x0, ...
 01510  1620   NtTestAlert  (...
 01482  1600   NtWaitForSingleObject  ... ) == 0x0
 01506  1708   NtSetEventBoostPriority  ... ) == 0x0
 01505  1308   NtDuplicateObject  ... 372, ) == 0x0
 01507   896   NtAllocateVirtualMemory  ... 43843584, 1048576, ) == 0x0
 01511   384   NtWaitForSingleObject  (356, 0, 0x0, ...
 01512  1600   NtSetEventBoostPriority  (284, ...
 01510  1620   NtTestAlert  ... ) == 0x0
 01513  1308   NtWaitForSingleObject  (284, 0, 0x0, ...
 01514   896   NtAllocateVirtualMemory  (-1, 44883968, 0, 8192, 4096, 4, ...
 01489  1372   NtWaitForSingleObject  ... ) == 0x0
 01512  1600   NtSetEventBoostPriority  ... ) == 0x0
 01515  1620   NtContinue  (43842864, 1, ...
 01516  1372   NtSetEventBoostPriority  (284, ...
 01514   896   NtAllocateVirtualMemory  ... 44883968, 8192, ) == 0x0
 01517  1708   NtSetEventBoostPriority  (356, ...
 01490  1884   NtWaitForSingleObject  ... ) == 0x0
 01516  1372   NtSetEventBoostPriority  ... ) == 0x0
 01518  1620   NtRegisterThreadTerminatePort  (24, ...
 01519   896   NtProtectVirtualMemory  (-1, (0x2ace000), 4096, 260, ...
 01520  1884   NtSetEventBoostPriority  (284, ...
 01453  1096   NtWaitForSingleObject  ... ) == 0x0
 01517  1708   NtSetEventBoostPriority  ... ) == 0x0
 01521  1600   NtWaitForSingleObject  (356, 0, 0x0, ...
 01518  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 01484  1776   NtWaitForSingleObject  ... ) == 0x0
 01522  1096   NtWaitForSingleObject  (284, 0, 0x0, ...
 01520  1884   NtSetEventBoostPriority  ... ) == 0x0
 01519   896   NtProtectVirtualMemory  ... (0x2ace000), 4096, 4, ) == 0x0
 01523  1708   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01524  1372   NtWaitForSingleObject  (356, 0, 0x0, ...
 01525  1776   NtSetEventBoostPriority  (284, ...
 01526  1620   NtWaitForSingleObject  (284, 0, 0x0, ...
 01527   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01523  1708   NtWaitForSingleObject  ... ) == 0x102
 01493  2036   NtWaitForSingleObject  ... ) == 0x0
 01525  1776   NtSetEventBoostPriority  ... ) == 0x0
 01528  1884   NtWaitForSingleObject  (356, 0, 0x0, ...
 01529  1708   NtWaitForSingleObject  (124, 0, 0x0, ...
 01530  2036   NtSetEventBoostPriority  (284, ...
 01531  1776   NtWaitForSingleObject  (356, 0, 0x0, ...
 01527   896   NtCreateThread  ... 376, {1252, 1296}, ) == 0x0
 01496  1676   NtWaitForSingleObject  ... ) == 0x0
 01530  2036   NtSetEventBoostPriority  ... ) == 0x0
 01532  1676   NtSetEventBoostPriority  (284, ...
 01533   896   NtQueryInformationThread  (376, Basic, 28, ...
 01499  1388   NtWaitForSingleObject  ... ) == 0x0
 01532  1676   NtSetEventBoostPriority  ... ) == 0x0
 01534  1388   NtSetEventBoostPriority  (284, ...
 01533   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 01508   500   NtWaitForSingleObject  ... ) == 0x0
 01534  1388   NtSetEventBoostPriority  ... ) == 0x0
 01535  1676   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01536   500   NtSetEventBoostPriority  (284, ...
 01537   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0\20\5\0\0" ...  ...
 01538  2036   NtWaitForSingleObject  (356, 0, 0x0, ...
 01539  1388   NtWaitForSingleObject  (356, 0, 0x0, ...
 01513  1308   NtWaitForSingleObject  ... ) == 0x0
 01537   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81869, 0}  ... {28, 56, reply, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 01540  1308   NtSetEventBoostPriority  (284, ...
 01536   500   NtSetEventBoostPriority  ... ) == 0x0
 01535  1676   NtDuplicateObject  ... 380, ) == 0x0
 01522  1096   NtWaitForSingleObject  ... ) == 0x0
 01540  1308   NtSetEventBoostPriority  ... ) == 0x0
 01541   500   NtWaitForSingleObject  (356, 0, 0x0, ...
 01542  1096   NtSetEventBoostPriority  (284, ...
 01543  1676   NtWaitForSingleObject  (284, 0, 0x0, ...
 01544   896   NtResumeThread  (376, ...
 01526  1620   NtWaitForSingleObject  ... ) == 0x0
 01544   896   NtResumeThread  ... 1, ) == 0x0
 01545  1620   NtSetEventBoostPriority  (284, ...
 01546   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01543  1676   NtWaitForSingleObject  ... ) == 0x0
 01545  1620   NtSetEventBoostPriority  ... ) == 0x0
 01547  1676   NtWaitForSingleObject  (356, 0, 0x0, ...
 01546   896   NtAllocateVirtualMemory  ... 44892160, 1048576, ) == 0x0
 01548  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01549   896   NtAllocateVirtualMemory  (-1, 45932544, 0, 8192, 4096, 4, ...
 01542  1096   NtSetEventBoostPriority  ... ) == 0x0
 01550  1308   NtWaitForSingleObject  (356, 0, 0x0, ...
 01551  1296   NtTestAlert  (...
 01549   896   NtAllocateVirtualMemory  ... 45932544, 8192, ) == 0x0
 01548  1620   NtDuplicateObject  ... 384, ) == 0x0
 01551  1296   NtTestAlert  ... ) == 0x0
 01552  1096   NtSetEventBoostPriority  (356, ...
 01553  1620   NtWaitForSingleObject  (356, 0, 0x0, ...
 01554  1296   NtContinue  (44891440, 1, ...
 01462  1732   NtWaitForSingleObject  ... ) == 0x0
 01552  1096   NtSetEventBoostPriority  ... ) == 0x0
 01555  1732   NtSetEventBoostPriority  (356, ...
 01556  1296   NtRegisterThreadTerminatePort  (24, ...
 01464  2016   NtWaitForSingleObject  ... ) == 0x0
 01555  1732   NtSetEventBoostPriority  ... ) == 0x0
 01557  1096   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01558  2016   NtSetEventBoostPriority  (356, ...
 01556  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 01559   896   NtProtectVirtualMemory  (-1, (0x2bce000), 4096, 260, ...
 01460  1300   NtWaitForSingleObject  ... ) == 0x0
 01558  2016   NtSetEventBoostPriority  ... ) == 0x0
 01557  1096   NtWaitForSingleObject  ... ) == 0x102
 01560  1732   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01561  1300   NtSetEventBoostPriority  (356, ...
 01559   896   NtProtectVirtualMemory  ... (0x2bce000), 4096, 4, ) == 0x0
 01562  1296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01563  1096   NtWaitForSingleObject  (124, 0, 0x0, ...
 01469  1324   NtWaitForSingleObject  ... ) == 0x0
 01560  1732   NtWaitForSingleObject  ... ) == 0x102
 01564   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01562  1296   NtDuplicateObject  ... 388, ) == 0x0
 01561  1300   NtSetEventBoostPriority  ... ) == 0x0
 01565  2016   NtWaitForSingleObject  (356, 0, 0x0, ...
 01566  1324   NtSetEventBoostPriority  (356, ...
 01567  1732   NtWaitForSingleObject  (124, 0, 0x0, ...
 01564   896   NtCreateThread  ... 392, {1252, 440}, ) == 0x0
 01568  1296   NtWaitForSingleObject  (356, 0, 0x0, ...
 01569  1300   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01473   252   NtWaitForSingleObject  ... ) == 0x0
 01570   896   NtQueryInformationThread  (392, Basic, 28, ...
 01571   252   NtSetEventBoostPriority  (356, ...
 01570   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 01475  1948   NtWaitForSingleObject  ... ) == 0x0
 01571   252   NtSetEventBoostPriority  ... ) == 0x0
 01566  1324   NtSetEventBoostPriority  ... ) == 0x0
 01569  1300   NtWaitForSingleObject  ... ) == 0x102
 01572  1948   NtSetEventBoostPriority  (356, ...
 01573   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\270\1\0\0" ...  ...
 01574  1324   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01471   748   NtWaitForSingleObject  ... ) == 0x0
 01572  1948   NtSetEventBoostPriority  ... ) == 0x0
 01575  1300   NtWaitForSingleObject  (124, 0, 0x0, ...
 01573   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81870, 0}  ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 01576   748   NtSetEventBoostPriority  (356, ...
 01574  1324   NtWaitForSingleObject  ... ) == 0x102
 01577   252   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01498   248   NtWaitForSingleObject  ... ) == 0x0
 01578   896   NtResumeThread  (392, ...
 01579  1324   NtWaitForSingleObject  (124, 0, 0x0, ...
 01577   252   NtWaitForSingleObject  ... ) == 0x102
 01580   248   NtSetEventBoostPriority  (356, ...
 01578   896   NtResumeThread  ... 1, ) == 0x0
 01581   252   NtWaitForSingleObject  (124, 0, 0x0, ...
 01509   900   NtWaitForSingleObject  ... ) == 0x0
 01580   248   NtSetEventBoostPriority  ... ) == 0x0
 01582   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01583   900   NtSetEventBoostPriority  (356, ...
 01584   248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01576   748   NtSetEventBoostPriority  ... ) == 0x0
 01585  1948   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01586   440   NtTestAlert  (...
 01511   384   NtWaitForSingleObject  ... ) == 0x0
 01583   900   NtSetEventBoostPriority  ... ) == 0x0
 01582   896   NtAllocateVirtualMemory  ... 45940736, 1048576, ) == 0x0
 01587   748   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01585  1948   NtWaitForSingleObject  ... ) == 0x102
 01588   384   NtSetEventBoostPriority  (356, ...
 01586   440   NtTestAlert  ... ) == 0x0
 01589   900   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01590   896   NtAllocateVirtualMemory  (-1, 46981120, 0, 8192, 4096, 4, ...
 01521  1600   NtWaitForSingleObject  ... ) == 0x0
 01588   384   NtSetEventBoostPriority  ... ) == 0x0
 01591  1948   NtWaitForSingleObject  (124, 0, 0x0, ...
 01592   440   NtContinue  (45940016, 1, ...
 01584   248   NtWaitForSingleObject  ... ) == 0x102
 01587   748   NtWaitForSingleObject  ... ) == 0x102
 01593  1600   NtSetEventBoostPriority  (356, ...
 01590   896   NtAllocateVirtualMemory  ... 46981120, 8192, ) == 0x0
 01589   900   NtWaitForSingleObject  ... ) == 0x102
 01594   440   NtRegisterThreadTerminatePort  (24, ...
 01595   248   NtWaitForSingleObject  (124, 0, 0x0, ...
 01524  1372   NtWaitForSingleObject  ... ) == 0x0
 01593  1600   NtSetEventBoostPriority  ... ) == 0x0
 01596   748   NtWaitForSingleObject  (124, 0, 0x0, ...
 01597   896   NtProtectVirtualMemory  (-1, (0x2cce000), 4096, 260, ...
 01598   900   NtWaitForSingleObject  (124, 0, 0x0, ...
 01594   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 01599  1372   NtSetEventBoostPriority  (356, ...
 01600  1600   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01597   896   NtProtectVirtualMemory  ... (0x2cce000), 4096, 4, ) == 0x0
 01601   384   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01528  1884   NtWaitForSingleObject  ... ) == 0x0
 01599  1372   NtSetEventBoostPriority  ... ) == 0x0
 01602   440   NtWaitForSingleObject  (284, 0, 0x0, ...
 01603   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01604  1884   NtWaitForSingleObject  (284, 0, 0x0, ...
 01601   384   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01605  1372   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01600  1600   NtWaitForSingleObject  ... ) == 0x102
 01606   384   NtSetEventBoostPriority  (284, ...
 01603   896   NtCreateThread  ... 396, {1252, 1588}, ) == 0x0
 01607  1600   NtWaitForSingleObject  (284, 0, 0x0, ...
 01602   440   NtWaitForSingleObject  ... ) == 0x0
 01606   384   NtSetEventBoostPriority  ... ) == 0x0
 01608   896   NtQueryInformationThread  (396, Basic, 28, ...
 01609   440   NtSetEventBoostPriority  (284, ...
 01610   384   NtWaitForSingleObject  (356, 0, 0x0, ...
 01604  1884   NtWaitForSingleObject  ... ) == 0x0
 01609   440   NtSetEventBoostPriority  ... ) == 0x0
 01608   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 01611  1884   NtSetEventBoostPriority  (284, ...
 01612   440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01607  1600   NtWaitForSingleObject  ... ) == 0x0
 01611  1884   NtSetEventBoostPriority  ... ) == 0x0
 01613   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\04\6\0\0" ...  ...
 01605  1372   NtWaitForSingleObject  ... ) == 0x102
 01614  1600   NtWaitForSingleObject  (124, 0, 0x0, ...
 01612   440   NtDuplicateObject  ... 400, ) == 0x0
 01613   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81871, 0}  ... {28, 56, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 01615  1372   NtWaitForSingleObject  (124, 0, 0x0, ...
 01616   440   NtWaitForSingleObject  (356, 0, 0x0, ...
 01617  1884   NtSetEventBoostPriority  (356, ...
 01531  1776   NtWaitForSingleObject  ... ) == 0x0
 01618  1776   NtSetEventBoostPriority  (356, ...
 01538  2036   NtWaitForSingleObject  ... ) == 0x0
 01619  2036   NtSetEventBoostPriority  (356, ...
 01539  1388   NtWaitForSingleObject  ... ) == 0x0
 01620  1388   NtSetEventBoostPriority  (356, ...
 01541   500   NtWaitForSingleObject  ... ) == 0x0
 01621   500   NtSetEventBoostPriority  (356, ...
 01547  1676   NtWaitForSingleObject  ... ) == 0x0
 01622  1676   NtSetEventBoostPriority  (356, ...
 01550  1308   NtWaitForSingleObject  ... ) == 0x0
 01623  1308   NtSetEventBoostPriority  (356, ...
 01553  1620   NtWaitForSingleObject  ... ) == 0x0
 01624  1620   NtSetEventBoostPriority  (356, ...
 01565  2016   NtWaitForSingleObject  ... ) == 0x0
 01625  2016   NtSetEventBoostPriority  (356, ...
 01568  1296   NtWaitForSingleObject  ... ) == 0x0
 01626  1296   NtSetEventBoostPriority  (356, ...
 01610   384   NtWaitForSingleObject  ... ) == 0x0
 01627   384   NtSetEventBoostPriority  (356, ...
 01616   440   NtWaitForSingleObject  ... ) == 0x0
 01628   440   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01627   384   NtSetEventBoostPriority  ... ) == 0x0
 01626  1296   NtSetEventBoostPriority  ... ) == 0x0
 01625  2016   NtSetEventBoostPriority  ... ) == 0x0
 01624  1620   NtSetEventBoostPriority  ... ) == 0x0
 01623  1308   NtSetEventBoostPriority  ... ) == 0x0
 01622  1676   NtSetEventBoostPriority  ... ) == 0x0
 01621   500   NtSetEventBoostPriority  ... ) == 0x0
 01620  1388   NtSetEventBoostPriority  ... ) == 0x0
 01619  2036   NtSetEventBoostPriority  ... ) == 0x0
 01618  1776   NtSetEventBoostPriority  ... ) == 0x0
 01617  1884   NtSetEventBoostPriority  ... ) == 0x0
 01629   896   NtResumeThread  (396, ...
 01628   440   NtWaitForSingleObject  ... ) == 0x102
 01630   384   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01631  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11071600, ... }, 11071600, ...
 01632  1296   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01633  1308   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01634  1620   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01635  1676   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01636  1388   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01637  2036   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01638   500   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01639  1884   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01629   896   NtResumeThread  ... 1, ) == 0x0
 01640   440   NtWaitForSingleObject  (124, 0, 0x0, ...
 01630   384   NtOpenFile  ... 404, {status=0x0, info=0}, ) == 0x0
 01641  1776   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01642  1588   NtWaitForSingleObject  (88, 0, 0x0, ...
 01632  1296   NtWaitForSingleObject  ... ) == 0x102
 01631  2016   NtQueryAttributesFile  ... ) == 0x0
 01634  1620   NtWaitForSingleObject  ... ) == 0x102
 01635  1676   NtWaitForSingleObject  ... ) == 0x102
 01633  1308   NtWaitForSingleObject  ... ) == 0x102
 01636  1388   NtWaitForSingleObject  ... ) == 0x102
 01638   500   NtWaitForSingleObject  ... ) == 0x102
 01639  1884   NtWaitForSingleObject  ... ) == 0x102
 01643   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01644   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\352m\4\373/\324\230\12v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01641  1776   NtWaitForSingleObject  ... ) == 0x102
 01645  1296   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01646  2016   NtSetEventBoostPriority  (88, ...
 01647  1620   NtWaitForSingleObject  (284, 0, 0x0, ...
 01648  1676   NtWaitForSingleObject  (284, 0, 0x0, ...
 01649  1308   NtWaitForSingleObject  (284, 0, 0x0, ...
 01650  1388   NtWaitForSingleObject  (284, 0, 0x0, ...
 01651   500   NtWaitForSingleObject  (284, 0, 0x0, ...
 01652  1884   NtWaitForSingleObject  (284, 0, 0x0, ...
 01643   896   NtAllocateVirtualMemory  ... 46989312, 1048576, ) == 0x0
 01653   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01654  1776   NtWaitForSingleObject  (284, 0, 0x0, ...
 01645  1296   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01642  1588   NtWaitForSingleObject  ... ) == 0x0
 01646  2016   NtSetEventBoostPriority  ... ) == 0x0
 01637  2036   NtWaitForSingleObject  ... ) == 0x102
 01655   896   NtAllocateVirtualMemory  (-1, 48029696, 0, 8192, 4096, 4, ...
 01653   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01656  1588   NtTestAlert  (...
 01657  1296   NtSetEventBoostPriority  (284, ...
 01658  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01659  2036   NtWaitForSingleObject  (284, 0, 0x0, ...
 01655   896   NtAllocateVirtualMemory  ... 48029696, 8192, ) == 0x0
 01656  1588   NtTestAlert  ... ) == 0x0
 01660   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01658  2016   NtOpenKey  ... 408, ) == 0x0
 01647  1620   NtWaitForSingleObject  ... ) == 0x0
 01657  1296   NtSetEventBoostPriority  ... ) == 0x0
 01661   896   NtProtectVirtualMemory  (-1, (0x2dce000), 4096, 260, ...
 01662  1588   NtContinue  (46988592, 1, ...
 01663  2016   NtQueryValueKey  (408,  (408, "Transports", Partial, 144, ... , Partial, 144, ...
 01664  1620   NtSetEventBoostPriority  (284, ...
 01665  1296   NtWaitForSingleObject  (124, 0, 0x0, ...
 01661   896   NtProtectVirtualMemory  ... (0x2dce000), 4096, 4, ) == 0x0
 01666  1588   NtRegisterThreadTerminatePort  (24, ...
 01660   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01648  1676   NtWaitForSingleObject  ... ) == 0x0
 01664  1620   NtSetEventBoostPriority  ... ) == 0x0
 01667   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01666  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01668  1676   NtSetEventBoostPriority  (284, ...
 01669   384   NtQuerySystemInformation  (Performance, 312, ...
 01663  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01667   896   NtCreateThread  ... 412, {1252, 2044}, ) == 0x0
 01649  1308   NtWaitForSingleObject  ... ) == 0x0
 01668  1676   NtSetEventBoostPriority  ... ) == 0x0
 01670  1588   NtWaitForSingleObject  (284, 0, 0x0, ...
 01669   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01671  2016   NtQueryValueKey  (408,  (408, "Transports", Partial, 144, ... , Partial, 144, ...
 01672  1308   NtSetEventBoostPriority  (284, ...
 01673   896   NtQueryInformationThread  (412, Basic, 28, ...
 01674  1620   NtWaitForSingleObject  (124, 0, 0x0, ...
 01675   384   NtQuerySystemInformation  (Exception, 16, ...
 01650  1388   NtWaitForSingleObject  ... ) == 0x0
 01672  1308   NtSetEventBoostPriority  ... ) == 0x0
 01671  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01673   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 01676  1388   NtSetEventBoostPriority  (284, ...
 01675   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01677  1676   NtWaitForSingleObject  (124, 0, 0x0, ...
 01678  2016   NtClose  (408, ...
 01679  1308   NtWaitForSingleObject  (124, 0, 0x0, ...
 01651   500   NtWaitForSingleObject  ... ) == 0x0
 01676  1388   NtSetEventBoostPriority  ... ) == 0x0
 01680   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01678  2016   NtClose  ... ) == 0x0
 01681   500   NtSetEventBoostPriority  (284, ...
 01682   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\374\7\0\0" ...  ...
 01683  1388   NtWaitForSingleObject  (124, 0, 0x0, ...
 01654  1776   NtWaitForSingleObject  ... ) == 0x0
 01681   500   NtSetEventBoostPriority  ... ) == 0x0
 01684  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01682   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81872, 0}  ... {28, 56, reply, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 01685  1776   NtSetEventBoostPriority  (284, ...
 01680   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01686   500   NtWaitForSingleObject  (124, 0, 0x0, ...
 01652  1884   NtWaitForSingleObject  ... ) == 0x0
 01685  1776   NtSetEventBoostPriority  ... ) == 0x0
 01687   896   NtResumeThread  (412, ...
 01688   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01689  1884   NtSetEventBoostPriority  (284, ...
 01684  2016   NtOpenKey  ... 408, ) == 0x0
 01687   896   NtResumeThread  ... 1, ) == 0x0
 01659  2036   NtWaitForSingleObject  ... ) == 0x0
 01688   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01690  2016   NtQueryValueKey  (408,  (408, "Mapping", Partial, 144, ... , Partial, 144, ...
 01691   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01692  2036   NtSetEventBoostPriority  (284, ...
 01693   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01690  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01689  1884   NtSetEventBoostPriority  ... ) == 0x0
 01694  1776   NtWaitForSingleObject  (124, 0, 0x0, ...
 01695  2044   NtTestAlert  (...
 01670  1588   NtWaitForSingleObject  ... ) == 0x0
 01692  2036   NtSetEventBoostPriority  ... ) == 0x0
 01693   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01696  2016   NtWaitForSingleObject  (284, 0, 0x0, ...
 01697  1884   NtWaitForSingleObject  (124, 0, 0x0, ...
 01698  1588   NtSetEventBoostPriority  (284, ...
 01695  2044   NtTestAlert  ... ) == 0x0
 01691   896   NtAllocateVirtualMemory  ... 48037888, 1048576, ) == 0x0
 01699   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01696  2016   NtWaitForSingleObject  ... ) == 0x0
 01698  1588   NtSetEventBoostPriority  ... ) == 0x0
 01700  2044   NtContinue  (48037168, 1, ...
 01701   896   NtAllocateVirtualMemory  (-1, 49078272, 0, 8192, 4096, 4, ...
 01702  2036   NtWaitForSingleObject  (124, 0, 0x0, ...
 01703  2016   NtQueryValueKey  (408,  (408, "Mapping", Partial, 144, ... , Partial, 144, ...
 01699   384   NtCreateKey  ... -2147482756, 2, ) == 0x0
 01704  2044   NtRegisterThreadTerminatePort  (24, ...
 01701   896   NtAllocateVirtualMemory  ... 49078272, 8192, ) == 0x0
 01703  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01705   384   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "0\177\213=U\13\343\307\214Q\351k*\262\332\276\310\337\303\226\314S\200\240F\277\252O\34\5\343\13\336C\337#\177[:_.\211\362J\332\374\223\211]\222\361o\4y\212%\177\231o#\224\346\370\242%\363\242\335\337\310mC\306q0\335\304X\242", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "0\177\213=U\13\343\307\214Q\351k*\262\332\276\310\337\303\226\314S\200\240F\277\252O\34\5\343\13\336C\337#\177[:_.\211\362J\332\374\223\211]\222\361o\4y\212%\177\231o#\224\346\370\242%\363\242\335\337\310mC\306q0\335\304X\242", 80, ... , 80, ...
 01704  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 01706   896   NtProtectVirtualMemory  (-1, (0x2ece000), 4096, 260, ...
 01707  1588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01705   384   NtSetValueKey  ... ) == 0x0
 01708  2016   NtQueryValueKey  (408,  (408, "Mapping", Partial, 152, ... , Partial, 152, ...
 01706   896   NtProtectVirtualMemory  ... (0x2ece000), 4096, 4, ) == 0x0
 01707  1588   NtDuplicateObject  ... 416, ) == 0x0
 01709   384   NtClose  (-2147482756, ...
 01708  2016   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01711  1588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01709   384   NtClose  ... ) == 0x0
 01712  2016   NtClose  (408, ...
 01713  2044   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01711  1588   NtWaitForSingleObject  ... ) == 0x102
 01644   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "W}\343K\321h\231\247-f\35>V\365\37.y\227j\321\312\210G\32:\351\362ng\206\244t\340r\350\220]\335\365(\361\321\340\261\247\363I[2TO\270\214\356\365h\365\342c\20\312\2335\343or\22\300P%\323/\271\333mbp\266\256b\274\2\236(W\301\360\207\262F\315\232T\277\301\351l<\340\371\260B\340\250\234\305J\312\237\325\241\375\32}V\31*\273\212\253\206ND\237\225\341\241c\23y\364>)\265\12\204\203\345\342\257u\241\313\254C\237?\372E\317\307\34V\376\321\344O!N\217>\220\311\241@\365\305\303\30T\347\25\231\30Y6\340\336W7\212\377\335r\321H\26u\\254(S\236\251^\22\263R\376\202\236Y\235\226\250]q5\334N\200\204\354\357\364T\350\244\25m\216\306aM\221\3558\273\252Q\370\30334\253\303<\31m\325\366(\362\232\260\334\356\21uv\217\3109\314", ) , ) == 0x0
 01712  2016   NtClose  ... ) == 0x0
 01713  2044   NtDuplicateObject  ... 408, ) == 0x0
 01714  1588   NtWaitForSingleObject  (124, 0, 0x0, ...
