Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 
NtCreateEvent(>) 
 100 

NtDelayExecution(>) 
 1 
NtNotifyChangeKey(>) 
 2 
NtQueryVirtualMemory(>) 
 10 
NtMapViewOfSection(>) 
 101 

NtGdiCreateBitmap(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtFsControlFile(>) 
 11 
NtWriteVirtualMemory(>) 
 116 

NtGdiInit(>) 
 1 
NtQueryDefaultUILanguage(>) 
 2 
NtSetInformationThread(>) 
 11 
NtResumeThread(>) 
 117 

NtGdiQueryFontAssocInfo(>) 
 1 
NtSetInformationObject(>) 
 2 
NtOpenThreadToken(>) 
 12 
NtQueryInformationThread(>) 
 122 

NtGdiSelectBitmap(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtSetInformationFile(>) 
 13 
NtQuerySystemInformation(>) 
 125 

NtOpenKeyedEvent(>) 
 1 
NtOpenProcessToken(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtOpenKey(>) 
 129 

NtOpenSymbolicLinkObject(>) 
 1 
NtOpenProcessTokenEx(>) 
 3 
NtQuerySection(>) 
 14 
NtCreateThread(>) 
 134 

NtQueryInstallUILanguage(>) 
 1 
NtOpenThreadTokenEx(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtRequestWaitReplyPort(>) 
 154 

NtQueryObject(>) 
 1 
NtQueryDefaultLocale(>) 
 3 
NtCreateFile(>) 
 16 
NtTestAlert(>) 
 161 

NtQueryPerformanceCounter(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtSetValueKey(>) 
 16 
NtRegisterThreadTerminatePort(>) 
 165 

NtQuerySymbolicLinkObject(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtCreateKey(>) 
 21 
NtDuplicateObject(>) 
 189 

NtQuerySystemTime(>) 
 1 
NtReadFile(>) 
 4 
NtOpenFile(>) 
 29 
NtQueryValueKey(>) 
 255 

NtRaiseException(>) 
 1 
NtWriteFile(>) 
 4 
NtOpenProcess(>) 
 29 
NtProtectVirtualMemory(>) 
 341 

NtSetInformationProcess(>) 
 1 
NtCreateMutant(>) 
 5 
NtDeviceIoControlFile(