 01710   896   NtCreateThread  ... 420, {1252, 588}, ) == 0x0
 01715  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01716  2044   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01717   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01718   896   NtQueryInformationThread  (420, Basic, 28, ...
 01715  2016   NtOpenKey  ... 424, ) == 0x0
 01716  2044   NtWaitForSingleObject  ... ) == 0x102
 01717   384   NtCreateEvent  ... 428, ) == 0x0
 01718   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 01719  2044   NtWaitForSingleObject  (124, 0, 0x0, ...
 01720   384   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15527428, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15527428, 188, ...
 01721   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0L\2\0\0" ...  ...
 01722  2016   NtQueryValueKey  (424,  (424, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01721   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81874, 0}  ... {28, 56, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 01722  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01720   384   NtConnectPort  ... 432, 0x0, 0x0, 0x0, 188, ) == 0x0
 01723  2016   NtQueryValueKey  (424,  (424, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01724   384   NtRequestWaitReplyPort  (432, {200, 224, new_msg, 0, 1384032, 12, 2, 1}  (432, {200, 224, new_msg, 0, 1384032, 12, 2, 1} "\0\3\24\0\274\0\0\0\4>\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0p\3\24\0\4\0\0\0\1\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\1\0\0\0\222\237\22\255\210w\2466\340\35\25\0d\1\24\0\12\0\0\0\0\0\0\0\0\0\0\200(\0\0\0\350\35\25\0\10\33\352\262\230\3\24\0\10\36\25\0`\1\24\0\0\0\0\0\0\0\0\0\10\36\25\0P\0\0\0\20\36\25\0\360\6\221|p\3\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\354\0\372\31\221|\30\364\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01723  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01725   896   NtResumeThread  (420, ...
 01726  2016   NtQueryValueKey  (424,  (424, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 01725   896   NtResumeThread  ... 1, ) == 0x0
 01726  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01727   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01724   384   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 384, 81875, 0}  ... {200, 224, reply, 0, 1252, 384, 81875, 0} "\7\3\24\0\274\0\0\0\4>\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\1\0\0\0\222\237\22\255\210w\2466\340\35\25\0d\1\24\0\12\0\0\0\0\0\0\0\0\0\0\200(\0\0\0\350\35\25\0\10\33\352\262\230\3\24\0\10\36\25\0`\1\24\0\0\0\0\0\0\0\0\0\10\36\25\0P\0\0\0\20\36\25\0\360\6\221|p\3\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\354\0\372\31\221|\30\364\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01728   588   NtTestAlert  (...
 01727   896   NtAllocateVirtualMemory  ... 49086464, 1048576, ) == 0x0
 01729   384   NtRequestWaitReplyPort  (432, {64, 88, new_msg, 0, 0, 0, 0, 0}  (432, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 01728   588   NtTestAlert  ... ) == 0x0
 01730   896   NtAllocateVirtualMemory  (-1, 50126848, 0, 8192, 4096, 4, ...
 01731   588   NtContinue  (49085744, 1, ...
 01730   896   NtAllocateVirtualMemory  ... 50126848, 8192, ) == 0x0
 01732   588   NtRegisterThreadTerminatePort  (24, ...
 01733  2016   NtQueryValueKey  (424,  (424, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01729   384   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 384, 81876, 0}  ... {52, 76, reply, 0, 1252, 384, 81876, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 01732   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01733  2016   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01734   384   NtClose  (428, ...
 01735   896   NtProtectVirtualMemory  (-1, (0x2fce000), 4096, 260, ...
 01736  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11072556, ... }, 11072556, ...
 01737   588   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 01735   896   NtProtectVirtualMemory  ... (0x2fce000), 4096, 4, ) == 0x0
 01736  2016   NtQueryAttributesFile  ... ) == 0x0
 01737   588   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 01738   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01739  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01740   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01738   896   NtCreateThread  ... 436, {1252, 1652}, ) == 0x0
 01739  2016   NtOpenFile  ... 440, {status=0x0, info=1}, ) == 0x0
 01740   588   NtDuplicateObject  ... 444, ) == 0x0
 01741   896   NtQueryInformationThread  (436, Basic, 28, ...
 01734   384   NtClose  ... ) == 0x0
 01742   588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01741   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 01743   384   NtClose  (432, ...
 01742   588   NtWaitForSingleObject  ... ) == 0x102
 01744  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 440, ...
 01743   384   NtClose  ... ) == 0x0
 01745   588   NtWaitForSingleObject  (124, 0, 0x0, ...
 01744  2016   NtCreateSection  ... 432, ) == 0x0
 01746   384   NtWaitForSingleObject  (88, 0, 0x0, ...
 01747  2016   NtClose  (440, ... ) == 0x0
 01748  2016   NtMapViewOfSection  (432, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x860000), 0x0, 20480, ) == 0x0
 01749  2016   NtClose  (432, ... ) == 0x0
 01750   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0t\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0t\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81878, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0t\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 01751   896   NtResumeThread  (436, ... 1, ) == 0x0
 01752   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01753  2016   NtUnmapViewOfSection  (-1, 0x860000, ...
 01754  1652   NtWaitForSingleObject  (88, 0, 0x0, ...
 01753  2016   NtUnmapViewOfSection  ... ) == 0x0
 01752   896   NtAllocateVirtualMemory  ... 50135040, 1048576, ) == 0x0
 01755   896   NtAllocateVirtualMemory  (-1, 51175424, 0, 8192, 4096, 4, ... 51175424, 8192, ) == 0x0
 01756   896   NtProtectVirtualMemory  (-1, (0x30ce000), 4096, 260, ... (0x30ce000), 4096, 4, ) == 0x0
 01757   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 432, {1252, 1376}, ) == 0x0
 01758   896   NtQueryInformationThread  (432, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 01759   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0`\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 01760  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11072864, ... ) }, 11072864, ... ) == 0x0
 01761  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 440, {status=0x0, info=1}, ) }, 5, 96, ... 440, {status=0x0, info=1}, ) == 0x0
 01762  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 440, ... 428, ) == 0x0
 01763  2016   NtQuerySection  (428, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01764  2016   NtClose  (440, ... ) == 0x0
 01765  2016   NtMapViewOfSection  (428, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01766   896   NtResumeThread  (432, ... 1, ) == 0x0
 01767   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 51183616, 1048576, ) == 0x0
 01768   896   NtAllocateVirtualMemory  (-1, 52224000, 0, 8192, 4096, 4, ... 52224000, 8192, ) == 0x0
 01769   896   NtProtectVirtualMemory  (-1, (0x31ce000), 4096, 260, ... (0x31ce000), 4096, 4, ) == 0x0
 01770   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 440, {1252, 1436}, ) == 0x0
 01771   896   NtQueryInformationThread  (440, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 01772  2016   NtClose  (428, ...
 01773  1376   NtWaitForSingleObject  (88, 0, 0x0, ...
 01772  2016   NtClose  ... ) == 0x0
 01774  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ... (0x71a91000), 4096, 32, ) == 0x0
 01775  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 01776  2016   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 01777   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0\234\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81880, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 01778   896   NtResumeThread  (440, ... 1, ) == 0x0
 01779   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01780  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... }, ...
 01781  1436   NtWaitForSingleObject  (88, 0, 0x0, ...
 01780  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01782  2016   NtSetEventBoostPriority  (88, ...
 01746   384   NtWaitForSingleObject  ... ) == 0x0
 01783   384   NtSetEventBoostPriority  (88, ...
 01754  1652   NtWaitForSingleObject  ... ) == 0x0
 01784  1652   NtSetEventBoostPriority  (88, ...
 01773  1376   NtWaitForSingleObject  ... ) == 0x0
 01785  1376   NtSetEventBoostPriority  (88, ...
 01781  1436   NtWaitForSingleObject  ... ) == 0x0
 01786  1436   NtTestAlert  (... ) == 0x0
 01785  1376   NtSetEventBoostPriority  ... ) == 0x0
 01784  1652   NtSetEventBoostPriority  ... ) == 0x0
 01783   384   NtSetEventBoostPriority  ... ) == 0x0
 01782  2016   NtSetEventBoostPriority  ... ) == 0x0
 01779   896   NtAllocateVirtualMemory  ... 52232192, 1048576, ) == 0x0
 01787  1436   NtContinue  (52231472, 1, ...
 01788  1376   NtTestAlert  (...
 01789  1652   NtTestAlert  (...
 01790  2016   NtClose  (424, ...
 01791   896   NtAllocateVirtualMemory  (-1, 53272576, 0, 8192, 4096, 4, ...
 01792  1436   NtRegisterThreadTerminatePort  (24, ...
 01788  1376   NtTestAlert  ... ) == 0x0
 01789  1652   NtTestAlert  ... ) == 0x0
 01790  2016   NtClose  ... ) == 0x0
 01791   896   NtAllocateVirtualMemory  ... 53272576, 8192, ) == 0x0
 01792  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 01793  1376   NtContinue  (51182896, 1, ...
 01794  1652   NtContinue  (50134320, 1, ...
 01795   384   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01796   896   NtProtectVirtualMemory  (-1, (0x32ce000), 4096, 260, ...
 01797  1436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01798  1376   NtRegisterThreadTerminatePort  (24, ...
 01799  1652   NtRegisterThreadTerminatePort  (24, ...
 01795   384   NtCreateKey  ... 424, 2, ) == 0x0
 01796   896   NtProtectVirtualMemory  ... (0x32ce000), 4096, 4, ) == 0x0
 01797  1436   NtDuplicateObject  ... 428, ) == 0x0
 01798  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 01799  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 01800   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01801   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01802  1436   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01803  1376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01804  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01800   384   NtOpenKey  ... 448, ) == 0x0
 01805  2016   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11075200, 67, ... }, 0x0, 0, 3, 3, 0, 11075200, 67, ...
 01801   896   NtCreateThread  ... 452, {1252, 1368}, ) == 0x0
 01802  1436   NtWaitForSingleObject  ... ) == 0x102
 01803  1376   NtDuplicateObject  ... 456, ) == 0x0
 01806   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01805  2016   NtCreateFile  ... 460, {status=0x0, info=0}, ) == 0x0
 01807   896   NtQueryInformationThread  (452, Basic, 28, ...
 01808  1436   NtWaitForSingleObject  (124, 0, 0x0, ...
 01809  1376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01806   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01810  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x1207b,  (460, 108, 0x0, 0x0, 0x1207b, "\7\0\0\0x\1\24\0\340\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 01807   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 01809  1376   NtWaitForSingleObject  ... ) == 0x102
 01804  1652   NtDuplicateObject  ... 464, ) == 0x0
 01810  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01811   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0X\5\0\0" ...  ...
 01812  1376   NtWaitForSingleObject  (124, 0, 0x0, ...
 01813  1652   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01814  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x1207b,  (460, 108, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", 16, 16, ... , 16, 16, ...
 01811   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 01813  1652   NtWaitForSingleObject  ... ) == 0x102
 01814  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01815   384   NtQueryValueKey  (424,  (424, "Hostname", Partial, 144, ... , Partial, 144, ...
 01816  1652   NtWaitForSingleObject  (124, 0, 0x0, ...
 01817   896   NtResumeThread  (452, ...
 01815   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01817   896   NtResumeThread  ... 1, ) == 0x0
 01818   384   NtQueryValueKey  (424,  (424, "Hostname", Partial, 144, ... , Partial, 144, ...
 01819   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01818   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01819   896   NtAllocateVirtualMemory  ... 53280768, 1048576, ) == 0x0
 01820   384   NtClose  (424, ...
 01821   896   NtAllocateVirtualMemory  (-1, 54321152, 0, 8192, 4096, 4, ...
 01820   384   NtClose  ... ) == 0x0
 01821   896   NtAllocateVirtualMemory  ... 54321152, 8192, ) == 0x0
 01822  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x12047,  (460, 108, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 01823  1368   NtTestAlert  (...
 01824   384   NtClose  (448, ...
 01822  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 01823  1368   NtTestAlert  ... ) == 0x0
 01824   384   NtClose  ... ) == 0x0
 01825  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ...
 01826  1368   NtContinue  (53280048, 1, ...
 01827   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\356\30g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\356\30g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 01825  2016   NtWaitForSingleObject  ... ) == 0x102
 01828  1368   NtRegisterThreadTerminatePort  (24, ...
 01829   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01830  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x12003,  (460, 108, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 01828  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 01829   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01831   896   NtProtectVirtualMemory  (-1, (0x33ce000), 4096, 260, ...
 01830  2016   NtDeviceIoControlFile  ... {status=0x0, info=448},  ... {status=0x0, info=448}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01832   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01831   896   NtProtectVirtualMemory  ... (0x33ce000), 4096, 4, ) == 0x0
 01833  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x12047,  (460, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01834  1368   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01835   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01833  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01834  1368   NtDuplicateObject  ... 424, ) == 0x0
 01835   896   NtCreateThread  ... 468, {1252, 724}, ) == 0x0
 01836  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x12037,  (460, 108, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 01837  1368   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01838   896   NtQueryInformationThread  (468, Basic, 28, ...
 01836  2016   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01837  1368   NtWaitForSingleObject  ... ) == 0x102
 01838   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 01832   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01839  1368   NtWaitForSingleObject  (124, 0, 0x0, ...
 01840  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x1200b,  (460, 108, 0x0, 0x0, 0x1200b, "\0\376\250\0\5\0\0\0\0\256\24\0", 12, 0, ... , 12, 0, ...
 01841   384   NtQuerySystemInformation  (Performance, 312, ...
 01842   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" ...  ...
 01840  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01841   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01842   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 01843  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x12047,  (460, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\250\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01844   384   NtQuerySystemInformation  (Exception, 16, ...
 01845   896   NtResumeThread  (468, ...
 01844   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01845   896   NtResumeThread  ... 1, ) == 0x0
 01846   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01847   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01843  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01848   724   NtTestAlert  (...
 01846   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01849  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 01848   724   NtTestAlert  ... ) == 0x0
 01850   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01849  2016   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01851   724   NtContinue  (54328624, 1, ...
 01850   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01852  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01853   724   NtRegisterThreadTerminatePort  (24, ...
 01854   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01852  2016   NtCreateEvent  ... 472, ) == 0x0
 01853   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 01854   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01855  2016   NtWaitForSingleObject  (472, 0, 0x0, ...
 01847   896   NtAllocateVirtualMemory  ... 54329344, 1048576, ) == 0x0
 01856   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01857   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01858   896   NtAllocateVirtualMemory  (-1, 55369728, 0, 8192, 4096, 4, ...
 01857   724   NtDuplicateObject  ... 476, ) == 0x0
 01858   896   NtAllocateVirtualMemory  ... 55369728, 8192, ) == 0x0
 01859   724   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01860   896   NtProtectVirtualMemory  (-1, (0x34ce000), 4096, 260, ...
 01859   724   NtWaitForSingleObject  ... ) == 0x102
 01860   896   NtProtectVirtualMemory  ... (0x34ce000), 4096, 4, ) == 0x0
 01861   724   NtWaitForSingleObject  (124, 0, 0x0, ...
 01862   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01856   384   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01863   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "I\362\237\33\317\321\214\32`\340/`;\25\324H\364\203<\317\350i\350\33\11%Fx\324?\\363\220\37b\225z\237\262\250\307\356\4t]\233\246\264\3005\34dA\2061\305\313\11\336|\21\340\56\243r\12\204\235"\2502\32h\373\6\362\351\263\201", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "I\362\237\33\317\321\214\32`\340/`;\25\324H\364\203<\317\350i\350\33\11%Fx\324?\\363\220\37b\225z\237\262\250\307\356\4t]\233\246\264\3005\34dA\2061\305\313\11\336|\21\340\56\243r\12\204\235"\2502\32h\373\6\362\351\263\201", 80, ... ) \2502\32h\373\6\362\351\263\201", 80, ... ) == 0x0
 01864   384   NtClose  (-2147481484, ... ) == 0x0
 01827   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\12RG(\324\374\346H\341S=?\356\214!`=|\263\207\35\26\200\225\7\307\25\3403\11\201\3142\327\205\353\177\271\247,o\336\215\13\24Y\330\34\34\16}ru4\342\264]/\347\326,\350\365\274\17\305\326%i=bLw\334\263:\203\10JI\254\317j\1\255W_\33\256#\334J\23\322\361\320\212ng\375\337K\351]\224\277\177\261\344;P\34\353]Y\265l\366\205\204[\274\24\332\333\205#\310 \342\2\342I\160\350\323:uZ*\204\36\26A\205\316\317\357\345\32Y1\37\177\227Mh*kV\227L\23\307\206~\373\202\32GR\300\206\266\4\221K =\216\265W\313\354\222\240vPS\4{9\334A!\337\21\257\373\270\320\332~\227\3\273z\256YK\335\321\375\313\37\14V\353\223\355\313\310L\3128\320d\343\33\210\211a\213\270\232\360\241cP$~2)[[\272\334K(\2\227\331\365\10g", ) , ) == 0x0
 01865   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\312\214\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\312\214\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 01866   384   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01867   384   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01868   384   NtQuerySystemInformation  (Performance, 312, ...
 01862   896   NtCreateThread  ... 480, {1252, 1276}, ) == 0x0
 01869   896   NtQueryInformationThread  (480, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 01870   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 01871   896   NtResumeThread  (480, ... 1, ) == 0x0
 01872   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 55377920, 1048576, ) == 0x0
 01873   896   NtAllocateVirtualMemory  (-1, 56418304, 0, 8192, 4096, 4, ... 56418304, 8192, ) == 0x0
 01868   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01874  1276   NtTestAlert  (...
 01875   384   NtQuerySystemInformation  (Exception, 16, ...
 01874  1276   NtTestAlert  ... ) == 0x0
 01875   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01876  1276   NtContinue  (55377200, 1, ...
 01877   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01878  1276   NtRegisterThreadTerminatePort  (24, ...
 01877   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01878  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 01879   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01880   896   NtProtectVirtualMemory  (-1, (0x35ce000), 4096, 260, ...
 01881  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01880   896   NtProtectVirtualMemory  ... (0x35ce000), 4096, 4, ) == 0x0
 01881  1276   NtDuplicateObject  ... 484, ) == 0x0
 01882   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01883  1276   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01882   896   NtCreateThread  ... 488, {1252, 220}, ) == 0x0
 01883  1276   NtWaitForSingleObject  ... ) == 0x102
 01884   896   NtQueryInformationThread  (488, Basic, 28, ...
 01885  1276   NtWaitForSingleObject  (124, 0, 0x0, ...
 01884   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 01879   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01886   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01887   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01888   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "e\364\343d\215g\362>%\15@z\27\266?\212&T\370\37\2101#X\227\215\16\330\246\204\275\376\265\317P\365\245\20E\364W\241\12\\233\270$\375;8\324I\201\206\362yB\2065\234j:z\33\325\267\48\314\221\320\342\27;\271y\376\222\213\216", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "e\364\343d\215g\362>%\15@z\27\266?\212&T\370\37\2101#X\227\215\16\330\246\204\275\376\265\317P\365\245\20E\364W\241\12\\233\270$\375;8\324I\201\206\362yB\2065\234j:z\33\325\267\48\314\221\320\342\27;\271y\376\222\213\216", 80, ... ) , 80, ... ) == 0x0
 01889   384   NtClose  (-2147481484, ... ) == 0x0
 01865   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\377\30\310c\376n?\347\237\354%K\70\15\241\24V\361 \356\27E\352\335\300\7\B\35\30\371\212A\346\30=\223\265#\345\264I\340((~\224\303\323s=Q\266\245\21\301\302\204_N\277\305\255`\3B\361\324\33(\355\267:\252\371\37\6\356\350'LFx\2555'\371&\212\254\370\317rq\22\271bX\305&w\206\177KL\250\351w}\210\2400^\343\244\324?I\356l\23\206X\0\261\263\24kw\270\211\306\260H\17\27m2\6\245\375\374'\30\2214\351\207\212z\321\376\215\333\352.F\271\"\314\20D\23\373\11\5\220\246\216\20\\32\322\361\234\264\214\351\177\333\25\371\5o\304S\364\37Jd\206L\223\366\300\220\333\253\6[\345\357~\344\377\367\216\323\325c"H\357>jS\3028(\332]%\12\310\231p\372\213\364\206\357Z\226c\247\10\370\346-\314\303\340\7\312%@\34\17\362\35-\255\3", ) \314\20D\23\373\11\5\220\246\216\20\\32\322\361\234\264\214\351\177\333\25\371\5o\304S\364\37Jd\206L\223\366\300\220\333\253\6[\345\357~\344\377\367\216\323\325c ... {status=0x0, info=256}, "\377\30\310c\376n?\347\237\354%K\70\15\241\24V\361 \356\27E\352\335\300\7\B\35\30\371\212A\346\30=\223\265#\345\264I\340((~\224\303\323s=Q\266\245\21\301\302\204_N\277\305\255`\3B\361\324\33(\355\267:\252\371\37\6\356\350'LFx\2555'\371&\212\254\370\317rq\22\271bX\305&w\206\177KL\250\351w}\210\2400^\343\244\324?I\356l\23\206X\0\261\263\24kw\270\211\306\260H\17\27m2\6\245\375\374'\30\2214\351\207\212z\321\376\215\333\352.F\271\"\314\20D\23\373\11\5\220\246\216\20\\32\322\361\234\264\214\351\177\333\25\371\5o\304S\364\37Jd\206L\223\366\300\220\333\253\6[\345\357~\344\377\367\216\323\325c"H\357>jS\3028(\332]%\12\310\231p\372\213\364\206\357Z\226c\247\10\370\346-\314\303\340\7\312%@\34\17\362\35-\255\3", ) , ) == 0x0
 01890   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\312\214\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\312\214\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 01891   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01892   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0\334\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 01893   896   NtResumeThread  (488, ... 1, ) == 0x0
 01894   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 56426496, 1048576, ) == 0x0
 01895   896   NtAllocateVirtualMemory  (-1, 57466880, 0, 8192, 4096, 4, ... 57466880, 8192, ) == 0x0
 01896   896   NtProtectVirtualMemory  (-1, (0x36ce000), 4096, 260, ... (0x36ce000), 4096, 4, ) == 0x0
 01897   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01891   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01898   220   NtTestAlert  (...
 01899   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01898   220   NtTestAlert  ... ) == 0x0
 01899   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01900   220   NtContinue  (56425776, 1, ...
 01901   384   NtQuerySystemInformation  (Performance, 312, ...
 01902   220   NtRegisterThreadTerminatePort  (24, ...
 01901   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01902   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 01903   384   NtQuerySystemInformation  (Exception, 16, ...
 01897   896   NtCreateThread  ... 492, {1252, 1328}, ) == 0x0
 01904   220   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01905   896   NtQueryInformationThread  (492, Basic, 28, ...
 01904   220   NtDuplicateObject  ... 496, ) == 0x0
 01905   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 01906   220   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01907   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\00\5\0\0" ...  ...
 01906   220   NtWaitForSingleObject  ... ) == 0x102
 01907   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 01908   220   NtWaitForSingleObject  (124, 0, 0x0, ...
 01903   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01909   896   NtResumeThread  (492, ...
 01910   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01909   896   NtResumeThread  ... 1, ) == 0x0
 01910   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01911   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01912   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01911   896   NtAllocateVirtualMemory  ... 57475072, 1048576, ) == 0x0
 01912   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01913   896   NtAllocateVirtualMemory  (-1, 58515456, 0, 8192, 4096, 4, ...
 01914   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01913   896   NtAllocateVirtualMemory  ... 58515456, 8192, ) == 0x0
 01915  1328   NtTestAlert  (...
 01914   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01915  1328   NtTestAlert  ... ) == 0x0
 01916   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01917  1328   NtContinue  (57474352, 1, ...
 01916   384   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01918  1328   NtRegisterThreadTerminatePort  (24, ...
 01919   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "Q\10\24342m\345q\350{\240\211\334\261U\276\241\3358\276\2251W\1(\31\251\263\22\220\235\307%\322De\223\213\35\260Oy\222\227K\377\202\246\371\2358>\352\345\37O\212\373\342\31Sx\13\242\2231\217\36O\314\2\202s\35\27\361\214\265\317\12", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "Q\10\24342m\345q\350{\240\211\334\261U\276\241\3358\276\2251W\1(\31\251\263\22\220\235\307%\322De\223\213\35\260Oy\222\227K\377\202\246\371\2358>\352\345\37O\212\373\342\31Sx\13\242\2231\217\36O\314\2\202s\35\27\361\214\265\317\12", 80, ... , 80, ...
 01918  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 01919   384   NtSetValueKey  ... ) == 0x0
 01920   896   NtProtectVirtualMemory  (-1, (0x37ce000), 4096, 260, ...
 01921   384   NtClose  (-2147481484, ...
 01920   896   NtProtectVirtualMemory  ... (0x37ce000), 4096, 4, ) == 0x0
 01922  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01923   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01922  1328   NtDuplicateObject  ... 500, ) == 0x0
 01923   896   NtCreateThread  ... 504, {1252, 1636}, ) == 0x0
 01924  1328   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 01925   896   NtQueryInformationThread  (504, Basic, 28, ...
 01924  1328   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 01925   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 01926  1328   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01921   384   NtClose  ... ) == 0x0
 01890   384   NtDeviceIoControlFile  ... {status=0x0, info=256}, " ... {status=0x0, info=256}, ""\235$!\263K\230\222\300\344\262Z\205\277=\7\331\4`\3530\24\313\377\3\327W\267m%\2\5f\317L\373\254\0\26m\336\15\223$\2301?\243\365\321\221\272\204\213\205\10}\37P\340Jm\37\231\356Hh\6\2130\274E\255\210\353\255\322\17\340S\5\330\340\232\312]\220\240\377\205\271\321\336[fq\344Q\205\360\375\202Q\6VX\20Me\37?\245\322\375\25{`\251E\21\264\216\27]]\206"G\2\245\355\325\300\215\322\333\300\20H\363g\322\371\245\37\357\15\244\312n\371u\334\247bAH2R \203\362\23\300v\207\201w\177\216\335\347J\245\363\344\212=\35\15I\351\3566Q\350'\15\374\377\323j\202}\365\357\264"\307\10\233N\12\31\346\212&%\33m\355\17\15\316\261\177\333\375\334\316\4\2618\251\217\A5\331?\304)\344qV\267\1\25\34\265\251\24.\311\34@\325gp\240\205\373\342S", ) G\2\245\355\325\300\215\322\333\300\20H\363g\322\371\245\37\357\15\244\312n\371u\334\247bAH2R \203\362\23\300v\207\201w\177\216\335\347J\245\363\344\212=\35\15I\351\3566Q\350'\15\374\377\323j\202}\365\357\264 ... {status=0x0, info=256}, ""\235$!\263K\230\222\300\344\262Z\205\277=\7\331\4`\3530\24\313\377\3\327W\267m%\2\5f\317L\373\254\0\26m\336\15\223$\2301?\243\365\321\221\272\204\213\205\10}\37P\340Jm\37\231\356Hh\6\2130\274E\255\210\353\255\322\17\340S\5\330\340\232\312]\220\240\377\205\271\321\336[fq\344Q\205\360\375\202Q\6VX\20Me\37?\245\322\375\25{`\251E\21\264\216\27]]\206"G\2\245\355\325\300\215\322\333\300\20H\363g\322\371\245\37\357\15\244\312n\371u\334\247bAH2R \203\362\23\300v\207\201w\177\216\335\347J\245\363\344\212=\35\15I\351\3566Q\350'\15\374\377\323j\202}\365\357\264"\307\10\233N\12\31\346\212&%\33m\355\17\15\316\261\177\333\375\334\316\4\2618\251\217\A5\331?\304)\344qV\267\1\25\34\265\251\24.\311\34@\325gp\240\205\373\342S", ) , ) == 0x0
 01927   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 01928   384   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01929   384   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01930   384   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01931   384   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01932   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01933   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0d\6\0\0" ...  ...
 01926  1328   NtWaitForSingleObject  ... ) == 0x102
 01933   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\1\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 01934  1328   NtWaitForSingleObject  (124, 0, 0x0, ...
 01935   896   NtResumeThread  (504, ... 1, ) == 0x0
 01936   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 58523648, 1048576, ) == 0x0
 01937   896   NtAllocateVirtualMemory  (-1, 59564032, 0, 8192, 4096, 4, ... 59564032, 8192, ) == 0x0
 01938   896   NtProtectVirtualMemory  (-1, (0x38ce000), 4096, 260, ... (0x38ce000), 4096, 4, ) == 0x0
 01939   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01932   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01940  1636   NtTestAlert  (...
 01941   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01940  1636   NtTestAlert  ... ) == 0x0
 01941   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01942  1636   NtContinue  (58522928, 1, ...
 01943   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01944  1636   NtRegisterThreadTerminatePort  (24, ...
 01943   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01944  1636   NtRegisterThreadTerminatePort  ... ) == 0x0
 01945   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01939   896   NtCreateThread  ... 508, {1252, 704}, ) == 0x0
 01946  1636   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01947   896   NtQueryInformationThread  (508, Basic, 28, ...
 01946  1636   NtDuplicateObject  ... 512, ) == 0x0
 01947   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=704,}, 0x0, ) == 0x0
 01948  1636   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01949   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\300\2\0\0" ...  ...
 01948  1636   NtWaitForSingleObject  ... ) == 0x102
 01949   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\300\2\0\0" )  ) == 0x0
 01950  1636   NtWaitForSingleObject  (124, 0, 0x0, ...
 01945   384   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01951   896   NtResumeThread  (508, ...
 01952   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\333\342\200\377\250\322\326w\215\256gj\265=\17j1\252f^1\37P%\1S\6\374\203\226\2669(\335\275\360\365<\300\234\27\207\35uD\25\317\274\371\263\214\327$\260/\224D\33\313\2501\352\351\13\374(\2\3+\272\245\254XN\362W\355\300\330\277", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\333\342\200\377\250\322\326w\215\256gj\265=\17j1\252f^1\37P%\1S\6\374\203\226\2669(\335\275\360\365<\300\234\27\207\35uD\25\317\274\371\263\214\327$\260/\224D\33\313\2501\352\351\13\374(\2\3+\272\245\254XN\362W\355\300\330\277", 80, ... , 80, ...
 01951   896   NtResumeThread  ... 1, ) == 0x0
 01952   384   NtSetValueKey  ... ) == 0x0
 01953   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01954   384   NtClose  (-2147481484, ...
 01953   896   NtAllocateVirtualMemory  ... 59572224, 1048576, ) == 0x0
 01954   384   NtClose  ... ) == 0x0
 01955   896   NtAllocateVirtualMemory  (-1, 60612608, 0, 8192, 4096, 4, ...
 01927   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "A\11+\326\23\236s\316\302\308"X\236\202\247\242\212\34\200\371\15\21\155\302\331\305\332AZ[u\321\360\361\370gB/i\311zA\233R\307\255\370\10\260Y?\213\203\255\333\263n\277a\305t_\210=\235\351\364\374!\263\27\227U\\177o\1V\273E\224\321\322\359\207\265\20\45}\344-R\351\267\350u\16`b\256\240+\263\240\214\270:QLa\13\23\206\15\201\322>\15\35\351\31\305\326\372JO\320\203\17"\310P\2145\307\30\232\2418k@\372\210\224\241$\301\201\332-(a\300\267w\377\3554g\256\304\375\313*\227B\200\177\275\35\343\376wo\26\12\3159|\374\210\7\345\35_e\267\2235`\314\31\252\203i\353J\201u\316!3\252^4p\314\232\322\204p\334\30\336P\346\3704\26\231\4T\346n;\374\200\377\33\343X@\367Z\0\251Q\354^U\276t\246\5t\235\217\235\354\16\343\16", ) X\236\202\247\242\212\34\200\371\15\21\155\302\331\305\332AZ[u\321\360\361\370gB/i\311zA\233R\307\255\370\10\260Y?\213\203\255\333\263n\277a\305t_\210=\235\351\364\374!\263\27\227U\\177o\1V\273E\224\321\322\359\207\265\20\45}\344-R\351\267\350u\16`b\256\240+\263\240\214\270:QLa\13\23\206\15\201\322>\15\35\351\31\305\326\372JO\320\203\17 ... {status=0x0, info=256}, "A\11+\326\23\236s\316\302\308"X\236\202\247\242\212\34\200\371\15\21\155\302\331\305\332AZ[u\321\360\361\370gB/i\311zA\233R\307\255\370\10\260Y?\213\203\255\333\263n\277a\305t_\210=\235\351\364\374!\263\27\227U\\177o\1V\273E\224\321\322\359\207\265\20\45}\344-R\351\267\350u\16`b\256\240+\263\240\214\270:QLa\13\23\206\15\201\322>\15\35\351\31\305\326\372JO\320\203\17"\310P\2145\307\30\232\2418k@\372\210\224\241$\301\201\332-(a\300\267w\377\3554g\256\304\375\313*\227B\200\177\275\35\343\376wo\26\12\3159|\374\210\7\345\35_e\267\2235`\314\31\252\203i\353J\201u\316!3\252^4p\314\232\322\204p\334\30\336P\346\3704\26\231\4T\346n;\374\200\377\33\343X@\367Z\0\251Q\354^U\276t\246\5t\235\217\235\354\16\343\16", ) , ) == 0x0
 01955   896   NtAllocateVirtualMemory  ... 60612608, 8192, ) == 0x0
 01956   704   NtTestAlert  (...
 01957   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 01956   704   NtTestAlert  ... ) == 0x0
 01958   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01959   704   NtContinue  (59571504, 1, ...
 01958   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01960   704   NtRegisterThreadTerminatePort  (24, ...
 01961   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01960   704   NtRegisterThreadTerminatePort  ... ) == 0x0
 01961   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01962   896   NtProtectVirtualMemory  (-1, (0x39ce000), 4096, 260, ...
 01963   384   NtQuerySystemInformation  (Performance, 312, ...
 01962   896   NtProtectVirtualMemory  ... (0x39ce000), 4096, 4, ) == 0x0
 01964   704   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01965   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01964   704   NtDuplicateObject  ... 516, ) == 0x0
 01965   896   NtCreateThread  ... 520, {1252, 1152}, ) == 0x0
 01966   704   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01967   896   NtQueryInformationThread  (520, Basic, 28, ...
 01966   704   NtWaitForSingleObject  ... ) == 0x102
 01967   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 01968   704   NtWaitForSingleObject  (124, 0, 0x0, ...
 01963   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01969   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\200\4\0\0" ...  ...
 01970   384   NtQuerySystemInformation  (Exception, 16, ...
 01969   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 01970   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01971   896   NtResumeThread  (520, ...
 01972   384   NtQuerySystemInformation  (Lookaside, 32, ...
 01971   896   NtResumeThread  ... 1, ) == 0x0
 01972   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01973   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01974   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01975  1152   NtTestAlert  (...
 01973   896   NtAllocateVirtualMemory  ... 60620800, 1048576, ) == 0x0
 01975  1152   NtTestAlert  ... ) == 0x0
 01976   896   NtAllocateVirtualMemory  (-1, 61661184, 0, 8192, 4096, 4, ...
 01977  1152   NtContinue  (60620080, 1, ...
 01976   896   NtAllocateVirtualMemory  ... 61661184, 8192, ) == 0x0
 01978  1152   NtRegisterThreadTerminatePort  (24, ...
 01979   896   NtProtectVirtualMemory  (-1, (0x3ace000), 4096, 260, ...
 01978  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 01979   896   NtProtectVirtualMemory  ... (0x3ace000), 4096, 4, ) == 0x0
 01974   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01980   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01981   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01982  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01981   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01982  1152   NtDuplicateObject  ... 524, ) == 0x0
 01983   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01984  1152   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01983   384   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01984  1152   NtWaitForSingleObject  ... ) == 0x102
 01985   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\332\204\>y\16"\24\301s\350x\200_\256\302o\7\355}\213\12S\332\254\213a\305\27\3335c:\377\210\274|\260A\353\251\376\327/\25371\325:\37wZ\262\342\2051\38\364tI;Iy\366\371v\264Z\220z\236\22\262'\375p^f\207", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\332\204\>y\16"\24\301s\350x\200_\256\302o\7\355}\213\12S\332\254\213a\305\27\3335c:\377\210\274|\260A\353\251\376\327/\25371\325:\37wZ\262\342\2051\38\364tI;Iy\366\371v\264Z\220z\236\22\262'\375p^f\207", 80, ... \24\301s\350x\200_\256\302o\7\355}\213\12S\332\254\213a\305\27\3335c:\377\210\274|\260A\353\251\376\327/\25371\325:\37wZ\262\342\2051\38\364tI;Iy\366\371v\264Z\220z\236\22\262'\375p^f\207", 80, ...
 01986  1152   NtWaitForSingleObject  (124, 0, 0x0, ...
 01980   896   NtCreateThread  ... 528, {1252, 1228}, ) == 0x0
 01985   384   NtSetValueKey  ... ) == 0x0
 01987   896   NtQueryInformationThread  (528, Basic, 28, ...
 01988   384   NtClose  (-2147481484, ...
 01987   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 01988   384   NtClose  ... ) == 0x0
 01989   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0\314\4\0\0" ...  ...
 01957   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\360\16\360\300\376\\204\316.\0\301d/y"j\331\325L{\11go\311\205\10\164\254\254\215\216\16\306\271\304\279\276\22\370\373\14\210v\200;\270\25\12\201\353 \312\225\327\32g\314\13\245\263\210L\241\273\371\36\343\255X\220\345\228\330\204a\345\235\225\302\15\362\353-\303`\276\372\225\21K]9]8\235\266\20\324E\\246\227\377\277\207\307_\240\231Y\11+\314\314\375\247'\30\345\351\273*i\371r\206\347\251\7n\345\371\311\377\352\231=\1\315M9\251\20\20\313w\347\10\351\376\317\240*\255\265\221ZA\275\272\300\13\243;\362St\333Q\261B:\205\374\11\235\24\264a\31\321\314B\32\337\214]\263\372n>u"\267z\211\241\3_\7\300\211\204\376\371_\237a\315\356u=nu;X\376\371\0\257\21\0\210%\254\177\304=6r\263\311\236\240q\214\36U;\320\361\16{\353|\23Nl\255\215\260\240\374", ) j\331\325L{\11go\311\205\10\164\254\254\215\216\16\306\271\304\279\276\22\370\373\14\210v\200;\270\25\12\201\353 \312\225\327\32g\314\13\245\263\210L\241\273\371\36\343\255X\220\345\228\330\204a\345\235\225\302\15\362\353-\303`\276\372\225\21K]9]8\235\266\20\324E\\246\227\377\277\207\307_\240\231Y\11+\314\314\375\247'\30\345\351\273*i\371r\206\347\251\7n\345\371\311\377\352\231=\1\315M9\251\20\20\313w\347\10\351\376\317\240*\255\265\221ZA\275\272\300\13\243;\362St\333Q\261B:\205\374\11\235\24\264a\31\321\314B\32\337\214]\263\372n>u ... {status=0x0, info=256}, "\360\16\360\300\376\\204\316.\0\301d/y"j\331\325L{\11go\311\205\10\164\254\254\215\216\16\306\271\304\279\276\22\370\373\14\210v\200;\270\25\12\201\353 \312\225\327\32g\314\13\245\263\210L\241\273\371\36\343\255X\220\345\228\330\204a\345\235\225\302\15\362\353-\303`\276\372\225\21K]9]8\235\266\20\324E\\246\227\377\277\207\307_\240\231Y\11+\314\314\375\247'\30\345\351\273*i\371r\206\347\251\7n\345\371\311\377\352\231=\1\315M9\251\20\20\313w\347\10\351\376\317\240*\255\265\221ZA\275\272\300\13\243;\362St\333Q\261B:\205\374\11\235\24\264a\31\321\314B\32\337\214]\263\372n>u"\267z\211\241\3_\7\300\211\204\376\371_\237a\315\356u=nu;X\376\371\0\257\21\0\210%\254\177\304=6r\263\311\236\240q\214\36U;\320\361\16{\353|\23Nl\255\215\260\240\374", ) , ) == 0x0
 01989   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 01990   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 01991   384   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01992   384   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01993   384   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01994   384   NtQuerySystemInformation  (Exception, 16, ...
 01995   896   NtResumeThread  (528, ... 1, ) == 0x0
 01996   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 61669376, 1048576, ) == 0x0
 01997   896   NtAllocateVirtualMemory  (-1, 62709760, 0, 8192, 4096, 4, ... 62709760, 8192, ) == 0x0
 01998   896   NtProtectVirtualMemory  (-1, (0x3bce000), 4096, 260, ... (0x3bce000), 4096, 4, ) == 0x0
 01999   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 532, {1252, 792}, ) == 0x0
 02000   896   NtQueryInformationThread  (532, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 01994   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02001  1228   NtTestAlert  (...
 02002   384   NtQuerySystemInformation  (Lookaside, 32, ...
 02001  1228   NtTestAlert  ... ) == 0x0
 02002   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02003  1228   NtContinue  (61668656, 1, ...
 02004   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02005  1228   NtRegisterThreadTerminatePort  (24, ...
 02004   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02005  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 02006   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02007   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\30\3\0\0" ...  ...
 02008  1228   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02007   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 02008  1228   NtDuplicateObject  ... 536, ) == 0x0
 02009   896   NtResumeThread  (532, ...
 02010  1228   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02009   896   NtResumeThread  ... 1, ) == 0x0
 02010  1228   NtWaitForSingleObject  ... ) == 0x102
 02011   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02012  1228   NtWaitForSingleObject  (124, 0, 0x0, ...
 02006   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02013   792   NtTestAlert  (...
 02011   896   NtAllocateVirtualMemory  ... 62717952, 1048576, ) == 0x0
 02014   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02013   792   NtTestAlert  ... ) == 0x0
 02015   896   NtAllocateVirtualMemory  (-1, 63758336, 0, 8192, 4096, 4, ...
 02014   384   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02016   792   NtContinue  (62717232, 1, ...
 02015   896   NtAllocateVirtualMemory  ... 63758336, 8192, ) == 0x0
 02017   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\354C\336\10-\264\257\261,Xy!7\336\317p\357\24\302\352\307\211 ^u\347\333\13\224c\351\207Id2\2L\21\332\352\267RF\177\341)\3\331\274\230\177\334\273\207\203<\327N\270\231\345\13\26\333\257\242\330\247{\255\312\303aT\206\355\375+\23\360", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\354C\336\10-\264\257\261,Xy!7\336\317p\357\24\302\352\307\211 ^u\347\333\13\224c\351\207Id2\2L\21\332\352\267RF\177\341)\3\331\274\230\177\334\273\207\203<\327N\270\231\345\13\26\333\257\242\330\247{\255\312\303aT\206\355\375+\23\360", 80, ... , 80, ...
 02018   792   NtRegisterThreadTerminatePort  (24, ...
 02019   896   NtProtectVirtualMemory  (-1, (0x3cce000), 4096, 260, ...
 02017   384   NtSetValueKey  ... ) == 0x0
 02018   792   NtRegisterThreadTerminatePort  ... ) == 0x0
 02019   896   NtProtectVirtualMemory  ... (0x3cce000), 4096, 4, ) == 0x0
 02020   384   NtClose  (-2147481484, ...
 02021   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02022   792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02020   384   NtClose  ... ) == 0x0
 02022   792   NtDuplicateObject  ... 540, ) == 0x0
 01990   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "^\16\311\337\264\314\350\24\254\373\300\370\367\341\24\202x\305\255wt$\354P\305\325_t\211\201j\323_\353\26\213,6\321\301/bAm\315\342\7Ji\17)4B!|\337\221\231\20\212\207\220]c\332\200\26\201\315d#\231\262\346\311z=)h\223\3511\360\273\303%\252\371\347\257\317h\367P\322/\273\264\241fHki\273O\310\215dk\23P\23\332\243RK-5\217MO\3240\207BE"i&\277`<8\14\301\240\3\300By\0\304\274\207W\323\0Q\314\212\367wS\2\201E\12\371b>\305\230\354\233\247\215+'nj(,\362\201\11\317\336\21@2\372\220\277\7\204\364U\7\376\331KuB\255\277\237\220\263\337\2654\265\32\316\246\322y\224\251\246\31"gZ[b\210\322BkXyJ(*r\15h_\264\37j\222X\365\25-XQm\365A\33\221\0n\26k\22\267\27-|\376\356", ) i&\277`<8\14\301\240\3\300By\0\304\274\207W\323\0Q\314\212\367wS\2\201E\12\371b>\305\230\354\233\247\215+'nj(,\362\201\11\317\336\21@2\372\220\277\7\204\364U\7\376\331KuB\255\277\237\220\263\337\2654\265\32\316\246\322y\224\251\246\31 ... {status=0x0, info=256}, "^\16\311\337\264\314\350\24\254\373\300\370\367\341\24\202x\305\255wt$\354P\305\325_t\211\201j\323_\353\26\213,6\321\301/bAm\315\342\7Ji\17)4B!|\337\221\231\20\212\207\220]c\332\200\26\201\315d#\231\262\346\311z=)h\223\3511\360\273\303%\252\371\347\257\317h\367P\322/\273\264\241fHki\273O\310\215dk\23P\23\332\243RK-5\217MO\3240\207BE"i&\277`<8\14\301\240\3\300By\0\304\274\207W\323\0Q\314\212\367wS\2\201E\12\371b>\305\230\354\233\247\215+'nj(,\362\201\11\317\336\21@2\372\220\277\7\204\364U\7\376\331KuB\255\277\237\220\263\337\2654\265\32\316\246\322y\224\251\246\31"gZ[b\210\322BkXyJ(*r\15h_\264\37j\222X\365\25-XQm\365A\33\221\0n\26k\22\267\27-|\376\356", ) , ) == 0x0
 02023   792   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02024   384   NtDeviceIoControlFile  (404, 0, 0x0, 0x0, 0x390008,  (404, 0, 0x0, 0x0, 0x390008, "P|\202\300X\337\10\316\371\225#1"@\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... @\312\214\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l\34\20\366B\316:l8\204g\232\320\314\264\334\352\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 02023   792   NtWaitForSingleObject  ... ) == 0x102
 02025   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02026   792   NtWaitForSingleObject  (124, 0, 0x0, ...
 02025   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02021   896   NtCreateThread  ... 544, {1252, 1484}, ) == 0x0
 02027   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02028   896   NtQueryInformationThread  (544, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 02029   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 02030   896   NtResumeThread  (544, ... 1, ) == 0x0
 02031   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 63766528, 1048576, ) == 0x0
 02032   896   NtAllocateVirtualMemory  (-1, 64806912, 0, 8192, 4096, 4, ... 64806912, 8192, ) == 0x0
 02027   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02033  1484   NtTestAlert  (...
 02034   384   NtQuerySystemInformation  (Performance, 312, ...
 02033  1484   NtTestAlert  ... ) == 0x0
 02034   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02035  1484   NtContinue  (63765808, 1, ...
 02036   384   NtQuerySystemInformation  (Exception, 16, ...
 02037  1484   NtRegisterThreadTerminatePort  (24, ...
 02036   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02037  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 02038   384   NtQuerySystemInformation  (Lookaside, 32, ...
 02039   896   NtProtectVirtualMemory  (-1, (0x3dce000), 4096, 260, ...
 02040  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02039   896   NtProtectVirtualMemory  ... (0x3dce000), 4096, 4, ) == 0x0
 02040  1484   NtDuplicateObject  ... 548, ) == 0x0
 02041   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02042  1484   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02041   896   NtCreateThread  ... 552, {1252, 888}, ) == 0x0
 02042  1484   NtWaitForSingleObject  ... ) == 0x102
 02043   896   NtQueryInformationThread  (552, Basic, 28, ...
 02044  1484   NtWaitForSingleObject  (124, 0, 0x0, ...
 02043   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=888,}, 0x0, ) == 0x0
 02038   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02045   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02046   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 02047   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 02048   384   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\232\222\313<&\204\15E\245\276c \215@\230\326a\215#\246\253s,Wy\202l\255"f\344\224\21 \373r\373\326o$oH\301\332\323\330[|\212\250\237\310Y\363\273Y\31-\260\301\301V\305\247\253\351\217e\306\360\253Z)\217\200\263\326A\211\373", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\232\222\313<&\204\15E\245\276c \215@\230\326a\215#\246\253s,Wy\202l\255"f\344\224\21 \373r\373\326o$oH\301\332\323\330[|\212\250\237\310Y\363\273Y\31-\260\301\301V\305\247\253\351\217e\306\360\253Z)\217\200\263\326A\211\373", 80, ... ) f\344\224\21 \373r\373\326o$oH\301\332\323\330[|\212\250\237\310Y\363\273Y\31-\260\301\301V\305\247\253\351\217e\306\360\253Z)\217\200\263\326A\211\373", 80, ... ) == 0x0
 02049   384   NtClose  (-2147481484, ... ) == 0x0
 02024   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "S="/\261\245\6D\13\214t\2078F\242\322*\260\204\272\7\344o=\266n\224dt Z\327\32^\227jx!\225\226{I\243\220\261\156\226\265\305eL\252\352\242\301P}u\344Wsc\2023S\302\350\353B \324W\275\210\262af\247\264\200Tm'\331\301Qg\215\363\270\312=p\337}\34v'\274G2\264\3556=\336AXC\263\235\376\346K\373\314QA3*\315\215\302\306[\367L\226\211\217\362`L\353\260\211O\320q\316\360`+\32\341\227\224\324o \365\212\277\337\354\367\203\340-\233\355\305\274\267\2i\23[X\363\262`\13\216\334\313"p\203e\266\207\304\365\36\217\254e\314\257\354(lEm\245\230g\225\217\266\7\16MJK\264\226\12\23\307\230\277#r\14\264~Ky+\267\356\231\215\304\235,N\247\235a\352\233*\3@/\324X\300#9o\14\374\15\2212_Z@\301ob", ) /\261\245\6D\13\214t\2078F\242\322*\260\204\272\7\344o=\266n\224dt Z\327\32^\227jx!\225\226{I\243\220\261\156\226\265\305eL\252\352\242\301P}u\344Wsc\2023S\302\350\353B \324W\275\210\262af\247\264\200Tm'\331\301Qg\215\363\270\312=p\337}\34v'\274G2\264\3556=\336AXC\263\235\376\346K\373\314QA3*\315\215\302\306[\367L\226\211\217\362`L\353\260\211O\320q\316\360`+\32\341\227\224\324o \365\212\277\337\354\367\203\340-\233\355\305\274\267\2i\23[X\363\262`\13\216\334\313 ... {status=0x0, info=256}, "S="/\261\245\6D\13\214t\2078F\242\322*\260\204\272\7\344o=\266n\224dt Z\327\32^\227jx!\225\226{I\243\220\261\156\226\265\305eL\252\352\242\301P}u\344Wsc\2023S\302\350\353B \324W\275\210\262af\247\264\200Tm'\331\301Qg\215\363\270\312=p\337}\34v'\274G2\264\3556=\336AXC\263\235\376\346K\373\314QA3*\315\215\302\306[\367L\226\211\217\362`L\353\260\211O\320q\316\360`+\32\341\227\224\324o \365\212\277\337\354\367\203\340-\233\355\305\274\267\2i\23[X\363\262`\13\216\334\313"p\203e\266\207\304\365\36\217\254e\314\257\354(lEm\245\230g\225\217\266\7\16MJK\264\226\12\23\307\230\277#r\14\264~Ky+\267\356\231\215\304\235,N\247\235a\352\233*\3@/\324X\300#9o\14\374\15\2212_Z@\301ob", ) , ) == 0x0
 02050   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0x\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0x\3\0\0" )  ) == 0x0
 02051   896   NtResumeThread  (552, ... 1, ) == 0x0
 02052   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 64815104, 1048576, ) == 0x0
 02053   896   NtAllocateVirtualMemory  (-1, 65855488, 0, 8192, 4096, 4, ... 65855488, 8192, ) == 0x0
 02054   896   NtProtectVirtualMemory  (-1, (0x3ece000), 4096, 260, ... (0x3ece000), 4096, 4, ) == 0x0
 02055   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02056   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02057   888   NtTestAlert  (...
 02056   384   NtCreateEvent  ... 556, ) == 0x0
 02057   888   NtTestAlert  ... ) == 0x0
 02058   384   NtSetEventBoostPriority  (472, ...
 02059   888   NtContinue  (64814384, 1, ...
 01855  2016   NtWaitForSingleObject  ... ) == 0x0
 02058   384   NtSetEventBoostPriority  ... ) == 0x0
 02060  2016   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 02061   888   NtRegisterThreadTerminatePort  (24, ...
 02060  2016   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 02062   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02063  2016   NtSetEventBoostPriority  (284, ...
 02061   888   NtRegisterThreadTerminatePort  ... ) == 0x0
 02063  2016   NtSetEventBoostPriority  ... ) == 0x0
 02062   384   NtWaitForSingleObject  ... ) == 0x0
 02055   896   NtCreateThread  ... 560, {1252, 1120}, ) == 0x0
 02064   888   NtWaitForSingleObject  (284, 0, 0x0, ...
 02065   384   NtSetEventBoostPriority  (284, ...
 02066   896   NtQueryInformationThread  (560, Basic, 28, ...
 02064   888   NtWaitForSingleObject  ... ) == 0x0
 02065   384   NtSetEventBoostPriority  ... ) == 0x0
 02067   888   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02066   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 02067   888   NtDuplicateObject  ... 564, ) == 0x0
 02068   384   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15527276, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15527276, 188, ...
 02069   888   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02070   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0`\4\0\0" ...  ...
 02068   384   NtConnectPort  ... 568, 0x0, 0x0, 0x0, 188, ) == 0x0
 02071  2016   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ...
 02070   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81894, 0}  ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 02069   888   NtWaitForSingleObject  ... ) == 0x102
 02071  2016   NtAllocateVirtualMemory  ... 1396736, 4096, ) == 0x0
 02072   384   NtRequestWaitReplyPort  (568, {200, 224, new_msg, 0, 1384032, 12, 2, 1310721}  (568, {200, 224, new_msg, 0, 1384032, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0&\201\326\16!C\333v\360E\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\230:\25\0\243\220C\15x\1\24\0\350E\25\0h\1\24\0\0\0\0\0\0\0\0\0\350E\25\0P\0\0\0\360E\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\354\0\372\31\221|\200\363\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02073   888   NtWaitForSingleObject  (124, 0, 0x0, ...
 02074  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 572, ) == 0x0
 02075  2016   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11072120, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11072120, 188, ...
 02072   384   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 384, 81895, 0}  ... {200, 224, reply, 0, 1252, 384, 81895, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0&\201\326\16!C\333v\360E\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\230:\25\0\243\220C\15x\1\24\0\350E\25\0h\1\24\0\0\0\0\0\0\0\0\0\350E\25\0P\0\0\0\360E\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\354\0\372\31\221|\200\363\354\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02076   384   NtRequestWaitReplyPort  (568, {44, 68, new_msg, 0, 1252, 384, 81876, 0}  (568, {44, 68, new_msg, 0, 1252, 384, 81876, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 1252, 384, 81897, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\1\0\0X-\12\0" )  ... {40, 64, reply, 0, 1252, 384, 81897, 0}  (568, {44, 68, new_msg, 0, 1252, 384, 81876, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 1252, 384, 81897, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\1\0\0X-\12\0" )  ) == 0x0
 02077   384   NtRequestWaitReplyPort  (568, {64, 88, new_msg, 56, 1371536, 15527788, 15527888, 0}  (568, {64, 88, new_msg, 56, 1371536, 15527788, 15527888, 0} "\10\357\354\0@\0\24\0\346\277\347w\320\357\354\0l\357\354\0\20\0\0\0\250.\362v\4\356\24\0\1\0\0\00S\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\300\332\24\0" ...  ...
 02078   896   NtResumeThread  (560, ... 1, ) == 0x0
 02079   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 65863680, 1048576, ) == 0x0
 02080   896   NtAllocateVirtualMemory  (-1, 66904064, 0, 8192, 4096, 4, ... 66904064, 8192, ) == 0x0
 02075  2016   NtConnectPort  ... 576, 0x0, 0x0, 0x0, 188, ) == 0x0
 02077   384   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 384, 81898, 0}  ... {64, 88, reply, 56, 1252, 384, 81898, 0} "\10\357\354\0@\0\24\0\346\277\347w\320\357\354\0l\357\354\0\20\0\0\0\250.\362v\4\356\24\0\1\0\0\00S\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\300\332\24\0" )  ) == 0x0
 02081  1120   NtAllocateVirtualMemory  (-1, 8871936, 0, 4096, 4096, 4, ...
 02082  2016   NtRequestWaitReplyPort  (576, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2}  (576, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\240<\24\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0k\0\226\11}`\6\32\340R\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\270R\25\0\274\324>\6x\1\24\0\330R\25\0h\1\24\0\0\0\0\0\0\0\0\0\330R\25\0P\0\0\0\340R\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\250\0\372\31\221|\214\370\250\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 02083   384   NtClose  (556, ...
 02081  1120   NtAllocateVirtualMemory  ... 8871936, 4096, ) == 0x0
 02083   384   NtClose  ... ) == 0x0
 02084  1120   NtTestAlert  (...
 02082  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81899, 0}  ... {200, 224, reply, 0, 1252, 2016, 81899, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\240<\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0k\0\226\11}`\6\32\340R\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\270R\25\0\274\324>\6x\1\24\0\330R\25\0h\1\24\0\0\0\0\0\0\0\0\0\330R\25\0P\0\0\0\340R\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\250\0\372\31\221|\214\370\250\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 02085   384   NtClose  (568, ...
 02084  1120   NtTestAlert  ... ) == 0x0
 02086  2016   NtRequestWaitReplyPort  (576, {44, 68, new_msg, 56, 0, 0, 0, 0}  (576, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0\0X\25\0\322\0\0\0" ...  ...
 02087   896   NtProtectVirtualMemory  (-1, (0x3fce000), 4096, 260, ...
 02088  1120   NtContinue  (65862960, 1, ...
 02087   896   NtProtectVirtualMemory  ... (0x3fce000), 4096, 4, ) == 0x0
 02085   384   NtClose  ... ) == 0x0
 02089   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02090   384   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02089   896   NtCreateThread  ... 568, {1252, 840}, ) == 0x0
 02090   384   NtCreateKey  ... 556, 2, ) == 0x0
 02091   896   NtQueryInformationThread  (568, Basic, 28, ...
 02092   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02091   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 02092   384   NtOpenKey  ... 580, ) == 0x0
 02093  1120   NtRegisterThreadTerminatePort  (24, ...
 02086  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81900, 0}  ... {40, 64, reply, 0, 1252, 2016, 81900, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 02094   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02093  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 02095  2016   NtRequestWaitReplyPort  (576, {64, 88, new_msg, 56, 1310720, 11071988, 1398776, 0}  (576, {64, 88, new_msg, 56, 1310720, 11071988, 1398776, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0HY\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02096   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0H\3\0\0" ...  ...
 02097  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02096   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 02097  1120   NtDuplicateObject  ... 584, ) == 0x0
 02095  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81902, 0}  ... {64, 88, reply, 56, 1252, 2016, 81902, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0HY\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02098   896   NtResumeThread  (568, ...
 02099  1120   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02100  2016   NtRequestWaitReplyPort  (576, {44, 68, new_msg, 56, 1252, 2016, 81900, 0}  (576, {44, 68, new_msg, 56, 1252, 2016, 81900, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\0X\25\0\322\0\0\0" ...  ...
 02098   896   NtResumeThread  ... 1, ) == 0x0
 02101   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02094   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02102   840   NtTestAlert  (...
 02099  1120   NtWaitForSingleObject  ... ) == 0x102
 02103   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 02102   840   NtTestAlert  ... ) == 0x0
 02104  1120   NtWaitForSingleObject  (124, 0, 0x0, ...
 02103   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02105   840   NtContinue  (66911536, 1, ...
 02106   384   NtQueryValueKey  (556,  (556, "Domain", Partial, 144, ... , Partial, 144, ...
 02107   840   NtRegisterThreadTerminatePort  (24, ...
 02106   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02107   840   NtRegisterThreadTerminatePort  ... ) == 0x0
 02108   384   NtQueryValueKey  (556,  (556, "Domain", Partial, 144, ... , Partial, 144, ...
 02101   896   NtAllocateVirtualMemory  ... 66912256, 1048576, ) == 0x0
 02100  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81904, 0}  ... {40, 64, reply, 0, 1252, 2016, 81904, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 02109   840   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 02110   896   NtAllocateVirtualMemory  (-1, 67952640, 0, 8192, 4096, 4, ...
 02111  2016   NtWaitForSingleObject  (284, 0, 0x0, ...
 02109   840   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 02110   896   NtAllocateVirtualMemory  ... 67952640, 8192, ) == 0x0
 02112   840   NtSetEventBoostPriority  (284, ...
 02113   896   NtProtectVirtualMemory  (-1, (0x40ce000), 4096, 260, ...
 02111  2016   NtWaitForSingleObject  ... ) == 0x0
 02112   840   NtSetEventBoostPriority  ... ) == 0x0
 02114  2016   NtRequestWaitReplyPort  (576, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0}  (576, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0(`\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02113   896   NtProtectVirtualMemory  ... (0x40ce000), 4096, 4, ) == 0x0
 02115   840   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02116   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02115   840   NtDuplicateObject  ... 588, ) == 0x0
 02108   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02114  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81905, 0}  ... {64, 88, reply, 56, 1252, 2016, 81905, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0(`\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02116   896   NtCreateThread  ... 592, {1252, 876}, ) == 0x0
 02117   384   NtClose  (556, ...
 02118  2016   NtRequestWaitReplyPort  (576, {44, 68, new_msg, 56, 1252, 2016, 81904, 0}  (576, {44, 68, new_msg, 56, 1252, 2016, 81904, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0\0X\25\0\322\0\0\0" ...  ...
 02119   896   NtQueryInformationThread  (592, Basic, 28, ...
 02117   384   NtClose  ... ) == 0x0
 02119   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 02120   384   NtClose  (580, ...
 02118  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81906, 0}  ... {40, 64, reply, 0, 1252, 2016, 81906, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 02121   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0l\3\0\0" ...  ...
 02120   384   NtClose  ... ) == 0x0
 02122  2016   NtRequestWaitReplyPort  (576, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0}  (576, {64, 88, new_msg, 56, 1310720, 11071988, 11072732, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0Pj\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02121   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 02123   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 02124   840   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02125   896   NtResumeThread  (592, ...
 02122  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81908, 0}  ... {64, 88, reply, 56, 1252, 2016, 81908, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\250\0\351\201\347w\214\370\250\0\30\356\220|p\5\221|\1\0\0\0Pj\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02124   840   NtWaitForSingleObject  ... ) == 0x102
 02125   896   NtResumeThread  ... 1, ) == 0x0
 02126  2016   NtClose  (572, ...
 02127   840   NtWaitForSingleObject  (124, 0, 0x0, ...
 02128   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02126  2016   NtClose  ... ) == 0x0
 02128   896   NtAllocateVirtualMemory  ... 67960832, 1048576, ) == 0x0
 02129  2016   NtClose  (576, ...
 02130   896   NtAllocateVirtualMemory  (-1, 69001216, 0, 8192, 4096, 4, ...
 02129  2016   NtClose  ... ) == 0x0
 02130   896   NtAllocateVirtualMemory  ... 69001216, 8192, ) == 0x0
 02131  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02123   384   NtOpenKey  ... 576, ) == 0x0
 02132   876   NtTestAlert  (...
 02133   896   NtProtectVirtualMemory  (-1, (0x41ce000), 4096, 260, ...
 02134   384   NtQueryValueKey  (576,  (576, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 02132   876   NtTestAlert  ... ) == 0x0
 02133   896   NtProtectVirtualMemory  ... (0x41ce000), 4096, 4, ) == 0x0
 02134   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02135   876   NtContinue  (67960112, 1, ...
 02136   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02137   384   NtClose  (576, ...
 02138   876   NtRegisterThreadTerminatePort  (24, ...
 02136   896   NtCreateThread  ... 572, {1252, 1104}, ) == 0x0
 02137   384   NtClose  ... ) == 0x0
 02138   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 02139   896   NtQueryInformationThread  (572, Basic, 28, ...
 02140   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15526864, ... }, 15526864, ...
 02131  2016   NtCreateEvent  ... 576, ) == 0x0
 02139   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 02141   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02142  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ...
 02140   384   NtQueryAttributesFile  ... ) == 0x0
 02141   876   NtDuplicateObject  ... 580, ) == 0x0
 02142  2016   NtOpenKey  ... 556, ) == 0x0
 02143   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02144   876   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02145  2016   NtOpenKey  (0x20019, {24, 556, 0x40, 0, 0,  (0x20019, {24, 556, 0x40, 0, 0, "ActiveComputerName"}, ... }, ...
 02143   384   NtOpenFile  ... 596, {status=0x0, info=1}, ) == 0x0
 02144   876   NtWaitForSingleObject  ... ) == 0x102
 02145  2016   NtOpenKey  ... 600, ) == 0x0
 02146   384   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 596, ...
 02147   876   NtWaitForSingleObject  (124, 0, 0x0, ...
 02148  2016   NtQueryValueKey  (600,  (600, "ComputerName", Full, 108, ... , Full, 108, ...
 02146   384   NtCreateSection  ... 604, ) == 0x0
 02149   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0P\4\0\0" ...  ...
 02150   384   NtClose  (596, ...
 02149   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 02148  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02151   896   NtResumeThread  (572, ...
 02152  2016   NtClose  (600, ...
 02151   896   NtResumeThread  ... 1, ) == 0x0
 02152  2016   NtClose  ... ) == 0x0
 02153   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02154  2016   NtClose  (556, ...
 02150   384   NtClose  ... ) == 0x0
 02155  1104   NtWaitForSingleObject  (88, 0, 0x0, ...
 02154  2016   NtClose  ... ) == 0x0
 02156   384   NtMapViewOfSection  (604, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02157  2016   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ...
 02156   384   NtMapViewOfSection  ... (0x860000), 0x0, 20480, ) == 0x0
 02153   896   NtAllocateVirtualMemory  ... 69009408, 1048576, ) == 0x0
 02158   384   NtClose  (604, ...
 02159   896   NtAllocateVirtualMemory  (-1, 70049792, 0, 8192, 4096, 4, ...
 02158   384   NtClose  ... ) == 0x0
 02159   896   NtAllocateVirtualMemory  ... 70049792, 8192, ) == 0x0
 02160   896   NtProtectVirtualMemory  (-1, (0x42ce000), 4096, 260, ... (0x42ce000), 4096, 4, ) == 0x0
 02161   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 604, {1252, 860}, ) == 0x0
 02162   896   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02163   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02157  2016   NtCreateIoCompletion  ... 556, ) == 0x0
 02164   384   NtUnmapViewOfSection  (-1, 0x860000, ...
 02165  2016   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ...
 02164   384   NtUnmapViewOfSection  ... ) == 0x0
 02165  2016   NtCreateIoCompletion  ... 596, ) == 0x0
 02166   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15527172, ... }, 15527172, ...
 02167  2016   NtDuplicateObject  (-1, 556, -1, 0x0, 0, 2, ...
 02166   384   NtQueryAttributesFile  ... ) == 0x0
 02167  2016   NtDuplicateObject  ... 600, ) == 0x0
 02168   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02169  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 02170   896   NtResumeThread  (604, ...
 02168   384   NtOpenFile  ... 608, {status=0x0, info=1}, ) == 0x0
 02170   896   NtResumeThread  ... 1, ) == 0x0
 02171   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 608, ...
 02172   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02171   384   NtCreateSection  ... 612, ) == 0x0
 02172   896   NtAllocateVirtualMemory  ... 70057984, 1048576, ) == 0x0
 02173   384   NtQuerySection  (612, Image, 48, ...
 02174   896   NtAllocateVirtualMemory  (-1, 71098368, 0, 8192, 4096, 4, ...
 02173   384   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02174   896   NtAllocateVirtualMemory  ... 71098368, 8192, ) == 0x0
 02175   384   NtClose  (608, ...
 02169  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02176   860   NtWaitForSingleObject  (88, 0, 0x0, ...
 02177   896   NtProtectVirtualMemory  (-1, (0x43ce000), 4096, 260, ...
 02178  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02177   896   NtProtectVirtualMemory  ... (0x43ce000), 4096, 4, ) == 0x0
 02178  2016   NtCreateEvent  ... 616, ) == 0x0
 02179   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02180  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 02179   896   NtCreateThread  ... 620, {1252, 1516}, ) == 0x0
 02180  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02181   896   NtQueryInformationThread  (620, Basic, 28, ...
 02182  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02181   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 02175   384   NtClose  ... ) == 0x0
 02182  2016   NtSetInformationThread  ... ) == 0x0
 02183   384   NtMapViewOfSection  (612, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02184  2016   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11071680,  (0xc0100080, {24, 0, 0x40, 0, 11071680, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02183   384   NtMapViewOfSection  ... (0x76fb0000), 0x0, 32768, ) == 0x0
 02184  2016   NtCreateFile  ... 608, {status=0x0, info=1}, ) == 0x0
 02185   384   NtClose  (612, ...
 02186  2016   NtSetInformationFile  (608, 11071736, 8, Pipe, ...
 02185   384   NtClose  ... ) == 0x0
 02186  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02187   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02188  2016   NtSetInformationFile  (608, 11071724, 8, Completion, ...
 02189   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\354\5\0\0" ...  ...
 02187   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02189   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81912, 0}  ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 02190   896   NtResumeThread  (620, ... 1, ) == 0x0
 02191   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02188  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02192  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02193  2016   NtWriteFile  (608, 221, 0, 0,  (608, 221, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02194  2016   NtReadFile  (608, 221, 0, 0, 1024, {0, 0}, 0, ...
 02191   896   NtAllocateVirtualMemory  ... 71106560, 1048576, ) == 0x0
 02195   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02196  1516   NtWaitForSingleObject  (88, 0, 0x0, ...
 02197   896   NtAllocateVirtualMemory  (-1, 72146944, 0, 8192, 4096, 4, ...
 02195   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02197   896   NtAllocateVirtualMemory  ... 72146944, 8192, ) == 0x0
 02198   384   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02199   896   NtProtectVirtualMemory  (-1, (0x44ce000), 4096, 260, ...
 02198   384   NtFlushInstructionCache  ... ) == 0x0
 02199   896   NtProtectVirtualMemory  ... (0x44ce000), 4096, 4, ) == 0x0
 02200   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02194  2016   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02200   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02201  2016   NtFsControlFile  (608, 221, 0x0, 0x0, 0x11c017,  (608, 221, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\250\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 02202   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02201  2016   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02202   896   NtCreateThread  ... 612, {1252, 780}, ) == 0x0
 02203  2016   NtFsControlFile  (608, 221, 0x0, 0x0, 0x11c017,  (608, 221, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\1\0\0\0\1\0\0\0&\0(\0\310;\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 02204   896   NtQueryInformationThread  (612, Basic, 28, ...
 02203  2016   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , ) == 0x103
 02204   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02205  2016   NtFsControlFile  (608, 221, 0x0, 0x0, 0x11c017,  (608, 221, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... , 44, 1024, ...
 02206   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\14\3\0\0" ...  ...
 02207   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02208   384   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02209   384   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 624, ) }, ... 624, ) == 0x0
 02210   384   NtMapViewOfSection  (624, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 02211   384   NtClose  (624, ... ) == 0x0
 02212   384   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02205  2016   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0xh\25\0\1\0\0\0\204h\25\0 \0\0\0\1\0\0\0\30\0\32\0\220h\25\0\254h\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\340h\25\0\1\0\0\0\5\0i\0\360h\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02206   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02213  2016   NtClose  (616, ...
 02214   896   NtResumeThread  (612, ...
 02213  2016   NtClose  ... ) == 0x0
 02214   896   NtResumeThread  ... 1, ) == 0x0
 02215  2016   NtClose  (608, ...
 02216   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02215  2016   NtClose  ... ) == 0x0
 02216   896   NtAllocateVirtualMemory  ... 72155136, 1048576, ) == 0x0
 02217  2016   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1384032, 0x0, 11073604, 188, ... , {12, 2, 1, 1}, 0x0, 1384032, 0x0, 11073604, 188, ...
 02218   896   NtAllocateVirtualMemory  (-1, 73195520, 0, 8192, 4096, 4, ...
 02219   780   NtWaitForSingleObject  (88, 0, 0x0, ...
 02217  2016   NtSecureConnectPort  ... 608, 0x0, 0x0, 0x0, 188, ) == 0x0
 02220   384   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 02221  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 02220   384   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 02221  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02222   384   NtFlushInstructionCache  (-1, 1995837440, 228, ...
 02223  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02222   384   NtFlushInstructionCache  ... ) == 0x0
 02223  2016   NtSetInformationThread  ... ) == 0x0
 02218   896   NtAllocateVirtualMemory  ... 73195520, 8192, ) == 0x0
 02224   384   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ...
 02225   896   NtProtectVirtualMemory  (-1, (0x45ce000), 4096, 260, ...
 02224   384   NtProtectVirtualMemory  ... (0x76f61000), 4096, 32, ) == 0x0
 02225   896   NtProtectVirtualMemory  ... (0x45ce000), 4096, 4, ) == 0x0
 02226   384   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 02227   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02226   384   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 02227   896   NtCreateThread  ... 616, {1252, 940}, ) == 0x0
 02228   384   NtFlushInstructionCache  (-1, 1995837440, 228, ...
 02229   896   NtQueryInformationThread  (616, Basic, 28, ...
 02228   384   NtFlushInstructionCache  ... ) == 0x0
 02230  2016   NtRequestWaitReplyPort  (608, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977}  (608, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\246\4\4\300{\34~\211\24\36/\3034\306T\274\12\0\0\0\361\13\207\313\213\244\231W\0\0\0\0\260'\25\0\251\261\244\344\3247Z\11(\0\0\0\5\331\0\331\0\0\24\0\240\366\250\0\245\24\16\177\0\0\0\0\340R\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\250\0\372\31\221|X\376\250\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02229   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 02231   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 02232   896   NtResumeThread  (616, ... 1, ) == 0x0
 02230  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81915, 0}  ... {200, 224, reply, 0, 1252, 2016, 81915, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\246\4\4\300{\34~\211\24\36/\3034\306T\274\12\0\0\0\361\13\207\313\213\244\231W\0\0\0\0\260'\25\0\251\261\244\344\3247Z\11(\0\0\0\5\331\0\331\0\0\24\0\240\366\250\0\245\24\16\177\0\0\0\0\340R\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\250\0\372\31\221|X\376\250\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02233   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02234   940   NtWaitForSingleObject  (88, 0, 0x0, ...
 02235  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02233   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02235  2016   NtSetInformationThread  ... ) == 0x0
 02236   384   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02237  2016   NtRequestWaitReplyPort  (608, {56, 80, new_msg, 0, 44, 3, 20, 0}  (608, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0gS\263F\252\227\2L\355h\28\1\0\0\0\0\0\0\0&\0(\0\314\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02236   384   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02238   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02239   384   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02238   896   NtAllocateVirtualMemory  ... 73203712, 1048576, ) == 0x0
 02239   384   NtFlushInstructionCache  ... ) == 0x0
 02240   896   NtAllocateVirtualMemory  (-1, 74244096, 0, 8192, 4096, 4, ... 74244096, 8192, ) == 0x0
 02241   896   NtProtectVirtualMemory  (-1, (0x46ce000), 4096, 260, ... (0x46ce000), 4096, 4, ) == 0x0
 02242   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 1268}, ) == 0x0
 02243   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02244   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 02245   896   NtResumeThread  (624, ... 1, ) == 0x0
 02246   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74252288, 1048576, ) == 0x0
 02247   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... }, ...
 02237  2016   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 2016, 81917, 0}  ... {44, 68, reply, 0, 1252, 2016, 81917, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02248  1268   NtWaitForSingleObject  (88, 0, 0x0, ...
 02247   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02249  2016   NtRaiseException  (11074064, 11073324, 1, ...
 02250   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02251  2016   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 02250   384   NtCreateEvent  ... 628, ) == 0x0
 02251  2016   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 02252   896   NtAllocateVirtualMemory  (-1, 75292672, 0, 8192, 4096, 4, ...
 02253  2016   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 02252   896   NtAllocateVirtualMemory  ... 75292672, 8192, ) == 0x0
 02254   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... }, ...
 02255   896   NtProtectVirtualMemory  (-1, (0x47ce000), 4096, 260, ...
 02254   384   NtOpenKey  ... 632, ) == 0x0
 02255   896   NtProtectVirtualMemory  ... (0x47ce000), 4096, 4, ) == 0x0
 02256   384   NtQueryValueKey  (632,  (632, "LdapClientIntegrity", Partial, 144, ... , Partial, 144, ...
 02257   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02256   384   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02257   896   NtCreateThread  ... 636, {1252, 644}, ) == 0x0
 02258   384   NtClose  (632, ...
 02253  2016   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02258   384   NtClose  ... ) == 0x0
 02259  2016   NtContinue  (11072292, 0, ...
 02260   896   NtQueryInformationThread  (636, Basic, 28, ...
 02261  2016   NtDeviceIoControlFile  (460, 108, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 02260   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 02261  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 02262   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\204\2\0\0" ...  ...
 02263  2016   NtWaitForSingleObject  (108, 1, {-5000000, -1}, ...
 02262   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 02264   896   NtResumeThread  (636, ... 1, ) == 0x0
 02265   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 75300864, 1048576, ) == 0x0
 02266   896   NtAllocateVirtualMemory  (-1, 76341248, 0, 8192, 4096, 4, ... 76341248, 8192, ) == 0x0
 02267   896   NtProtectVirtualMemory  (-1, (0x48ce000), 4096, 260, ...
 02268   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... }, ...
 02269   644   NtWaitForSingleObject  (88, 0, 0x0, ...
 02268   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02270   384   NtQueryPerformanceCounter  (... {-1449193583, 16}, {3579545, 0}, ) == 0x0
 02271   384   NtSetEventBoostPriority  (88, ...
 02155  1104   NtWaitForSingleObject  ... ) == 0x0
 02272  1104   NtSetEventBoostPriority  (88, ...
 02176   860   NtWaitForSingleObject  ... ) == 0x0
 02273   860   NtSetEventBoostPriority  (88, ...
 02196  1516   NtWaitForSingleObject  ... ) == 0x0
 02274  1516   NtSetEventBoostPriority  (88, ...
 02219   780   NtWaitForSingleObject  ... ) == 0x0
 02275   780   NtSetEventBoostPriority  (88, ...
 02234   940   NtWaitForSingleObject  ... ) == 0x0
 02276   940   NtSetEventBoostPriority  (88, ...
 02248  1268   NtWaitForSingleObject  ... ) == 0x0
 02277  1268   NtSetEventBoostPriority  (88, ...
 02269   644   NtWaitForSingleObject  ... ) == 0x0
 02278   644   NtTestAlert  (... ) == 0x0
 02277  1268   NtSetEventBoostPriority  ... ) == 0x0
 02276   940   NtSetEventBoostPriority  ... ) == 0x0
 02275   780   NtSetEventBoostPriority  ... ) == 0x0
 02274  1516   NtSetEventBoostPriority  ... ) == 0x0
 02273   860   NtSetEventBoostPriority  ... ) == 0x0
 02272  1104   NtSetEventBoostPriority  ... ) == 0x0
 02271   384   NtSetEventBoostPriority  ... ) == 0x0
 02267   896   NtProtectVirtualMemory  ... (0x48ce000), 4096, 4, ) == 0x0
 02279   644   NtContinue  (75300144, 1, ...
 02280  1268   NtTestAlert  (...
 02281   940   NtTestAlert  (...
 02282   780   NtTestAlert  (...
 02283  1516   NtTestAlert  (...
 02284   860   NtTestAlert  (...
 02285   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15526864, ... }, 15526864, ...
 02286   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02287   644   NtRegisterThreadTerminatePort  (24, ...
 02280  1268   NtTestAlert  ... ) == 0x0
 02281   940   NtTestAlert  ... ) == 0x0
 02282   780   NtTestAlert  ... ) == 0x0
 02283  1516   NtTestAlert  ... ) == 0x0
 02284   860   NtTestAlert  ... ) == 0x0
 02285   384   NtQueryAttributesFile  ... ) == 0x0
 02286   896   NtCreateThread  ... 632, {1252, 1736}, ) == 0x0
 02287   644   NtRegisterThreadTerminatePort  ... ) == 0x0
 02288  1268   NtContinue  (74251568, 1, ...
 02289   940   NtContinue  (73202992, 1, ...
 02290   780   NtContinue  (72154416, 1, ...
 02291  1516   NtContinue  (71105840, 1, ...
 02292   860   NtContinue  (70057264, 1, ...
 02293   384   NtQuerySystemInformation  (Basic, 44, ...
 02294   896   NtQueryInformationThread  (632, Basic, 28, ...
 02295   644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02296  1268   NtRegisterThreadTerminatePort  (24, ...
 02297   940   NtRegisterThreadTerminatePort  (24, ...
 02298   780   NtRegisterThreadTerminatePort  (24, ...
 02299  1516   NtRegisterThreadTerminatePort  (24, ...
 02300   860   NtRegisterThreadTerminatePort  (24, ...
 02293   384   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02294   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02295   644   NtDuplicateObject  ... 640, ) == 0x0
 02296  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 02297   940   NtRegisterThreadTerminatePort  ... ) == 0x0
 02298   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 02299  1516   NtRegisterThreadTerminatePort  ... ) == 0x0
 02300   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 02301  1104   NtTestAlert  (...
 02302   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\310\6\0\0" ...  ...
 02303   644   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02304  1268   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02305   940   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02306   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02307  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02308   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02301  1104   NtTestAlert  ... ) == 0x0
 02309   384   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ...
 02302   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02303   644   NtWaitForSingleObject  ... ) == 0x102
 02304  1268   NtDuplicateObject  ... 644, ) == 0x0
 02305   940   NtDuplicateObject  ... 648, ) == 0x0
 02306   780   NtDuplicateObject  ... 652, ) == 0x0
 02307  1516   NtDuplicateObject  ... 656, ) == 0x0
 02310  1104   NtContinue  (69008688, 1, ...
 02309   384   NtAllocateVirtualMemory  ... 8781824, 65536, ) == 0x0
 02311   896   NtResumeThread  (632, ...
 02312   644   NtWaitForSingleObject  (124, 0, 0x0, ...
 02313  1268   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02314   940   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02315   780   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02316  1516   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02317  1104   NtRegisterThreadTerminatePort  (24, ...
 02318   384   NtAllocateVirtualMemory  (-1, 8781824, 0, 4096, 4096, 4, ...
 02311   896   NtResumeThread  ... 1, ) == 0x0
 02313  1268   NtWaitForSingleObject  ... ) == 0x102
 02314   940   NtWaitForSingleObject  ... ) == 0x102
 02315   780   NtWaitForSingleObject  ... ) == 0x102
 02316  1516   NtWaitForSingleObject  ... ) == 0x102
 02317  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 02318   384   NtAllocateVirtualMemory  ... 8781824, 4096, ) == 0x0
 02319   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02320  1268   NtWaitForSingleObject  (124, 0, 0x0, ...
 02321   940   NtWaitForSingleObject  (124, 0, 0x0, ...
 02322   780   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ...
 02323  1516   NtWaitForSingleObject  (284, 0, 0x0, ...
 02324  1104   NtWaitForSingleObject  (284, 0, 0x0, ...
 02325   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02319   896   NtAllocateVirtualMemory  ... 76349440, 1048576, ) == 0x0
 02322   780   NtAllocateVirtualMemory  ... 1404928, 4096, ) == 0x0
 02308   860   NtDuplicateObject  ... 660, ) == 0x0
 02326  1736   NtWaitForSingleObject  (284, 0, 0x0, ...
 02327   896   NtAllocateVirtualMemory  (-1, 77389824, 0, 8192, 4096, 4, ...
 02328   860   NtWaitForSingleObject  (284, 0, 0x0, ...
 02327   896   NtAllocateVirtualMemory  ... 77389824, 8192, ) == 0x0
 02329   896   NtProtectVirtualMemory  (-1, (0x49ce000), 4096, 260, ... (0x49ce000), 4096, 4, ) == 0x0
 02330   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 320}, ) == 0x0
 02331   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 02332   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 02333   896   NtResumeThread  (664, ...
 02334   780   NtSetEventBoostPriority  (284, ...
 02323  1516   NtWaitForSingleObject  ... ) == 0x0
 02335  1516   NtSetEventBoostPriority  (284, ...
 02325   384   NtWaitForSingleObject  ... ) == 0x0
 02336   384   NtSetEventBoostPriority  (284, ...
 02324  1104   NtWaitForSingleObject  ... ) == 0x0
 02337  1104   NtSetEventBoostPriority  (284, ...
 02326  1736   NtWaitForSingleObject  ... ) == 0x0
 02338  1736   NtSetEventBoostPriority  (284, ...
 02328   860   NtWaitForSingleObject  ... ) == 0x0
 02339   860   NtWaitForSingleObject  (356, 0, 0x0, ...
 02338  1736   NtSetEventBoostPriority  ... ) == 0x0
 02336   384   NtSetEventBoostPriority  ... ) == 0x0
 02335  1516   NtSetEventBoostPriority  ... ) == 0x0
 02334   780   NtSetEventBoostPriority  ... ) == 0x0
 02337  1104   NtSetEventBoostPriority  ... ) == 0x0
 02333   896   NtResumeThread  ... 1, ) == 0x0
 02340  1736   NtTestAlert  (...
 02341   320   NtTestAlert  (...
 02342   384   NtSetEventBoostPriority  (356, ...
 02343   780   NtWaitForSingleObject  (124, 0, 0x0, ...
 02344  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02345   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02340  1736   NtTestAlert  ... ) == 0x0
 02341   320   NtTestAlert  ... ) == 0x0
 02339   860   NtWaitForSingleObject  ... ) == 0x0
 02342   384   NtSetEventBoostPriority  ... ) == 0x0
 02344  1104   NtDuplicateObject  ... 668, ) == 0x0
 02345   896   NtAllocateVirtualMemory  ... 77398016, 1048576, ) == 0x0
 02346  1736   NtContinue  (76348720, 1, ...
 02347   860   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02348   320   NtContinue  (77397296, 1, ...
 02349   384   NtAllocateVirtualMemory  (-1, 8785920, 0, 8192, 4096, 4, ...
 02350  1516   NtWaitForSingleObject  (124, 0, 0x0, ...
 02351   896   NtAllocateVirtualMemory  (-1, 78438400, 0, 8192, 4096, 4, ...
 02352  1736   NtRegisterThreadTerminatePort  (24, ...
 02353   320   NtRegisterThreadTerminatePort  (24, ...
 02349   384   NtAllocateVirtualMemory  ... 8785920, 8192, ) == 0x0
 02351   896   NtAllocateVirtualMemory  ... 78438400, 8192, ) == 0x0
 02352  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 02353   320   NtRegisterThreadTerminatePort  ... ) == 0x0
 02354   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15526864, ... }, 15526864, ...
 02355   896   NtProtectVirtualMemory  (-1, (0x4ace000), 4096, 260, ...
 02356  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02357  1104   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02347   860   NtWaitForSingleObject  ... ) == 0x102
 02354   384   NtQueryAttributesFile  ... ) == 0x0
 02358   320   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02355   896   NtProtectVirtualMemory  ... (0x4ace000), 4096, 4, ) == 0x0
 02357  1104   NtWaitForSingleObject  ... ) == 0x102
 02359   860   NtWaitForSingleObject  (124, 0, 0x0, ...
 02356  1736   NtDuplicateObject  ... 672, ) == 0x0
 02358   320   NtDuplicateObject  ... 676, ) == 0x0
 02360   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02361  1104   NtWaitForSingleObject  (124, 0, 0x0, ...
 02362  1736   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02363   320   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02360   896   NtCreateThread  ... 680, {1252, 380}, ) == 0x0
 02362  1736   NtWaitForSingleObject  ... ) == 0x102
 02363   320   NtWaitForSingleObject  ... ) == 0x102
 02364   896   NtQueryInformationThread  (680, Basic, 28, ...
 02365  1736   NtWaitForSingleObject  (124, 0, 0x0, ...
 02366   320   NtWaitForSingleObject  (124, 0, 0x0, ...
 02364   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 02367   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... }, 5, 96, ...
 02368   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0|\1\0\0" ...  ...
 02367   384   NtOpenFile  ... 684, {status=0x0, info=1}, ) == 0x0
 02369   384   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 684, ... 688, ) == 0x0
 02370   384   NtClose  (684, ... ) == 0x0
 02371   384   NtMapViewOfSection  (688, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb90000), 0x0, 110592, ) == 0x0
 02372   384   NtClose  (688, ... ) == 0x0
 02368   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 02373   896   NtResumeThread  (680, ... 1, ) == 0x0
 02374   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78446592, 1048576, ) == 0x0
 02375   380   NtWaitForSingleObject  (88, 0, 0x0, ...
 02376   896   NtAllocateVirtualMemory  (-1, 79486976, 0, 8192, 4096, 4, ... 79486976, 8192, ) == 0x0
 02377   896   NtProtectVirtualMemory  (-1, (0x4bce000), 4096, 260, ... (0x4bce000), 4096, 4, ) == 0x0
 02378   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02379   384   NtUnmapViewOfSection  (-1, 0xb90000, ... ) == 0x0
 02380   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15527172, ... ) }, 15527172, ... ) == 0x0
 02381   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 688, {status=0x0, info=1}, ) }, 5, 96, ... 688, {status=0x0, info=1}, ) == 0x0
 02378   896   NtCreateThread  ... 684, {1252, 1332}, ) == 0x0
 02382   896   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 02383   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 02384   896   NtResumeThread  (684, ... 1, ) == 0x0
 02385   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 79495168, 1048576, ) == 0x0
 02386   896   NtAllocateVirtualMemory  (-1, 80535552, 0, 8192, 4096, 4, ... 80535552, 8192, ) == 0x0
 02387   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 688, ...
 02388  1332   NtWaitForSingleObject  (88, 0, 0x0, ...
 02387   384   NtCreateSection  ... 692, ) == 0x0
 02389   384   NtQuerySection  (692, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02390   384   NtClose  (688, ... ) == 0x0
 02391   384   NtMapViewOfSection  (692, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x751d0000), 0x0, 122880, ) == 0x0
 02392   384   NtClose  (692, ... ) == 0x0
 02393   384   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02394   896   NtProtectVirtualMemory  (-1, (0x4cce000), 4096, 260, ... (0x4cce000), 4096, 4, ) == 0x0
 02395   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1252, 1336}, ) == 0x0
 02396   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02397   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02398   896   NtResumeThread  (692, ... 1, ) == 0x0
 02399   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02400   384   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ...
 02401  1336   NtWaitForSingleObject  (88, 0, 0x0, ...
 02400   384   NtProtectVirtualMemory  ... (0x751d1000), 4096, 4, ) == 0x0
 02402   384   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02403   384   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02404   384   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02405   384   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02399   896   NtAllocateVirtualMemory  ... 80543744, 1048576, ) == 0x0
 02406   896   NtAllocateVirtualMemory  (-1, 81584128, 0, 8192, 4096, 4, ... 81584128, 8192, ) == 0x0
 02407   896   NtProtectVirtualMemory  (-1, (0x4dce000), 4096, 260, ... (0x4dce000), 4096, 4, ) == 0x0
 02408   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1252, 1808}, ) == 0x0
 02409   896   NtQueryInformationThread  (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 02410   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\20\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 02411   384   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02412   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 15526348, ... }, 15526348, ...
 02413   896   NtResumeThread  (688, ... 1, ) == 0x0
 02414   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 81592320, 1048576, ) == 0x0
 02415   896   NtAllocateVirtualMemory  (-1, 82632704, 0, 8192, 4096, 4, ... 82632704, 8192, ) == 0x0
 02416  1808   NtWaitForSingleObject  (88, 0, 0x0, ...
 02417   896   NtProtectVirtualMemory  (-1, (0x4ece000), 4096, 260, ... (0x4ece000), 4096, 4, ) == 0x0
 02418   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 696, {1252, 468}, ) == 0x0
 02419   896   NtQueryInformationThread  (696, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 02420   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 02421   896   NtResumeThread  (696, ... 1, ) == 0x0
 02422   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02423   468   NtWaitForSingleObject  (88, 0, 0x0, ...
 02422   896   NtAllocateVirtualMemory  ... 82640896, 1048576, ) == 0x0
 02424   896   NtAllocateVirtualMemory  (-1, 83681280, 0, 8192, 4096, 4, ... 83681280, 8192, ) == 0x0
 02425   896   NtProtectVirtualMemory  (-1, (0x4fce000), 4096, 260, ... (0x4fce000), 4096, 4, ) == 0x0
 02426   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 700, {1252, 752}, ) == 0x0
 02427   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02428   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02412   384   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02429   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 15526348, ... ) }, 15526348, ... ) == 0x0
 02430   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 704, {status=0x0, info=1}, ) }, 5, 96, ... 704, {status=0x0, info=1}, ) == 0x0
 02431   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 704, ... 708, ) == 0x0
 02432   384   NtQuerySection  (708, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02433   384   NtClose  (704, ... ) == 0x0
 02434   384   NtMapViewOfSection  (708, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02435   896   NtResumeThread  (700, ... 1, ) == 0x0
 02436   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 83689472, 1048576, ) == 0x0
 02437   896   NtAllocateVirtualMemory  (-1, 84729856, 0, 8192, 4096, 4, ... 84729856, 8192, ) == 0x0
 02438   896   NtProtectVirtualMemory  (-1, (0x50ce000), 4096, 260, ... (0x50ce000), 4096, 4, ) == 0x0
 02439   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 1512}, ) == 0x0
 02440   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 02434   384   NtMapViewOfSection  ... (0x77920000), 0x0, 995328, ) == 0x0
 02441   752   NtWaitForSingleObject  (88, 0, 0x0, ...
 02442   384   NtClose  (708, ... ) == 0x0
 02443   384   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02444   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 02445   896   NtResumeThread  (704, ... 1, ) == 0x0
 02446   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02447   384   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ...
 02448  1512   NtWaitForSingleObject  (88, 0, 0x0, ...
 02447   384   NtProtectVirtualMemory  ... (0x77921000), 4096, 4, ) == 0x0
 02449   384   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02450   384   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02451   384   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02452   384   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02453   384   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ...
 02446   896   NtAllocateVirtualMemory  ... 84738048, 1048576, ) == 0x0
 02454   896   NtAllocateVirtualMemory  (-1, 85778432, 0, 8192, 4096, 4, ... 85778432, 8192, ) == 0x0
 02455   896   NtProtectVirtualMemory  (-1, (0x51ce000), 4096, 260, ... (0x51ce000), 4096, 4, ) == 0x0
 02456   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 708, {1252, 1380}, ) == 0x0
 02457   896   NtQueryInformationThread  (708, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02458   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02453   384   NtProtectVirtualMemory  ... (0x77921000), 4096, 32, ) == 0x0
 02459   384   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02460   384   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02461   384   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02462   384   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02463   384   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02464   384   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ...
 02465   896   NtResumeThread  (708, ... 1, ) == 0x0
 02466   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 85786624, 1048576, ) == 0x0
 02467   896   NtAllocateVirtualMemory  (-1, 86827008, 0, 8192, 4096, 4, ... 86827008, 8192, ) == 0x0
 02468   896   NtProtectVirtualMemory  (-1, (0x52ce000), 4096, 260, ... (0x52ce000), 4096, 4, ) == 0x0
 02469   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 712, {1252, 1564}, ) == 0x0
 02470   896   NtQueryInformationThread  (712, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 02464   384   NtProtectVirtualMemory  ... (0x77921000), 4096, 32, ) == 0x0
 02471  1380   NtWaitForSingleObject  (88, 0, 0x0, ...
 02472   384   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02473   384   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02474   384   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02475   384   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02476   384   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02477   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 02478   896   NtResumeThread  (712, ... 1, ) == 0x0
 02479   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02480  1564   NtWaitForSingleObject  (88, 0, 0x0, ...
 02479   896   NtAllocateVirtualMemory  ... 86835200, 1048576, ) == 0x0
 02481   896   NtAllocateVirtualMemory  (-1, 87875584, 0, 8192, 4096, 4, ... 87875584, 8192, ) == 0x0
 02482   896   NtProtectVirtualMemory  (-1, (0x53ce000), 4096, 260, ... (0x53ce000), 4096, 4, ) == 0x0
 02483   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02484   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02485   384   NtQueryDefaultUILanguage  (2090319928, ...
 02486   384   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02487   384   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481484, ) == 0x0
 02488   384   NtQueryInformationToken  (-2147481484, User, 80, ...
 02483   896   NtCreateThread  ... 716, {1252, 164}, ) == 0x0
 02489   896   NtQueryInformationThread  (716, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 02490   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 02491   896   NtResumeThread  (716, ... 1, ) == 0x0
 02492   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 87883776, 1048576, ) == 0x0
 02493   896   NtAllocateVirtualMemory  (-1, 88924160, 0, 8192, 4096, 4, ... 88924160, 8192, ) == 0x0
 02488   384   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 02494   164   NtWaitForSingleObject  (88, 0, 0x0, ...
 02495   384   NtClose  (-2147481484, ... ) == 0x0
 02496   384   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481484, ) }, ... -2147481484, ) == 0x0
 02497   384   NtOpenKey  (0x80000000, {24, -2147481484, 0x240, 0, 0,  (0x80000000, {24, -2147481484, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02498   384   NtOpenKey  (0x80000000, {24, -2147481484, 0x640, 0, 0,  (0x80000000, {24, -2147481484, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482104, ) }, ... -2147482104, ) == 0x0
 02499   384   NtQueryValueKey  (-2147482104,  (-2147482104, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02500   384   NtClose  (-2147482104, ...
 02501   896   NtProtectVirtualMemory  (-1, (0x54ce000), 4096, 260, ... (0x54ce000), 4096, 4, ) == 0x0
 02502   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 720, {1252, 312}, ) == 0x0
 02503   896   NtQueryInformationThread  (720, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 02504   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\08\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 02505   896   NtResumeThread  (720, ... 1, ) == 0x0
 02506   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02500   384   NtClose  ... ) == 0x0
 02507   312   NtWaitForSingleObject  (88, 0, 0x0, ...
 02508   384   NtClose  (-2147481484, ... ) == 0x0
 02485   384   NtQueryDefaultUILanguage  ... ) == 0x0
 02509   384   NtAllocateVirtualMemory  (-1, 15515648, 0, 4096, 4096, 260, ... 15515648, 4096, ) == 0x0
 02510   384   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 02511   384   NtQueryDefaultLocale  (1, 15527068, ... ) == 0x0
 02512   384   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02506   896   NtAllocateVirtualMemory  ... 88932352, 1048576, ) == 0x0
 02513   896   NtAllocateVirtualMemory  (-1, 89972736, 0, 8192, 4096, 4, ... 89972736, 8192, ) == 0x0
 02514   896   NtProtectVirtualMemory  (-1, (0x55ce000), 4096, 260, ... (0x55ce000), 4096, 4, ) == 0x0
 02515   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 724, {1252, 1964}, ) == 0x0
 02516   896   NtQueryInformationThread  (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 02517   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\254\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 02518   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 728, ) }, ... 728, ) == 0x0
 02519   384   NtQueryValueKey  (728,  (728, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (728, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02520   384   NtClose  (728, ... ) == 0x0
 02521   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 728, ) == 0x0
 02522   384   NtCallbackReturn  (0, 0, 0, ...
 02523   896   NtResumeThread  (724, ... 1, ) == 0x0
 02524   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 89980928, 1048576, ) == 0x0
 02525   896   NtAllocateVirtualMemory  (-1, 91021312, 0, 8192, 4096, 4, ... 91021312, 8192, ) == 0x0
 02526   896   NtProtectVirtualMemory  (-1, (0x56ce000), 4096, 260, ... (0x56ce000), 4096, 4, ) == 0x0
 02527   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 732, {1252, 1568}, ) == 0x0
 02528   896   NtQueryInformationThread  (732, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 02529   384   NtUserGetProcessWindowStation  (...
 02530  1964   NtWaitForSingleObject  (88, 0, 0x0, ...
 02529   384   NtUserGetProcessWindowStation  ... ) == 0x20
 02531   384   NtUserGetObjectInformation  (32, 1, 15526664, 12, 15526676, ... ) == 0x1
 02532   384   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02533   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\WPA\PnP"}, ... 736, ) }, ... 736, ) == 0x0
 02534   384   NtQueryValueKey  (736,  (736, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (736, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 02535   384   NtClose  (736, ... ) == 0x0
 02536   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0 \6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0 \6\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\2\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 02537   896   NtResumeThread  (732, ... 1, ) == 0x0
 02538   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 91029504, 1048576, ) == 0x0
 02539   896   NtAllocateVirtualMemory  (-1, 92069888, 0, 8192, 4096, 4, ... 92069888, 8192, ) == 0x0
 02540   896   NtProtectVirtualMemory  (-1, (0x57ce000), 4096, 260, ... (0x57ce000), 4096, 4, ) == 0x0
 02541   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02542   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... }, ...
 02543  1568   NtWaitForSingleObject  (88, 0, 0x0, ...
 02542   384   NtOpenKey  ... 736, ) == 0x0
 02544   384   NtQueryValueKey  (736,  (736, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (736, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02545   384   NtQueryValueKey  (736,  (736, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (736, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02546   384   NtClose  (736, ... ) == 0x0
 02547   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 736, ) }, ... 736, ) == 0x0
 02548   384   NtQueryValueKey  (736,  (736, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (736, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02541   896   NtCreateThread  ... 740, {1252, 1624}, ) == 0x0
 02549   896   NtQueryInformationThread  (740, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=1624,}, 0x0, ) == 0x0
 02550   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0X\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0X\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0X\6\0\0" )  ) == 0x0
 02551   896   NtResumeThread  (740, ... 1, ) == 0x0
 02552   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 92078080, 1048576, ) == 0x0
 02553   896   NtAllocateVirtualMemory  (-1, 93118464, 0, 8192, 4096, 4, ... 93118464, 8192, ) == 0x0
 02554   384   NtQueryValueKey  (736,  (736, "SystemPartition", Partial, 144, ... , Partial, 144, ...
 02555  1624   NtWaitForSingleObject  (88, 0, 0x0, ...
 02554   384   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02556   384   NtClose  (736, ... ) == 0x0
 02557   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 736, ) }, ... 736, ) == 0x0
 02558   384   NtQueryValueKey  (736,  (736, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (736, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02559   384   NtQueryValueKey  (736,  (736, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (736, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02560   384   NtClose  (736, ... ) == 0x0
 02561   896   NtProtectVirtualMemory  (-1, (0x58ce000), 4096, 260, ... (0x58ce000), 4096, 4, ) == 0x0
 02562   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 736, {1252, 1716}, ) == 0x0
 02563   896   NtQueryInformationThread  (736, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 02564   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\264\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\264\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 02565   896   NtResumeThread  (736, ... 1, ) == 0x0
 02566   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02567   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... }, ...
 02568  1716   NtWaitForSingleObject  (88, 0, 0x0, ...
 02567   384   NtOpenKey  ... 744, ) == 0x0
 02569   384   NtQueryValueKey  (744,  (744, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (744, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02570   384   NtQueryValueKey  (744,  (744, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (744, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02571   384   NtClose  (744, ... ) == 0x0
 02572   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 744, ) }, ... 744, ) == 0x0
 02573   384   NtQueryValueKey  (744,  (744, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (744, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02566   896   NtAllocateVirtualMemory  ... 93126656, 1048576, ) == 0x0
 02574   896   NtAllocateVirtualMemory  (-1, 94167040, 0, 8192, 4096, 4, ... 94167040, 8192, ) == 0x0
 02575   896   NtProtectVirtualMemory  (-1, (0x59ce000), 4096, 260, ... (0x59ce000), 4096, 4, ) == 0x0
 02576   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 748, {1252, 1440}, ) == 0x0
 02577   896   NtQueryInformationThread  (748, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 02578   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\2\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 02579   384   NtQueryValueKey  (744,  (744, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (744, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02580   384   NtClose  (744, ... ) == 0x0
 02581   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 744, ) }, ... 744, ) == 0x0
 02582   384   NtQueryValueKey  (744,  (744, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (744, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02583   384   NtQueryValueKey  (744,  (744, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (744, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02584   384   NtClose  (744, ... ) == 0x0
 02585   896   NtResumeThread  (748, ... 1, ) == 0x0
 02586   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 94175232, 1048576, ) == 0x0
 02587   896   NtAllocateVirtualMemory  (-1, 95215616, 0, 8192, 4096, 4, ... 95215616, 8192, ) == 0x0
 02588   896   NtProtectVirtualMemory  (-1, (0x5ace000), 4096, 260, ... (0x5ace000), 4096, 4, ) == 0x0
 02589   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 744, {1252, 1664}, ) == 0x0
 02590   896   NtQueryInformationThread  (744, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 02591   384   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... }, ...
 02592  1440   NtWaitForSingleObject  (88, 0, 0x0, ...
 02591   384   NtOpenKey  ... 752, ) == 0x0
 02593   384   NtQueryValueKey  (752,  (752, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02594   384   NtQueryValueKey  (752,  (752, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (752, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 02595   384   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0
 02596   384   NtClose  (752, ... ) == 0x0
 02597   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 752, ) == 0x0
 02598   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\200\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\200\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\2\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 02599   896   NtResumeThread  (744, ... 1, ) == 0x0
 02600   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 95223808, 1048576, ) == 0x0
 02601   896   NtAllocateVirtualMemory  (-1, 96264192, 0, 8192, 4096, 4, ... 96264192, 8192, ) == 0x0
 02602   896   NtProtectVirtualMemory  (-1, (0x5bce000), 4096, 260, ... (0x5bce000), 4096, 4, ) == 0x0
 02603   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02604   384   NtCreateMutant  (0x1f0001, 0x0, 0, ...
 02605  1664   NtWaitForSingleObject  (88, 0, 0x0, ...
 02604   384   NtCreateMutant  ... 756, ) == 0x0
 02606   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 760, ) == 0x0
 02607   384   NtCreateMutant  (0x1f0001, 0x0, 0, ... 764, ) == 0x0
 02608   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 768, ) == 0x0
 02609   384   NtCreateMutant  (0x1f0001, 0x0, 0, ... 772, ) == 0x0
 02610   384   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 776, ) }, ... 776, ) == 0x0
 02603   896   NtCreateThread  ... 780, {1252, 1972}, ) == 0x0
 02611   896   NtQueryInformationThread  (780, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 02612   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0\264\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\3\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 02613   896   NtResumeThread  (780, ... 1, ) == 0x0
 02614   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 96272384, 1048576, ) == 0x0
 02615   896   NtAllocateVirtualMemory  (-1, 97312768, 0, 8192, 4096, 4, ... 97312768, 8192, ) == 0x0
 02616   384   NtQueryValueKey  (776,  (776, "LogLevel", Partial, 144, ... , Partial, 144, ...
 02617  1972   NtWaitForSingleObject  (88, 0, 0x0, ...
 02616   384   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02618   384   NtQueryValueKey  (776,  (776, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (776, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02619   384   NtQueryValueKey  (776,  (776, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02620   384   NtOpenKey  (0x1, {24, 776, 0x40, 0, 0,  (0x1, {24, 776, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02621   384   NtClose  (776, ... ) == 0x0
 02622   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 15526580, ... ) }, 15526580, ... ) == 0x0
 02623   896   NtProtectVirtualMemory  (-1, (0x5cce000), 4096, 260, ... (0x5cce000), 4096, 4, ) == 0x0
 02624   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 776, {1252, 1036}, ) == 0x0
 02625   896   NtQueryInformationThread  (776, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 02626   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0\14\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0\14\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\3\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 02627   896   NtResumeThread  (776, ... 1, ) == 0x0
 02628   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02629   384   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... }, ...
 02630  1036   NtWaitForSingleObject  (88, 0, 0x0, ...
 02629   384   NtOpenKey  ... 784, ) == 0x0
 02631   384   NtQueryValueKey  (784,  (784, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (784, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (784, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02632   384   NtClose  (784, ... ) == 0x0
 02633   384   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 784, ) }, ... 784, ) == 0x0
 02634   384   NtQueryValueKey  (784,  (784, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (784, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (784, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 02635   384   NtClose  (784, ... ) == 0x0
 02628   896   NtAllocateVirtualMemory  ... 97320960, 1048576, ) == 0x0
 02636   896   NtAllocateVirtualMemory  (-1, 98361344, 0, 8192, 4096, 4, ... 98361344, 8192, ) == 0x0
 02637   896   NtProtectVirtualMemory  (-1, (0x5dce000), 4096, 260, ... (0x5dce000), 4096, 4, ) == 0x0
 02638   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 784, {1252, 1248}, ) == 0x0
 02639   896   NtQueryInformationThread  (784, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 02640   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0\340\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0\340\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 02641   384   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02642   384   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 788, ) }, ... 788, ) == 0x0
 02643   384   NtQueryValueKey  (788,  (788, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (788, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (788, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 02644   384   NtClose  (788, ... ) == 0x0
 02645   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02646   384   NtSetEventBoostPriority  (88, ...
 02375   380   NtWaitForSingleObject  ... ) == 0x0
 02647   380   NtSetEventBoostPriority  (88, ...
 02388  1332   NtWaitForSingleObject  ... ) == 0x0
 02648  1332   NtSetEventBoostPriority  (88, ...
 02401  1336   NtWaitForSingleObject  ... ) == 0x0
 02649  1336   NtSetEventBoostPriority  (88, ...
 02416  1808   NtWaitForSingleObject  ... ) == 0x0
 02650  1808   NtSetEventBoostPriority  (88, ...
 02423   468   NtWaitForSingleObject  ... ) == 0x0
 02651   468   NtSetEventBoostPriority  (88, ...
 02441   752   NtWaitForSingleObject  ... ) == 0x0
 02652   752   NtSetEventBoostPriority  (88, ...
 02448  1512   NtWaitForSingleObject  ... ) == 0x0
 02653  1512   NtSetEventBoostPriority  (88, ...
 02471  1380   NtWaitForSingleObject  ... ) == 0x0
 02654  1380   NtSetEventBoostPriority  (88, ...
 02480  1564   NtWaitForSingleObject  ... ) == 0x0
 02655  1564   NtSetEventBoostPriority  (88, ...
 02494   164   NtWaitForSingleObject  ... ) == 0x0
 02656   164   NtSetEventBoostPriority  (88, ...
 02507   312   NtWaitForSingleObject  ... ) == 0x0
 02657   312   NtSetEventBoostPriority  (88, ...
 02530  1964   NtWaitForSingleObject  ... ) == 0x0
 02658  1964   NtSetEventBoostPriority  (88, ...
 02543  1568   NtWaitForSingleObject  ... ) == 0x0
 02659  1568   NtSetEventBoostPriority  (88, ...
 02555  1624   NtWaitForSingleObject  ... ) == 0x0
 02660  1624   NtSetEventBoostPriority  (88, ...
 02568  1716   NtWaitForSingleObject  ... ) == 0x0
 02661  1716   NtAllocateVirtualMemory  (-1, 8876032, 0, 4096, 4096, 4, ... 8876032, 4096, ) == 0x0
 02660  1624   NtSetEventBoostPriority  ... ) == 0x0
 02659  1568   NtSetEventBoostPriority  ... ) == 0x0
 02658  1964   NtSetEventBoostPriority  ... ) == 0x0
 02657   312   NtSetEventBoostPriority  ... ) == 0x0
 02656   164   NtSetEventBoostPriority  ... ) == 0x0
 02655  1564   NtSetEventBoostPriority  ... ) == 0x0
 02654  1380   NtSetEventBoostPriority  ... ) == 0x0
 02653  1512   NtSetEventBoostPriority  ... ) == 0x0
 02652   752   NtSetEventBoostPriority  ... ) == 0x0
 02651   468   NtSetEventBoostPriority  ... ) == 0x0
 02650  1808   NtSetEventBoostPriority  ... ) == 0x0
 02649  1336   NtSetEventBoostPriority  ... ) == 0x0
 02648  1332   NtSetEventBoostPriority  ... ) == 0x0
 02647   380   NtSetEventBoostPriority  ... ) == 0x0
 02646   384   NtSetEventBoostPriority  ... ) == 0x0
 02662   896   NtResumeThread  (784, ...
 02663  1716   NtSetEventBoostPriority  (88, ...
 02664  1624   NtTestAlert  (...
 02665  1568   NtTestAlert  (...
 02666  1964   NtTestAlert  (...
 02667   312   NtTestAlert  (...
 02668   164   NtTestAlert  (...
 02669  1564   NtTestAlert  (...
 02670  1380   NtTestAlert  (...
 02671  1512   NtTestAlert  (...
 02672   752   NtTestAlert  (...
 02673   468   NtTestAlert  (...
 02674  1808   NtTestAlert  (...
 02675  1336   NtTestAlert  (...
 02676  1332   NtTestAlert  (...
 02677   380   NtTestAlert  (...
 02662   896   NtResumeThread  ... 1, ) == 0x0
 02592  1440   NtWaitForSingleObject  ... ) == 0x0
 02663  1716   NtSetEventBoostPriority  ... ) == 0x0
 02664  1624   NtTestAlert  ... ) == 0x0
 02665  1568   NtTestAlert  ... ) == 0x0
 02666  1964   NtTestAlert  ... ) == 0x0
 02667   312   NtTestAlert  ... ) == 0x0
 02668   164   NtTestAlert  ... ) == 0x0
 02669  1564   NtTestAlert  ... ) == 0x0
 02670  1380   NtTestAlert  ... ) == 0x0
 02671  1512   NtTestAlert  ... ) == 0x0
 02672   752   NtTestAlert  ... ) == 0x0
 02673   468   NtTestAlert  ... ) == 0x0
 02674  1808   NtTestAlert  ... ) == 0x0
 02675  1336   NtTestAlert  ... ) == 0x0
 02676  1332   NtTestAlert  ... ) == 0x0
 02677   380   NtTestAlert  ... ) == 0x0
 02678  1440   NtSetEventBoostPriority  (88, ...
 02679   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02680  1716   NtTestAlert  (...
 02681  1624   NtContinue  (92077360, 1, ...
 02682  1568   NtContinue  (91028784, 1, ...
 02683  1964   NtContinue  (89980208, 1, ...
 02684   312   NtContinue  (88931632, 1, ...
 02685   164   NtContinue  (87883056, 1, ...
 02686  1564   NtContinue  (86834480, 1, ...
 02687  1380   NtContinue  (85785904, 1, ...
 02688  1512   NtContinue  (84737328, 1, ...
 02689   752   NtContinue  (83688752, 1, ...
 02690   468   NtContinue  (82640176, 1, ...
 02691  1808   NtContinue  (81591600, 1, ...
 02692  1336   NtContinue  (80543024, 1, ...
 02693  1332   NtContinue  (79494448, 1, ...
 02605  1664   NtWaitForSingleObject  ... ) == 0x0
 02678  1440   NtSetEventBoostPriority  ... ) == 0x0
 02694   380   NtContinue  (78445872, 1, ...
 02679   896   NtAllocateVirtualMemory  ... 98369536, 1048576, ) == 0x0
 02680  1716   NtTestAlert  ... ) == 0x0
 02695  1624   NtRegisterThreadTerminatePort  (24, ...
 02696  1568   NtRegisterThreadTerminatePort  (24, ...
 02697  1964   NtRegisterThreadTerminatePort  (24, ...
 02698   312   NtRegisterThreadTerminatePort  (24, ...
 02699   164   NtRegisterThreadTerminatePort  (24, ...
 02700  1564   NtRegisterThreadTerminatePort  (24, ...
 02701  1380   NtRegisterThreadTerminatePort  (24, ...
 02702  1512   NtRegisterThreadTerminatePort  (24, ...
 02703   752   NtRegisterThreadTerminatePort  (24, ...
 02704   468   NtRegisterThreadTerminatePort  (24, ...
 02705  1808   NtRegisterThreadTerminatePort  (24, ...
 02706  1336   NtRegisterThreadTerminatePort  (24, ...
 02707  1664   NtSetEventBoostPriority  (88, ...
 02708  1332   NtRegisterThreadTerminatePort  (24, ...
 02709   384   NtWaitForSingleObject  (88, 0, 0x0, ...
 02710  1248   NtWaitForSingleObject  (88, 0, 0x0, ...
 02711   380   NtRegisterThreadTerminatePort  (24, ...
 02712   896   NtAllocateVirtualMemory  (-1, 99409920, 0, 8192, 4096, 4, ...
 02713  1716   NtContinue  (93125936, 1, ...
 02695  1624   NtRegisterThreadTerminatePort  ... ) == 0x0
 02696  1568   NtRegisterThreadTerminatePort  ... ) == 0x0
 02697  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 02698   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 02699   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 02700  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 02701  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 02702  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 02703   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 02704   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 02705  1808   NtRegisterThreadTerminatePort  ... ) == 0x0
 02617  1972   NtWaitForSingleObject  ... ) == 0x0
 02707  1664   NtSetEventBoostPriority  ... ) == 0x0
 02706  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 02708  1332   NtRegisterThreadTerminatePort  ... ) == 0x0
 02711   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 02712   896   NtAllocateVirtualMemory  ... 99409920, 8192, ) == 0x0
 02714  1716   NtRegisterThreadTerminatePort  (24, ...
 02715  1624   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02716  1568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02717  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02718   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02719   164   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02720  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02721  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02722  1512   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02723   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02724   468   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02725  1972   NtSetEventBoostPriority  (88, ...
 02726  1808   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02727  1440   NtTestAlert  (...
 02728  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02729  1332   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02730   380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02731  1664   NtTestAlert  (...
 02732   896   NtProtectVirtualMemory  (-1, (0x5ece000), 4096, 260, ...
 02714  1716   NtRegisterThreadTerminatePort  ... ) == 0x0
 02715  1624   NtDuplicateObject  ... 788, ) == 0x0
 02716  1568   NtDuplicateObject  ... 792, ) == 0x0
 02717  1964   NtDuplicateObject  ... 796, ) == 0x0
 02718   312   NtDuplicateObject  ... 800, ) == 0x0
 02719   164   NtDuplicateObject  ... 804, ) == 0x0
 02720  1564   NtDuplicateObject  ... 808, ) == 0x0
 02721  1380   NtDuplicateObject  ... 812, ) == 0x0
 02722  1512   NtDuplicateObject  ... 816, ) == 0x0
 02723   752   NtDuplicateObject  ... 820, ) == 0x0
 02630  1036   NtWaitForSingleObject  ... ) == 0x0
 02725  1972   NtSetEventBoostPriority  ... ) == 0x0
 02724   468   NtDuplicateObject  ... 824, ) == 0x0
 02727  1440   NtTestAlert  ... ) == 0x0
 02726  1808   NtDuplicateObject  ... 828, ) == 0x0
 02728  1336   NtDuplicateObject  ... 832, ) == 0x0
 02729  1332   NtDuplicateObject  ... 836, ) == 0x0
 02731  1664   NtTestAlert  ... ) == 0x0
 02732   896   NtProtectVirtualMemory  ... (0x5ece000), 4096, 4, ) == 0x0
 02733  1716   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02734  1624   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02735  1568   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02736  1964   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02737   312   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02738   164   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02739  1564   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02740  1380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02741  1512   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02742  1036   NtSetEventBoostPriority  (88, ...
 02743   752   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02730   380   NtDuplicateObject  ... 840, ) == 0x0
 02744   468   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02745  1440   NtContinue  (94174512, 1, ...
 02746  1808   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02747  1336   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02748  1332   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02749  1664   NtContinue  (95223088, 1, ...
 02750   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02733  1716   NtDuplicateObject  ... 844, ) == 0x0
 02734  1624   NtWaitForSingleObject  ... ) == 0x102
 02735  1568   NtWaitForSingleObject  ... ) == 0x102
 02736  1964   NtWaitForSingleObject  ... ) == 0x102
 02737   312   NtWaitForSingleObject  ... ) == 0x102
 02738   164   NtWaitForSingleObject  ... ) == 0x102
 02739  1564   NtWaitForSingleObject  ... ) == 0x102
 02740  1380   NtWaitForSingleObject  ... ) == 0x102
 02709   384   NtWaitForSingleObject  ... ) == 0x0
 02742  1036   NtSetEventBoostPriority  ... ) == 0x0
 02741  1512   NtWaitForSingleObject  ... ) == 0x102
 02743   752   NtWaitForSingleObject  ... ) == 0x102
 02751   380   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 02744   468   NtWaitForSingleObject  ... ) == 0x102
 02752  1440   NtRegisterThreadTerminatePort  (24, ...
 02746  1808   NtWaitForSingleObject  ... ) == 0x102
 02747  1336   NtWaitForSingleObject  ... ) == 0x102
 02748  1332   NtWaitForSingleObject  ... ) == 0x102
 02753  1664   NtRegisterThreadTerminatePort  (24, ...
 02750   896   NtCreateThread  ... 848, {1252, 1656}, ) == 0x0
 02754  1716   NtWaitForSingleObject  (284, 0, 0x0, ...
 02755  1624   NtWaitForSingleObject  (284, 0, 0x0, ...
 02756  1568   NtWaitForSingleObject  (284, 0, 0x0, ...
 02757  1964   NtWaitForSingleObject  (284, 0, 0x0, ...
 02758   312   NtWaitForSingleObject  (284, 0, 0x0, ...
 02759   164   NtWaitForSingleObject  (284, 0, 0x0, ...
 02760  1564   NtWaitForSingleObject  (284, 0, 0x0, ...
 02761   384   NtSetEventBoostPriority  (88, ...
 02762  1380   NtWaitForSingleObject  (284, 0, 0x0, ...
 02763  1972   NtTestAlert  (...
 02764  1512   NtWaitForSingleObject  (284, 0, 0x0, ...
 02765   752   NtWaitForSingleObject  (284, 0, 0x0, ...
 02751   380   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 02766   468   NtWaitForSingleObject  (284, 0, 0x0, ...
 02752  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 02767  1808   NtWaitForSingleObject  (284, 0, 0x0, ...
 02768  1336   NtWaitForSingleObject  (284, 0, 0x0, ...
 02769  1332   NtWaitForSingleObject  (284, 0, 0x0, ...
 02753  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 02770   896   NtQueryInformationThread  (848, Basic, 28, ...
 02710  1248   NtWaitForSingleObject  ... ) == 0x0
 02761   384   NtSetEventBoostPriority  ... ) == 0x0
 02763  1972   NtTestAlert  ... ) == 0x0
 02771   380   NtSetEventBoostPriority  (284, ...
 02772  1440   NtWaitForSingleObject  (284, 0, 0x0, ...
 02773  1664   NtWaitForSingleObject  (284, 0, 0x0, ...
 02774  1248   NtWaitForSingleObject  (284, 0, 0x0, ...
 02770   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 02775   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02776  1972   NtContinue  (96271664, 1, ...
 02754  1716   NtWaitForSingleObject  ... ) == 0x0
 02771   380   NtSetEventBoostPriority  ... ) == 0x0
 02777  1036   NtTestAlert  (...
 02778   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0x\6\0\0" ...  ...
 02779  1716   NtSetEventBoostPriority  (284, ...
 02780  1972   NtRegisterThreadTerminatePort  (24, ...
 02781   380   NtWaitForSingleObject  (284, 0, 0x0, ...
 02777  1036   NtTestAlert  ... ) == 0x0
 02755  1624   NtWaitForSingleObject  ... ) == 0x0
 02779  1716   NtSetEventBoostPriority  ... ) == 0x0
 02778   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\3\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 02780  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 02782  1624   NtSetEventBoostPriority  (284, ...
 02783  1036   NtContinue  (97320240, 1, ...
 02784   896   NtResumeThread  (848, ...
 02756  1568   NtWaitForSingleObject  ... ) == 0x0
 02782  1624   NtSetEventBoostPriority  ... ) == 0x0
 02785  1972   NtWaitForSingleObject  (284, 0, 0x0, ...
 02786  1036   NtRegisterThreadTerminatePort  (24, ...
 02787  1568   NtSetEventBoostPriority  (284, ...
 02784   896   NtResumeThread  ... 1, ) == 0x0
 02788  1716   NtWaitForSingleObject  (284, 0, 0x0, ...
 02789  1624   NtWaitForSingleObject  (124, 0, 0x0, ...
 02790  1656   NtWaitForSingleObject  (88, 0, 0x0, ...
 02757  1964   NtWaitForSingleObject  ... ) == 0x0
 02787  1568   NtSetEventBoostPriority  ... ) == 0x0
 02786  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 02791   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02792  1964   NtSetEventBoostPriority  (284, ...
 02793  1036   NtWaitForSingleObject  (284, 0, 0x0, ...
 02794  1568   NtWaitForSingleObject  (124, 0, 0x0, ...
 02758   312   NtWaitForSingleObject  ... ) == 0x0
 02792  1964   NtSetEventBoostPriority  ... ) == 0x0
 02791   896   NtAllocateVirtualMemory  ... 99418112, 1048576, ) == 0x0
 02795   312   NtSetEventBoostPriority  (284, ...
 02759   164   NtWaitForSingleObject  ... ) == 0x0
 02796   164   NtSetEventBoostPriority  (284, ...
 02760  1564   NtWaitForSingleObject  ... ) == 0x0
 02797  1564   NtSetEventBoostPriority  (284, ...
 02762  1380   NtWaitForSingleObject  ... ) == 0x0
 02798  1380   NtSetEventBoostPriority  (284, ...
 02764  1512   NtWaitForSingleObject  ... ) == 0x0
 02799  1512   NtSetEventBoostPriority  (284, ...
 02765   752   NtWaitForSingleObject  ... ) == 0x0
 02800   752   NtSetEventBoostPriority  (284, ...
 02766   468   NtWaitForSingleObject  ... ) == 0x0
 02801   468   NtSetEventBoostPriority  (284, ...
 02767  1808   NtWaitForSingleObject  ... ) == 0x0
 02802  1808   NtSetEventBoostPriority  (284, ...
 02768  1336   NtWaitForSingleObject  ... ) == 0x0
 02803  1336   NtSetEventBoostPriority  (284, ...
 02769  1332   NtWaitForSingleObject  ... ) == 0x0
 02804  1332   NtSetEventBoostPriority  (284, ...
 02772  1440   NtWaitForSingleObject  ... ) == 0x0
 02805  1440   NtSetEventBoostPriority  (284, ...
 02774  1248   NtWaitForSingleObject  ... ) == 0x0
 02806  1248   NtSetEventBoostPriority  (284, ...
 02773  1664   NtWaitForSingleObject  ... ) == 0x0
 02807  1664   NtSetEventBoostPriority  (284, ...
 02775   384   NtWaitForSingleObject  ... ) == 0x0
 02808   384   NtSetEventBoostPriority  (284, ...
 02781   380   NtWaitForSingleObject  ... ) == 0x0
 02809   380   NtSetEventBoostPriority  (284, ...
 02788  1716   NtWaitForSingleObject  ... ) == 0x0
 02810  1716   NtSetEventBoostPriority  (284, ...
 02785  1972   NtWaitForSingleObject  ... ) == 0x0
 02811  1972   NtSetEventBoostPriority  (284, ...
 02793  1036   NtWaitForSingleObject  ... ) == 0x0
 02812  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 852, ) == 0x0
 02813  1036   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02810  1716   NtSetEventBoostPriority  ... ) == 0x0
 02814  1716   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02806  1248   NtSetEventBoostPriority  ... ) == 0x0
 02804  1332   NtSetEventBoostPriority  ... ) == 0x0
 02803  1336   NtSetEventBoostPriority  ... ) == 0x0
 02802  1808   NtSetEventBoostPriority  ... ) == 0x0
 02801   468   NtSetEventBoostPriority  ... ) == 0x0
 02800   752   NtSetEventBoostPriority  ... ) == 0x0
 02799  1512   NtSetEventBoostPriority  ... ) == 0x0
 02798  1380   NtSetEventBoostPriority  ... ) == 0x0
 02797  1564   NtSetEventBoostPriority  ... ) == 0x0
 02796   164   NtSetEventBoostPriority  ... ) == 0x0
 02795   312   NtSetEventBoostPriority  ... ) == 0x0
 02815   896   NtAllocateVirtualMemory  (-1, 100458496, 0, 8192, 4096, 4, ...
 02811  1972   NtSetEventBoostPriority  ... ) == 0x0
 02809   380   NtSetEventBoostPriority  ... ) == 0x0
 02808   384   NtSetEventBoostPriority  ... ) == 0x0
 02807  1664   NtSetEventBoostPriority  ... ) == 0x0
 02805  1440   NtSetEventBoostPriority  ... ) == 0x0
 02816  1964   NtWaitForSingleObject  (124, 0, 0x0, ...
 02813  1036   NtWaitForSingleObject  ... ) == 0x102
 02814  1716   NtWaitForSingleObject  ... ) == 0x102
 02817  1248   NtSetEventBoostPriority  (88, ...
 02818  1332   NtWaitForSingleObject  (124, 0, 0x0, ...
 02819  1336   NtWaitForSingleObject  (124, 0, 0x0, ...
 02820  1808   NtWaitForSingleObject  (124, 0, 0x0, ...
 02821   468   NtWaitForSingleObject  (124, 0, 0x0, ...
 02822   752   NtWaitForSingleObject  (124, 0, 0x0, ...
 02823  1380   NtWaitForSingleObject  (124, 0, 0x0, ...
 02824  1512   NtWaitForSingleObject  (124, 0, 0x0, ...
 02825  1564   NtWaitForSingleObject  (124, 0, 0x0, ...
 02826   164   NtWaitForSingleObject  (124, 0, 0x0, ...
 02815   896   NtAllocateVirtualMemory  ... 100458496, 8192, ) == 0x0
 02827  1972   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02828   380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02829   384   NtSetEventBoostPriority  (124, ...
 02830  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02831  1440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02832  1036   NtWaitForSingleObject  (124, 0, 0x0, ...
 02833  1716   NtWaitForSingleObject  (124, 0, 0x0, ...
 02790  1656   NtWaitForSingleObject  ... ) == 0x0
 02817  1248   NtSetEventBoostPriority  ... ) == 0x0
 02834   312   NtWaitForSingleObject  (124, 0, 0x0, ...
 02835   896   NtProtectVirtualMemory  (-1, (0x5fce000), 4096, 260, ...
 02827  1972   NtDuplicateObject  ... 856, ) == 0x0
 00856   420   NtWaitForSingleObject  ... ) == 0x0
 02829   384   NtSetEventBoostPriority  ... ) == 0x0
 02830  1664   NtDuplicateObject  ... 860, ) == 0x0
 02831  1440   NtDuplicateObject  ... 864, ) == 0x0
 02836  1656   NtTestAlert  (...
 02837  1248   NtTestAlert  (...
 02835   896   NtProtectVirtualMemory  ... (0x5fce000), 4096, 4, ) == 0x0
 02828   380   NtWaitForSingleObject  ... ) == 0x102
 02838   420   NtSetEventBoostPriority  (124, ...
 02839  1972   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02840   384   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 02841  1664   NtWaitForSingleObject  (284, 0, 0x0, ...
 02836  1656   NtTestAlert  ... ) == 0x0
 02837  1248   NtTestAlert  ... ) == 0x0
 02842   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00858   596   NtWaitForSingleObject  ... ) == 0x0
 02838   420   NtSetEventBoostPriority  ... ) == 0x0
 02843   380   NtWaitForSingleObject  (284, 0, 0x0, ...
 02839  1972   NtWaitForSingleObject  ... ) == 0x102
 02840   384   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 02844  1440   NtWaitForSingleObject  (284, 0, 0x0, ...
 02845  1248   NtContinue  (98368816, 1, ...
 02846  1656   NtContinue  (99417392, 1, ...
 02847   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 02848   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02849  1972   NtWaitForSingleObject  (284, 0, 0x0, ...
 02850   384   NtSetEventBoostPriority  (284, ...
 02851  1248   NtRegisterThreadTerminatePort  (24, ...
 02852  1656   NtRegisterThreadTerminatePort  (24, ...
 02842   896   NtCreateThread  ... 868, {1252, 760}, ) == 0x0
 02841  1664   NtWaitForSingleObject  ... ) == 0x0
 02850   384   NtSetEventBoostPriority  ... ) == 0x0
 02848   420   NtCreateEvent  ... 872, ) == 0x0
 02852  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 02853  1664   NtSetEventBoostPriority  (284, ...
 02854   896   NtQueryInformationThread  (868, Basic, 28, ...
 02855   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02856   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 02843   380   NtWaitForSingleObject  ... ) == 0x0
 02853  1664   NtSetEventBoostPriority  ... ) == 0x0
 02857  1656   NtWaitForSingleObject  (284, 0, 0x0, ...
 02854   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 02858   380   NtSetEventBoostPriority  (284, ...
 02859  1664   NtWaitForSingleObject  (284, 0, 0x0, ...
 02844  1440   NtWaitForSingleObject  ... ) == 0x0
 02858   380   NtSetEventBoostPriority  ... ) == 0x0
 02860   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0\344\4\0\0\370\2\0\0" ...  ...
 02851  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 02861  1440   NtSetEventBoostPriority  (284, ...
 02860   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\3\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 02847   596   NtWaitForSingleObject  ... ) == 0x0
 02861  1440   NtSetEventBoostPriority  ... ) == 0x0
 02862  1248   NtWaitForSingleObject  (284, 0, 0x0, ...
 02863   380   NtWaitForSingleObject  (124, 0, 0x0, ...
 02864   596   NtSetEventBoostPriority  (284, ...
 02865  1440   NtWaitForSingleObject  (284, 0, 0x0, ...
 02849  1972   NtWaitForSingleObject  ... ) == 0x0
 02864   596   NtSetEventBoostPriority  ... ) == 0x0
 02866   896   NtResumeThread  (868, ...
 02867  1972   NtSetEventBoostPriority  (284, ...
 02855   384   NtWaitForSingleObject  ... ) == 0x0
 02868   384   NtSetEventBoostPriority  (284, ...
 02856   420   NtWaitForSingleObject  ... ) == 0x0
 02869   420   NtSetEventBoostPriority  (284, ...
 02857  1656   NtWaitForSingleObject  ... ) == 0x0
 02870  1656   NtSetEventBoostPriority  (284, ...
 02859  1664   NtWaitForSingleObject  ... ) == 0x0
 02871  1664   NtSetEventBoostPriority  (284, ...
 02862  1248   NtWaitForSingleObject  ... ) == 0x0
 02872  1248   NtSetEventBoostPriority  (284, ...
 02865  1440   NtWaitForSingleObject  ... ) == 0x0
 02873  1440   NtWaitForSingleObject  (64, 0, {0, 0}, ... ) == 0x102
 02874  1440   NtWaitForSingleObject  (124, 0, 0x0, ...
 02872  1248   NtSetEventBoostPriority  ... ) == 0x0
 02870  1656   NtSetEventBoostPriority  ... ) == 0x0
 02869   420   NtSetEventBoostPriority  ... ) == 0x0
 02868   384   NtSetEventBoostPriority  ... ) == 0x0
 02867  1972   NtSetEventBoostPriority  ... ) == 0x0
 02866   896   NtResumeThread  ... 1, ) == 0x0
 02871  1664   NtSetEventBoostPriority  ... ) == 0x0
 02875   596   NtSetEventBoostPriority  (124, ...
 02876   760   NtTestAlert  (...
 02877  1248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02878  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02879   420   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ...
 02880   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02881   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02882  1664   NtWaitForSingleObject  (284, 0, 0x0, ...
 00867   376   NtWaitForSingleObject  ... ) == 0x0
 02875   596   NtSetEventBoostPriority  ... ) == 0x0
 02876   760   NtTestAlert  ... ) == 0x0
 02877  1248   NtDuplicateObject  ... 876, ) == 0x0
 02878  1656   NtDuplicateObject  ... 880, ) == 0x0
 02879   420   NtAllocateVirtualMemory  ... 1421312, 4096, ) == 0x0
 02881   896   NtAllocateVirtualMemory  ... 100466688, 1048576, ) == 0x0
 02883   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 02884   596   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02885   760   NtContinue  (100465968, 1, ...
 02886  1248   NtWaitForSingleObject  (284, 0, 0x0, ...
 02887  1656   NtWaitForSingleObject  (284, 0, 0x0, ...
 02888   420   NtSetEventBoostPriority  (284, ...
 02889   896   NtAllocateVirtualMemory  (-1, 101507072, 0, 8192, 4096, 4, ...
 02884   596   NtCreateEvent  ... 884, ) == 0x0
 02890   760   NtRegisterThreadTerminatePort  (24, ...
 02880   384   NtWaitForSingleObject  ... ) == 0x0
 02888   420   NtSetEventBoostPriority  ... ) == 0x0
 02889   896   NtAllocateVirtualMemory  ... 101507072, 8192, ) == 0x0
 02891   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 02892   384   NtSetEventBoostPriority  (284, ...
 02890   760   NtRegisterThreadTerminatePort  ... ) == 0x0
 02893   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 02894  1972   NtWaitForSingleObject  (124, 0, 0x0, ...
 02882  1664   NtWaitForSingleObject  ... ) == 0x0
 02892   384   NtSetEventBoostPriority  ... ) == 0x0
 02895   896   NtProtectVirtualMemory  (-1, (0x60ce000), 4096, 260, ...
 02896  1664   NtSetEventBoostPriority  (284, ...
 02897   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02883   376   NtWaitForSingleObject  ... ) == 0x0
 02896  1664   NtSetEventBoostPriority  ... ) == 0x0
 02895   896   NtProtectVirtualMemory  ... (0x60ce000), 4096, 4, ) == 0x0
 02898   760   NtWaitForSingleObject  (284, 0, 0x0, ...
 02899   376   NtSetEventBoostPriority  (284, ...
 02900   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02886  1248   NtWaitForSingleObject  ... ) == 0x0
 02899   376   NtSetEventBoostPriority  ... ) == 0x0
 02901  1248   NtSetEventBoostPriority  (284, ...
 02900   896   NtCreateThread  ... 888, {1252, 484}, ) == 0x0
 02902  1664   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02887  1656   NtWaitForSingleObject  ... ) == 0x0
 02901  1248   NtSetEventBoostPriority  ... ) == 0x0
 02903   896   NtQueryInformationThread  (888, Basic, 28, ...
 02904  1656   NtSetEventBoostPriority  (284, ...
 02902  1664   NtWaitForSingleObject  ... ) == 0x102
 02905   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 02891   596   NtWaitForSingleObject  ... ) == 0x0
 02904  1656   NtSetEventBoostPriority  ... ) == 0x0
 02903   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=484,}, 0x0, ) == 0x0
 02906  1664   NtWaitForSingleObject  (284, 0, 0x0, ...
 02907   596   NtSetEventBoostPriority  (284, ...
 02908  1248   NtWaitForSingleObject  (284, 0, 0x0, ...
 02909  1656   NtWaitForSingleObject  (284, 0, 0x0, ...
 02893   420   NtWaitForSingleObject  ... ) == 0x0
 02907   596   NtSetEventBoostPriority  ... ) == 0x0
 02910   420   NtSetEventBoostPriority  (284, ...
 02911   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\344\1\0\0" ...  ...
 02897   384   NtWaitForSingleObject  ... ) == 0x0
 02910   420   NtSetEventBoostPriority  ... ) == 0x0
 02912   384   NtSetEventBoostPriority  (284, ...
 02911   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81944, 0}  ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\3\0\0\344\4\0\0\344\1\0\0" )  ) == 0x0
 02913   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 02898   760   NtWaitForSingleObject  ... ) == 0x0
 02914   896   NtResumeThread  (888, ...
 02915   760   NtSetEventBoostPriority  (284, ...
 02914   896   NtResumeThread  ... 1, ) == 0x0
 02905   376   NtWaitForSingleObject  ... ) == 0x0
 02915   760   NtSetEventBoostPriority  ... ) == 0x0
 02916   376   NtSetEventBoostPriority  (284, ...
 02917   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02906  1664   NtWaitForSingleObject  ... ) == 0x0
 02916   376   NtSetEventBoostPriority  ... ) == 0x0
 02918   760   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02912   384   NtSetEventBoostPriority  ... ) == 0x0
 02919   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 02920   484   NtWaitForSingleObject  (284, 0, 0x0, ...
 02921  1664   NtSetEventBoostPriority  (284, ...
 02922   376   NtSetEventBoostPriority  (124, ...
 02917   896   NtAllocateVirtualMemory  ... 101515264, 1048576, ) == 0x0
 02923   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02908  1248   NtWaitForSingleObject  ... ) == 0x0
 02921  1664   NtSetEventBoostPriority  ... ) == 0x0
 02918   760   NtDuplicateObject  ... 892, ) == 0x0
 02924   896   NtAllocateVirtualMemory  (-1, 102555648, 0, 8192, 4096, 4, ...
 02925  1248   NtSetEventBoostPriority  (284, ...
 00963  1028   NtWaitForSingleObject  ... ) == 0x0
 02922   376   NtSetEventBoostPriority  ... ) == 0x0
 02926   760   NtWaitForSingleObject  (284, 0, 0x0, ...
 02909  1656   NtWaitForSingleObject  ... ) == 0x0
 02925  1248   NtSetEventBoostPriority  ... ) == 0x0
 02924   896   NtAllocateVirtualMemory  ... 102555648, 8192, ) == 0x0
 02927  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 02928   376   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02929  1656   NtSetEventBoostPriority  (284, ...
 02930  1248   NtWaitForSingleObject  (284, 0, 0x0, ...
 02931   896   NtProtectVirtualMemory  (-1, (0x61ce000), 4096, 260, ...
 02913   596   NtWaitForSingleObject  ... ) == 0x0
 02929  1656   NtSetEventBoostPriority  ... ) == 0x0
 02928   376   NtCreateEvent  ... 896, ) == 0x0
 02932  1664   NtWaitForSingleObject  (124, 0, 0x0, ...
 02933   596   NtSetEventBoostPriority  (284, ...
 02931   896   NtProtectVirtualMemory  ... (0x61ce000), 4096, 4, ) == 0x0
 02934  1656   NtWaitForSingleObject  (356, 0, 0x0, ...
 02935   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 02919   420   NtWaitForSingleObject  ... ) == 0x0
 02933   596   NtSetEventBoostPriority  ... ) == 0x0
 02936   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02937   420   NtSetEventBoostPriority  (284, ...
 02938   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 02920   484   NtWaitForSingleObject  ... ) == 0x0
 02937   420   NtSetEventBoostPriority  ... ) == 0x0
 02936   896   NtCreateThread  ... 900, {1252, 1580}, ) == 0x0
 02939   484   NtSetEventBoostPriority  (284, ...
 02940   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 02923   384   NtWaitForSingleObject  ... ) == 0x0
 02939   484   NtSetEventBoostPriority  ... ) == 0x0
 02941   896   NtQueryInformationThread  (900, Basic, 28, ...
 02942   384   NtSetEventBoostPriority  (284, ...
 02926   760   NtWaitForSingleObject  ... ) == 0x0
 02943   760   NtSetEventBoostPriority  (284, ...
 02927  1028   NtWaitForSingleObject  ... ) == 0x0
 02944  1028   NtSetEventBoostPriority  (284, ...
 02930  1248   NtWaitForSingleObject  ... ) == 0x0
 02945  1248   NtSetEventBoostPriority  (284, ...
 02935   376   NtWaitForSingleObject  ... ) == 0x0
 02946   376   NtSetEventBoostPriority  (284, ...
 02938   596   NtWaitForSingleObject  ... ) == 0x0
 02947   596   NtSetEventBoostPriority  (284, ...
 02940   420   NtWaitForSingleObject  ... ) == 0x0
 02948   420   NtAllocateVirtualMemory  (-1, 14471168, 0, 4096, 4096, 260, ... 14471168, 4096, ) == 0x0
 02949   420   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ... 1425408, 4096, ) == 0x0
 02946   376   NtSetEventBoostPriority  ... ) == 0x0
 02944  1028   NtSetEventBoostPriority  ... ) == 0x0
 02943   760   NtSetEventBoostPriority  ... ) == 0x0
 02942   384   NtSetEventBoostPriority  ... ) == 0x0
 02941   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 02947   596   NtSetEventBoostPriority  ... ) == 0x0
 02945  1248   NtSetEventBoostPriority  ... ) == 0x0
 02950   484   NtTestAlert  (...
 02951   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02952   376   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ...
 02953  1028   NtSetEventBoostPriority  (124, ...
 02954   760   NtWaitForSingleObject  (284, 0, 0x0, ...
 02955   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\3\0\0\344\4\0\0,\6\0\0" ...  ...
 02956   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 02957  1248   NtSetEventBoostPriority  (356, ...
 02950   484   NtTestAlert  ... ) == 0x0
 02951   420   NtCreateEvent  ... 904, ) == 0x0
 02952   376   NtAllocateVirtualMemory  ... 1429504, 4096, ) == 0x0
 00965  2012   NtWaitForSingleObject  ... ) == 0x0
 02953  1028   NtSetEventBoostPriority  ... ) == 0x0
 02955   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\3\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 02934  1656   NtWaitForSingleObject  ... ) == 0x0
 02957  1248   NtSetEventBoostPriority  ... ) == 0x0
 02958   484   NtContinue  (101514544, 1, ...
 02959   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02960  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 02961   376   NtSetEventBoostPriority  (284, ...
 02962  1028   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02963   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02964  1656   NtWaitForSingleObject  (284, 0, 0x0, ...
 02965   896   NtResumeThread  (900, ...
 02966   484   NtRegisterThreadTerminatePort  (24, ...
 02959   420   NtDuplicateObject  ... 908, ) == 0x0
 02954   760   NtWaitForSingleObject  ... ) == 0x0
 02961   376   NtSetEventBoostPriority  ... ) == 0x0
 02962  1028   NtCreateEvent  ... 912, ) == 0x0
 02965   896   NtResumeThread  ... 1, ) == 0x0
 02966   484   NtRegisterThreadTerminatePort  ... ) == 0x0
 02967   760   NtSetEventBoostPriority  (284, ...
 02968   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 02969   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 02970  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 02971   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02956   596   NtWaitForSingleObject  ... ) == 0x0
 02967   760   NtSetEventBoostPriority  ... ) == 0x0
 02972   484   NtWaitForSingleObject  (284, 0, 0x0, ...
 02973   596   NtSetEventBoostPriority  (284, ...
 02971   896   NtAllocateVirtualMemory  ... 102563840, 1048576, ) == 0x0
 02974   760   NtWaitForSingleObject  (356, 0, 0x0, ...
 02975  1248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02976  1580   NtWaitForSingleObject  (284, 0, 0x0, ...
 02960  2012   NtWaitForSingleObject  ... ) == 0x0
 02973   596   NtSetEventBoostPriority  ... ) == 0x0
 02977   896   NtAllocateVirtualMemory  (-1, 103604224, 0, 8192, 4096, 4, ...
 02975  1248   NtWaitForSingleObject  ... ) == 0x102
 02978  2012   NtSetEventBoostPriority  (284, ...
 02977   896   NtAllocateVirtualMemory  ... 103604224, 8192, ) == 0x0
 02964  1656   NtWaitForSingleObject  ... ) == 0x0
 02978  2012   NtSetEventBoostPriority  ... ) == 0x0
 02979  1248   NtWaitForSingleObject  (124, 0, 0x0, ...
 02980   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 02981  1656   NtSetEventBoostPriority  (284, ...
 02982   896   NtProtectVirtualMemory  (-1, (0x62ce000), 4096, 260, ...
 02963   384   NtWaitForSingleObject  ... ) == 0x0
 02982   896   NtProtectVirtualMemory  ... (0x62ce000), 4096, 4, ) == 0x0
 02983   384   NtSetEventBoostPriority  (284, ...
 02984   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02968   420   NtWaitForSingleObject  ... ) == 0x0
 02983   384   NtSetEventBoostPriority  ... ) == 0x0
 02985   420   NtSetEventBoostPriority  (284, ...
 02984   896   NtCreateThread  ... 916, {1252, 1756}, ) == 0x0
 02969   376   NtWaitForSingleObject  ... ) == 0x0
 02985   420   NtSetEventBoostPriority  ... ) == 0x0
 02986   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 02987   376   NtSetEventBoostPriority  (284, ...
 02988   896   NtQueryInformationThread  (916, Basic, 28, ...
 02981  1656   NtSetEventBoostPriority  ... ) == 0x0
 02989  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 02990   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 02970  1028   NtWaitForSingleObject  ... ) == 0x0
 02987   376   NtSetEventBoostPriority  ... ) == 0x0
 02988   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 02991  1028   NtSetEventBoostPriority  (284, ...
 02992  1656   NtSetEventBoostPriority  (356, ...
 02993   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 02972   484   NtWaitForSingleObject  ... ) == 0x0
 02991  1028   NtSetEventBoostPriority  ... ) == 0x0
 02974   760   NtWaitForSingleObject  ... ) == 0x0
 02992  1656   NtSetEventBoostPriority  ... ) == 0x0
 02994   484   NtSetEventBoostPriority  (284, ...
 02995   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\3\0\0\344\4\0\0\334\6\0\0" ...  ...
 02996   760   NtWaitForSingleObject  (284, 0, 0x0, ...
 02976  1580   NtWaitForSingleObject  ... ) == 0x0
 02997  1656   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02995   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\3\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 02998  1580   NtSetEventBoostPriority  (284, ...
 02997  1656   NtWaitForSingleObject  ... ) == 0x102
 02999   896   NtResumeThread  (916, ...
 02980   596   NtWaitForSingleObject  ... ) == 0x0
 02998  1580   NtSetEventBoostPriority  ... ) == 0x0
 03000  1656   NtWaitForSingleObject  (124, 0, 0x0, ...
 03001   596   NtSetEventBoostPriority  (284, ...
 02999   896   NtResumeThread  ... 1, ) == 0x0
 02994   484   NtSetEventBoostPriority  ... ) == 0x0
 03002  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03003  1580   NtTestAlert  (...
 03004  1756   NtWaitForSingleObject  (284, 0, 0x0, ...
 02986   384   NtWaitForSingleObject  ... ) == 0x0
 03001   596   NtSetEventBoostPriority  ... ) == 0x0
 03005   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03006   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03003  1580   NtTestAlert  ... ) == 0x0
 03007   384   NtSetEventBoostPriority  (284, ...
 03008   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03006   484   NtDuplicateObject  ... 920, ) == 0x0
 02989  2012   NtWaitForSingleObject  ... ) == 0x0
 03009  1580   NtContinue  (102563120, 1, ...
 03007   384   NtSetEventBoostPriority  ... ) == 0x0
 03005   896   NtAllocateVirtualMemory  ... 103612416, 1048576, ) == 0x0
 03010  2012   NtSetEventBoostPriority  (284, ...
 03011  1580   NtRegisterThreadTerminatePort  (24, ...
 03012   384   NtWaitForSingleObject  (356, 0, 0x0, ...
 03013   896   NtAllocateVirtualMemory  (-1, 104652800, 0, 8192, 4096, 4, ...
 02990   420   NtWaitForSingleObject  ... ) == 0x0
 03010  2012   NtSetEventBoostPriority  ... ) == 0x0
 03011  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 03014   420   NtSetEventBoostPriority  (284, ...
 03013   896   NtAllocateVirtualMemory  ... 104652800, 8192, ) == 0x0
 03015  2012   NtSetEventBoostPriority  (124, ...
 02993   376   NtWaitForSingleObject  ... ) == 0x0
 03014   420   NtSetEventBoostPriority  ... ) == 0x0
 03016  1580   NtWaitForSingleObject  (284, 0, 0x0, ...
 03017   896   NtProtectVirtualMemory  (-1, (0x63ce000), 4096, 260, ...
 03018   484   NtWaitForSingleObject  (284, 0, 0x0, ...
 03019   376   NtSetEventBoostPriority  (284, ...
 03020   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 00969  1168   NtWaitForSingleObject  ... ) == 0x0
 03015  2012   NtSetEventBoostPriority  ... ) == 0x0
 03017   896   NtProtectVirtualMemory  ... (0x63ce000), 4096, 4, ) == 0x0
 02996   760   NtWaitForSingleObject  ... ) == 0x0
 03019   376   NtSetEventBoostPriority  ... ) == 0x0
 03021  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03022  2012   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03023   760   NtSetEventBoostPriority  (284, ...
 03024   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03025   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03002  1028   NtWaitForSingleObject  ... ) == 0x0
 03022  2012   NtCreateEvent  ... 924, ) == 0x0
 03023   760   NtSetEventBoostPriority  ... ) == 0x0
 03024   896   NtCreateThread  ... 928, {1252, 1304}, ) == 0x0
 03026  1028   NtSetEventBoostPriority  (284, ...
 03027  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03028   896   NtQueryInformationThread  (928, Basic, 28, ...
 03004  1756   NtWaitForSingleObject  ... ) == 0x0
 03026  1028   NtSetEventBoostPriority  ... ) == 0x0
 03029  1756   NtSetEventBoostPriority  (284, ...
 03028   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 03008   596   NtWaitForSingleObject  ... ) == 0x0
 03029  1756   NtSetEventBoostPriority  ... ) == 0x0
 03030  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03031   596   NtSetEventBoostPriority  (284, ...
 03032   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\30\5\0\0" ...  ...
 03033   760   NtSetEventBoostPriority  (356, ...
 03034  1756   NtTestAlert  (...
 03018   484   NtWaitForSingleObject  ... ) == 0x0
 03032   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 03012   384   NtWaitForSingleObject  ... ) == 0x0
 03033   760   NtSetEventBoostPriority  ... ) == 0x0
 03034  1756   NtTestAlert  ... ) == 0x0
 03035   484   NtSetEventBoostPriority  (284, ...
 03031   596   NtSetEventBoostPriority  ... ) == 0x0
 03036   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 03037   760   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03038  1756   NtContinue  (103611696, 1, ...
 03016  1580   NtWaitForSingleObject  ... ) == 0x0
 03035   484   NtSetEventBoostPriority  ... ) == 0x0
 03039   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03037   760   NtWaitForSingleObject  ... ) == 0x102
 03040  1580   NtSetEventBoostPriority  (284, ...
 03041  1756   NtRegisterThreadTerminatePort  (24, ...
 03042   484   NtWaitForSingleObject  (284, 0, 0x0, ...
 03021  1168   NtWaitForSingleObject  ... ) == 0x0
 03043   760   NtWaitForSingleObject  (124, 0, 0x0, ...
 03041  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 03040  1580   NtSetEventBoostPriority  ... ) == 0x0
 03044   896   NtResumeThread  (928, ...
 03045  1168   NtSetEventBoostPriority  (284, ...
 03046  1756   NtWaitForSingleObject  (284, 0, 0x0, ...
 03047  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03044   896   NtResumeThread  ... 1, ) == 0x0
 03020   420   NtWaitForSingleObject  ... ) == 0x0
 03045  1168   NtSetEventBoostPriority  ... ) == 0x0
 03048  1304   NtWaitForSingleObject  (284, 0, 0x0, ...
 03047  1580   NtDuplicateObject  ... 932, ) == 0x0
 03049   420   NtSetEventBoostPriority  (284, ...
 03050   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03051  1168   NtSetEventBoostPriority  (124, ...
 03025   376   NtWaitForSingleObject  ... ) == 0x0
 03050   896   NtAllocateVirtualMemory  ... 104660992, 1048576, ) == 0x0
 00976  1180   NtWaitForSingleObject  ... ) == 0x0
 03051  1168   NtSetEventBoostPriority  ... ) == 0x0
 03052   376   NtSetEventBoostPriority  (284, ...
 03053  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03054   896   NtAllocateVirtualMemory  (-1, 105701376, 0, 8192, 4096, 4, ...
 03055  1168   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03027  2012   NtWaitForSingleObject  ... ) == 0x0
 03054   896   NtAllocateVirtualMemory  ... 105701376, 8192, ) == 0x0
 03055  1168   NtCreateEvent  ... 936, ) == 0x0
 03056  2012   NtSetEventBoostPriority  (284, ...
 03052   376   NtSetEventBoostPriority  ... ) == 0x0
 03049   420   NtSetEventBoostPriority  ... ) == 0x0
 03057  1580   NtWaitForSingleObject  (284, 0, 0x0, ...
 03058  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03030  1028   NtWaitForSingleObject  ... ) == 0x0
 03056  2012   NtSetEventBoostPriority  ... ) == 0x0
 03059   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03060   420   NtWaitForSingleObject  (356, 0, 0x0, ...
 03061  1028   NtSetEventBoostPriority  (284, ...
 03062   896   NtProtectVirtualMemory  (-1, (0x64ce000), 4096, 260, ...
 03036   384   NtWaitForSingleObject  ... ) == 0x0
 03063   384   NtSetEventBoostPriority  (284, ...
 03039   596   NtWaitForSingleObject  ... ) == 0x0
 03064   596   NtSetEventBoostPriority  (284, ...
 03042   484   NtWaitForSingleObject  ... ) == 0x0
 03065   484   NtSetEventBoostPriority  (284, ...
 03046  1756   NtWaitForSingleObject  ... ) == 0x0
 03066  1756   NtSetEventBoostPriority  (284, ...
 03048  1304   NtWaitForSingleObject  ... ) == 0x0
 03067  1304   NtSetEventBoostPriority  (284, ...
 03053  1180   NtWaitForSingleObject  ... ) == 0x0
 03068  1180   NtSetEventBoostPriority  (284, ...
 03057  1580   NtWaitForSingleObject  ... ) == 0x0
 03069  1580   NtSetEventBoostPriority  (284, ...
 03058  1168   NtWaitForSingleObject  ... ) == 0x0
 03070  1168   NtSetEventBoostPriority  (284, ...
 03059   376   NtWaitForSingleObject  ... ) == 0x0
 03071   376   NtAllocateVirtualMemory  (-1, 13422592, 0, 4096, 4096, 260, ... 13422592, 4096, ) == 0x0
 03070  1168   NtSetEventBoostPriority  ... ) == 0x0
 03069  1580   NtSetEventBoostPriority  ... ) == 0x0
 03068  1180   NtSetEventBoostPriority  ... ) == 0x0
 03067  1304   NtSetEventBoostPriority  ... ) == 0x0
 03064   596   NtSetEventBoostPriority  ... ) == 0x0
 03063   384   NtSetEventBoostPriority  ... ) == 0x0
 03062   896   NtProtectVirtualMemory  ... (0x64ce000), 4096, 4, ) == 0x0
 03066  1756   NtSetEventBoostPriority  ... ) == 0x0
 03065   484   NtSetEventBoostPriority  ... ) == 0x0
 03061  1028   NtSetEventBoostPriority  ... ) == 0x0
 03072  2012   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ...
 03073   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03074  1580   NtWaitForSingleObject  (284, 0, 0x0, ...
 03075  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03076  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03077  1304   NtTestAlert  (...
 03078   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03079   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03080  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03081   484   NtWaitForSingleObject  (356, 0, 0x0, ...
 03082  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03072  2012   NtAllocateVirtualMemory  ... 1433600, 4096, ) == 0x0
 03083   384   NtSetEventBoostPriority  (356, ...
 03077  1304   NtTestAlert  ... ) == 0x0
 03079   896   NtCreateThread  ... 940, {1252, 2052}, ) == 0x0
 03080  1756   NtDuplicateObject  ... 944, ) == 0x0
 03084  2012   NtSetEventBoostPriority  (284, ...
 03060   420   NtWaitForSingleObject  ... ) == 0x0
 03083   384   NtSetEventBoostPriority  ... ) == 0x0
 03085  1304   NtContinue  (104660272, 1, ...
 03086   896   NtQueryInformationThread  (940, Basic, 28, ...
 03087   420   NtWaitForSingleObject  (284, 0, 0x0, ...
 03073   376   NtWaitForSingleObject  ... ) == 0x0
 03084  2012   NtSetEventBoostPriority  ... ) == 0x0
 03088   384   NtWaitForSingleObject  (356, 0, 0x0, ...
 03089  1304   NtRegisterThreadTerminatePort  (24, ...
 03090   376   NtSetEventBoostPriority  (284, ...
 03086   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=2052,}, 0x0, ) == 0x0
 03091  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03075  1168   NtWaitForSingleObject  ... ) == 0x0
 03090   376   NtSetEventBoostPriority  ... ) == 0x0
 03089  1304   NtRegisterThreadTerminatePort  ... ) == 0x0
 03092  1756   NtWaitForSingleObject  (284, 0, 0x0, ...
 03093  1168   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ...
 03094   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03095  1304   NtWaitForSingleObject  (284, 0, 0x0, ...
 03093  1168   NtAllocateVirtualMemory  ... 1437696, 4096, ) == 0x0
 03096   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\3\0\0\344\4\0\0\4\10\0\0" ...  ...
 03097  1168   NtSetEventBoostPriority  (284, ...
 03096   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\3\0\0\344\4\0\0\4\10\0\0" )  ) == 0x0
 03098   896   NtResumeThread  (940, ... 1, ) == 0x0
 03099   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 105709568, 1048576, ) == 0x0
 03100   896   NtAllocateVirtualMemory  (-1, 106749952, 0, 8192, 4096, 4, ... 106749952, 8192, ) == 0x0
 03101   896   NtProtectVirtualMemory  (-1, (0x65ce000), 4096, 260, ... (0x65ce000), 4096, 4, ) == 0x0
 03102   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03076  1180   NtWaitForSingleObject  ... ) == 0x0
 03097  1168   NtSetEventBoostPriority  ... ) == 0x0
 03103  2052   NtWaitForSingleObject  (284, 0, 0x0, ...
 03104  1180   NtSetEventBoostPriority  (284, ...
 03105  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03078   596   NtWaitForSingleObject  ... ) == 0x0
 03104  1180   NtSetEventBoostPriority  ... ) == 0x0
 03106   596   NtSetEventBoostPriority  (284, ...
 03082  1028   NtWaitForSingleObject  ... ) == 0x0
 03107  1028   NtSetEventBoostPriority  (284, ...
 03074  1580   NtWaitForSingleObject  ... ) == 0x0
 03108  1580   NtSetEventBoostPriority  (284, ...
 03087   420   NtWaitForSingleObject  ... ) == 0x0
 03109   420   NtSetEventBoostPriority  (284, ...
 03091  2012   NtWaitForSingleObject  ... ) == 0x0
 03110  2012   NtSetEventBoostPriority  (284, ...
 03092  1756   NtWaitForSingleObject  ... ) == 0x0
 03111  1756   NtSetEventBoostPriority  (284, ...
 03094   376   NtWaitForSingleObject  ... ) == 0x0
 03112   376   NtSetEventBoostPriority  (284, ...
 03095  1304   NtWaitForSingleObject  ... ) == 0x0
 03113  1304   NtSetEventBoostPriority  (284, ...
 03103  2052   NtWaitForSingleObject  ... ) == 0x0
 03114  2052   NtSetEventBoostPriority  (284, ...
 03105  1168   NtWaitForSingleObject  ... ) == 0x0
 03115  1168   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ... 1441792, 4096, ) == 0x0
 03114  2052   NtSetEventBoostPriority  ... ) == 0x0
 03111  1756   NtSetEventBoostPriority  ... ) == 0x0
 03110  2012   NtSetEventBoostPriority  ... ) == 0x0
 03109   420   NtSetEventBoostPriority  ... ) == 0x0
 03107  1028   NtSetEventBoostPriority  ... ) == 0x0
 03106   596   NtSetEventBoostPriority  ... ) == 0x0
 03116  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03113  1304   NtSetEventBoostPriority  ... ) == 0x0
 03112   376   NtSetEventBoostPriority  ... ) == 0x0
 03108  1580   NtSetEventBoostPriority  ... ) == 0x0
 03102   896   NtCreateThread  ... 948, {1252, 2056}, ) == 0x0
 03117  1168   NtSetEventBoostPriority  (284, ...
 03118  1756   NtWaitForSingleObject  (284, 0, 0x0, ...
 03119  2052   NtTestAlert  (...
 03120  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03121   420   NtSetEventBoostPriority  (356, ...
 03122   596   NtAllocateVirtualMemory  (-1, 12111872, 0, 4096, 4096, 260, ...
 03123  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03124  1304   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03125   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03126  1580   NtWaitForSingleObject  (356, 0, 0x0, ...
 03127   896   NtQueryInformationThread  (948, Basic, 28, ...
 03117  1168   NtSetEventBoostPriority  ... ) == 0x0
 03116  1180   NtWaitForSingleObject  ... ) == 0x0
 03119  2052   NtTestAlert  ... ) == 0x0
 03081   484   NtWaitForSingleObject  ... ) == 0x0
 03121   420   NtSetEventBoostPriority  ... ) == 0x0
 03124  1304   NtDuplicateObject  ... 952, ) == 0x0
 03127   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=2056,}, 0x0, ) == 0x0
 03128  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03129  1180   NtSetEventBoostPriority  (284, ...
 03130   484   NtWaitForSingleObject  (284, 0, 0x0, ...
 03131  2052   NtContinue  (105708848, 1, ...
 03132   420   NtWaitForSingleObject  (472, 0, 0x0, ...
 03122   596   NtAllocateVirtualMemory  ... 12111872, 4096, ) == 0x0
 03133   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\10\10\0\0" ...  ...
 03120  2012   NtWaitForSingleObject  ... ) == 0x0
 03129  1180   NtSetEventBoostPriority  ... ) == 0x0
 03134  2052   NtRegisterThreadTerminatePort  (24, ...
 03135   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03136  2012   NtSetEventBoostPriority  (284, ...
 03133   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81949, 0}  ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\10\10\0\0" )  ) == 0x0
 03137  1180   NtSetEventBoostPriority  (124, ...
 03134  2052   NtRegisterThreadTerminatePort  ... ) == 0x0
 03118  1756   NtWaitForSingleObject  ... ) == 0x0
 03136  2012   NtSetEventBoostPriority  ... ) == 0x0
 03138  1304   NtWaitForSingleObject  (284, 0, 0x0, ...
 00982   928   NtWaitForSingleObject  ... ) == 0x0
 03137  1180   NtSetEventBoostPriority  ... ) == 0x0
 03139  1756   NtSetEventBoostPriority  (284, ...
 03140  2052   NtWaitForSingleObject  (284, 0, 0x0, ...
 03141  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03142   928   NtWaitForSingleObject  (284, 0, 0x0, ...
 03143   896   NtResumeThread  (948, ...
 03123  1028   NtWaitForSingleObject  ... ) == 0x0
 03139  1756   NtSetEventBoostPriority  ... ) == 0x0
 03144  1180   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03143   896   NtResumeThread  ... 1, ) == 0x0
 03145  1028   NtSetEventBoostPriority  (284, ...
 03146  1756   NtWaitForSingleObject  (356, 0, 0x0, ...
 03144  1180   NtCreateEvent  ... 956, ) == 0x0
 03147   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03125   376   NtWaitForSingleObject  ... ) == 0x0
 03145  1028   NtSetEventBoostPriority  ... ) == 0x0
 03148  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03149   376   NtSetEventBoostPriority  (284, ...
 03147   896   NtAllocateVirtualMemory  ... 106758144, 1048576, ) == 0x0
 03150  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03128  1168   NtWaitForSingleObject  ... ) == 0x0
 03149   376   NtSetEventBoostPriority  ... ) == 0x0
 03151   896   NtAllocateVirtualMemory  (-1, 107798528, 0, 8192, 4096, 4, ...
 03152  2056   NtWaitForSingleObject  (284, 0, 0x0, ...
 03153  1168   NtSetEventBoostPriority  (284, ...
 03151   896   NtAllocateVirtualMemory  ... 107798528, 8192, ) == 0x0
 03130   484   NtWaitForSingleObject  ... ) == 0x0
 03153  1168   NtSetEventBoostPriority  ... ) == 0x0
 03154   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03155   484   NtSetEventBoostPriority  (284, ...
 03156   896   NtProtectVirtualMemory  (-1, (0x66ce000), 4096, 260, ...
 03135   596   NtWaitForSingleObject  ... ) == 0x0
 03155   484   NtSetEventBoostPriority  ... ) == 0x0
 03157   596   NtSetEventBoostPriority  (284, ...
 03156   896   NtProtectVirtualMemory  ... (0x66ce000), 4096, 4, ) == 0x0
 03158  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03138  1304   NtWaitForSingleObject  ... ) == 0x0
 03157   596   NtSetEventBoostPriority  ... ) == 0x0
 03159   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03160  1304   NtSetEventBoostPriority  (284, ...
 03161   484   NtSetEventBoostPriority  (356, ...
 03140  2052   NtWaitForSingleObject  ... ) == 0x0
 03160  1304   NtSetEventBoostPriority  ... ) == 0x0
 03159   896   NtCreateThread  ... 960, {1252, 2060}, ) == 0x0
 03162  2052   NtSetEventBoostPriority  (284, ...
 03088   384   NtWaitForSingleObject  ... ) == 0x0
 03161   484   NtSetEventBoostPriority  ... ) == 0x0
 03163  1304   NtWaitForSingleObject  (284, 0, 0x0, ...
 03142   928   NtWaitForSingleObject  ... ) == 0x0
 03164   384   NtWaitForSingleObject  (284, 0, 0x0, ...
 03165   896   NtQueryInformationThread  (960, Basic, 28, ...
 03166   484   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03162  2052   NtSetEventBoostPriority  ... ) == 0x0
 03167   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03168   928   NtSetEventBoostPriority  (284, ...
 03165   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1252,Tid=2060,}, 0x0, ) == 0x0
 03166   484   NtWaitForSingleObject  ... ) == 0x102
 03169  2052   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03148  1180   NtWaitForSingleObject  ... ) == 0x0
 03168   928   NtSetEventBoostPriority  ... ) == 0x0
 03170   484   NtWaitForSingleObject  (124, 0, 0x0, ...
 03171  1180   NtSetEventBoostPriority  (284, ...
 03169  2052   NtDuplicateObject  ... 964, ) == 0x0
 03172   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\14\10\0\0" ...  ...
 03173   928   NtSetEventBoostPriority  (124, ...
 03141  2012   NtWaitForSingleObject  ... ) == 0x0
 03171  1180   NtSetEventBoostPriority  ... ) == 0x0
 03172   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\14\10\0\0" )  ) == 0x0
 03174  2012   NtSetEventBoostPriority  (284, ...
 00983   428   NtWaitForSingleObject  ... ) == 0x0
 03173   928   NtSetEventBoostPriority  ... ) == 0x0
 03175  2052   NtWaitForSingleObject  (284, 0, 0x0, ...
 03150  1028   NtWaitForSingleObject  ... ) == 0x0
 03176   428   NtWaitForSingleObject  (284, 0, 0x0, ...
 03177   896   NtResumeThread  (960, ...
 03178   928   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03179  1028   NtSetEventBoostPriority  (284, ...
 03177   896   NtResumeThread  ... 1, ) == 0x0
 03178   928   NtCreateEvent  ... 968, ) == 0x0
 03152  2056   NtWaitForSingleObject  ... ) == 0x0
 03180   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03181   928   NtWaitForSingleObject  (284, 0, 0x0, ...
 03182  2056   NtSetEventBoostPriority  (284, ...
 03179  1028   NtSetEventBoostPriority  ... ) == 0x0
 03174  2012   NtSetEventBoostPriority  ... ) == 0x0
 03183  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03184  2060   NtWaitForSingleObject  (88, 0, 0x0, ...
 03154   376   NtWaitForSingleObject  ... ) == 0x0
 03182  2056   NtSetEventBoostPriority  ... ) == 0x0
 03185  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03186  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03187   376   NtSetEventBoostPriority  (284, ...
 03180   896   NtAllocateVirtualMemory  ... 107806720, 1048576, ) == 0x0
 03158  1168   NtWaitForSingleObject  ... ) == 0x0
 03187   376   NtSetEventBoostPriority  ... ) == 0x0
 03188  1168   NtSetEventBoostPriority  (284, ...
 03189   896   NtAllocateVirtualMemory  (-1, 108847104, 0, 8192, 4096, 4, ...
 03164   384   NtWaitForSingleObject  ... ) == 0x0
 03188  1168   NtSetEventBoostPriority  ... ) == 0x0
 03190   376   NtWaitForSingleObject  (284, 0, 0x0, ...
 03191   384   NtSetEventBoostPriority  (284, ...
 03189   896   NtAllocateVirtualMemory  ... 108847104, 8192, ) == 0x0
 03192  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03193  2056   NtSetEventBoostPriority  (88, ...
 03167   596   NtWaitForSingleObject  ... ) == 0x0
 03191   384   NtSetEventBoostPriority  ... ) == 0x0
 03194   896   NtProtectVirtualMemory  (-1, (0x67ce000), 4096, 260, ...
 03195   596   NtSetEventBoostPriority  (284, ...
 03184  2060   NtWaitForSingleObject  ... ) == 0x0
 03193  2056   NtSetEventBoostPriority  ... ) == 0x0
 03163  1304   NtWaitForSingleObject  ... ) == 0x0
 03196  2060   NtTestAlert  (...
 03195   596   NtSetEventBoostPriority  ... ) == 0x0
 03194   896   NtProtectVirtualMemory  ... (0x67ce000), 4096, 4, ) == 0x0
 03197  1304   NtSetEventBoostPriority  (284, ...
 03196  2060   NtTestAlert  ... ) == 0x0
 03198  2056   NtTestAlert  (...
 03199   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03175  2052   NtWaitForSingleObject  ... ) == 0x0
 03200   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03197  1304   NtSetEventBoostPriority  ... ) == 0x0
 03201   384   NtSetEventBoostPriority  (356, ...
 03198  2056   NtTestAlert  ... ) == 0x0
 03202  2060   NtContinue  (107806000, 1, ...
 03203  2052   NtSetEventBoostPriority  (284, ...
 03204  1304   NtWaitForSingleObject  (356, 0, 0x0, ...
 03126  1580   NtWaitForSingleObject  ... ) == 0x0
 03201   384   NtSetEventBoostPriority  ... ) == 0x0
 03205  2056   NtContinue  (106757424, 1, ...
 03206  2060   NtRegisterThreadTerminatePort  (24, ...
 03176   428   NtWaitForSingleObject  ... ) == 0x0
 03203  2052   NtSetEventBoostPriority  ... ) == 0x0
 03207  1580   NtWaitForSingleObject  (284, 0, 0x0, ...
 03208   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03209  2056   NtRegisterThreadTerminatePort  (24, ...
 03210   428   NtSetEventBoostPriority  (284, ...
 03206  2060   NtRegisterThreadTerminatePort  ... ) == 0x0
 03211  2052   NtWaitForSingleObject  (356, 0, 0x0, ...
 03208   384   NtCreateEvent  ... 972, ) == 0x0
 03200   896   NtCreateThread  ... 976, {1252, 2064}, ) == 0x0
 03181   928   NtWaitForSingleObject  ... ) == 0x0
 03210   428   NtSetEventBoostPriority  ... ) == 0x0
 03212  2060   NtWaitForSingleObject  (284, 0, 0x0, ...
 03209  2056   NtRegisterThreadTerminatePort  ... ) == 0x0
 03213   384   NtWaitForSingleObject  (356, 0, 0x0, ...
 03214   928   NtSetEventBoostPriority  (284, ...
 03215   896   NtQueryInformationThread  (976, Basic, 28, ...
 03216  2056   NtWaitForSingleObject  (284, 0, 0x0, ...
 03183  1180   NtWaitForSingleObject  ... ) == 0x0
 03214   928   NtSetEventBoostPriority  ... ) == 0x0
 03215   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5b000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 03217  1180   NtSetEventBoostPriority  (284, ...
 03218   428   NtSetEventBoostPriority  (124, ...
 03185  1028   NtWaitForSingleObject  ... ) == 0x0
 03217  1180   NtSetEventBoostPriority  ... ) == 0x0
 03219   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\3\0\0\344\4\0\0\20\10\0\0" ...  ...
 03220  1028   NtSetEventBoostPriority  (284, ...
 01260  1024   NtWaitForSingleObject  ... ) == 0x0
 03218   428   NtSetEventBoostPriority  ... ) == 0x0
 03221  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03186  2012   NtWaitForSingleObject  ... ) == 0x0
 03222  1024   NtWaitForSingleObject  (284, 0, 0x0, ...
 03220  1028   NtSetEventBoostPriority  ... ) == 0x0
 03219   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\3\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 03223   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03224   928   NtWaitForSingleObject  (284, 0, 0x0, ...
 03225  2012   NtSetEventBoostPriority  (284, ...
 03226  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03223   428   NtCreateEvent  ... 980, ) == 0x0
 03190   376   NtWaitForSingleObject  ... ) == 0x0
 03225  2012   NtSetEventBoostPriority  ... ) == 0x0
 03227   376   NtSetEventBoostPriority  (284, ...
 03228   428   NtWaitForSingleObject  (284, 0, 0x0, ...
 03229   896   NtResumeThread  (976, ...
 03192  1168   NtWaitForSingleObject  ... ) == 0x0
 03229   896   NtResumeThread  ... 1, ) == 0x0
 03230  1168   NtSetEventBoostPriority  (284, ...
 03231   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03199   596   NtWaitForSingleObject  ... ) == 0x0
 03231   896   NtAllocateVirtualMemory  ... 108855296, 1048576, ) == 0x0
 03232   596   NtSetEventBoostPriority  (284, ...
 03233   896   NtAllocateVirtualMemory  (-1, 109895680, 0, 8192, 4096, 4, ...
 03207  1580   NtWaitForSingleObject  ... ) == 0x0
 03234  1580   NtSetEventBoostPriority  (284, ...
 03212  2060   NtWaitForSingleObject  ... ) == 0x0
 03235  2060   NtSetEventBoostPriority  (284, ...
 03216  2056   NtWaitForSingleObject  ... ) == 0x0
 03236  2056   NtSetEventBoostPriority  (284, ...
 03222  1024   NtWaitForSingleObject  ... ) == 0x0
 03237  1024   NtSetEventBoostPriority  (284, ...
 03221  1180   NtWaitForSingleObject  ... ) == 0x0
 03238  1180   NtSetEventBoostPriority  (284, ...
 03224   928   NtWaitForSingleObject  ... ) == 0x0
 03239   928   NtSetEventBoostPriority  (284, ...
 03226  1028   NtWaitForSingleObject  ... ) == 0x0
 03240  1028   NtSetEventBoostPriority  (284, ...
 03228   428   NtWaitForSingleObject  ... ) == 0x0
 03241   428   NtAllocateVirtualMemory  (-1, 1445888, 0, 4096, 4096, 4, ... 1445888, 4096, ) == 0x0
 03240  1028   NtSetEventBoostPriority  ... ) == 0x0
 03239   928   NtSetEventBoostPriority  ... ) == 0x0
 03237  1024   NtSetEventBoostPriority  ... ) == 0x0
 03236  2056   NtSetEventBoostPriority  ... ) == 0x0
 03235  2060   NtSetEventBoostPriority  ... ) == 0x0
 03234  1580   NtSetEventBoostPriority  ... ) == 0x0
 03233   896   NtAllocateVirtualMemory  ... 109895680, 8192, ) == 0x0
 03238  1180   NtSetEventBoostPriority  ... ) == 0x0
 03232   596   NtSetEventBoostPriority  ... ) == 0x0
 03230  1168   NtSetEventBoostPriority  ... ) == 0x0
 03227   376   NtSetEventBoostPriority  ... ) == 0x0
 03242  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03243  2064   NtWaitForSingleObject  (284, 0, 0x0, ...
 03244  1028   NtAllocateVirtualMemory  (-1, 16568320, 0, 4096, 4096, 260, ...
 03245   928   NtWaitForSingleObject  (284, 0, 0x0, ...
 03246   428   NtSetEventBoostPriority  (284, ...
 03247  1024   NtSetEventBoostPriority  (124, ...
 03248  2056   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03249  2060   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03250  1580   NtSetEventBoostPriority  (356, ...
 03251  1180   NtWaitForSingleObject  (284, 0, 0x0, ...
 03252   596   NtWaitForSingleObject  (284, 0, 0x0, ...
 03253  1168   NtWaitForSingleObject  (284, 0, 0x0, ...
 03254   376   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03255   896   NtProtectVirtualMemory  (-1, (0x68ce000), 4096, 260, ...
 03244  1028   NtAllocateVirtualMemory  ... 16568320, 4096, ) == 0x0
 03242  2012   NtWaitForSingleObject  ... ) == 0x0
 03246   428   NtSetEventBoostPriority  ... ) == 0x0
 01529  1708   NtWaitForSingleObject  ... ) == 0x0
 03247  1024   NtSetEventBoostPriority  ... ) == 0x0
 03248  2056   NtDuplicateObject  ... 984, ) == 0x0
 03249  2060   NtDuplicateObject  ... 988, ) == 0x0
 03146  1756   NtWaitForSingleObject  ... ) == 0x0
 03250  1580   NtSetEventBoostPriority  ... ) == 0x0
 03254   376   NtCreateEvent  ... 992, ) == 0x0
 03255   896   NtProtectVirtualMemory  ... (0x68ce000), 4096, 4, ) == 0x0
 03256  2012   NtSetEventBoostPriority  (284, ...
 03257  1028   NtWaitForSingleObject  (284, 0, 0x0, ...
 03258  1708   NtWaitForSingleObject  (284, 0, 0x0, ...
 03259   428   NtWaitForSingleObject  (284, 0, 0x0, ...
 03260  1024   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03261  2056   NtWaitForSingleObject  (284, 0, 0x0, ...
 03262  1756   NtWaitForSingleObject  (284, 0, 0x0, ...
 03263  2060   NtWaitForSingleObject  (284, 0, 0x0, ...
 03264  1580   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03243  2064   NtWaitForSingleObject  ... ) == 0x0
 03256  2012   NtSetEventBoostPriority  ... ) == 0x0
 03265   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03260  1024   NtCreateEvent  ... 996, ) == 0x0
 03266  2064   NtSetEventBoostPriority  (284, ...
 03264  1580   NtWaitForSingleObject  ... ) == 0x102
 03267  2012   NtWaitForSingleObject  (284, 0, 0x0, ...
 03265   896   NtCreateThread  ... 1000, {1252, 2068}, ) == 0x0
 03251  1180   NtWaitForSingleObject  ... ) == 0x0
 03266  2064   NtSetEventBoostPriority  ... ) == 0x0
 03268  1024   NtWaitForSingleObject  (284, 0, 0x0, ...
 03269  1580   NtWaitForSingleObject  (284, 0, 0x0, ...
 03270   376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03271  1180   NtSetEventBoostPriority  (284, ...
 03272   896   NtQueryInformationThread  (1000, Basic, 28, ...
 03273  2064   NtTestAlert  (...
 03252   596   NtWaitForSingleObject  ... ) == 0x0
 03271  1180   NtSetEventBoostPriority  ... ) == 0x0
 03270   376   NtDuplicateObject  ... 1004, ) == 0x0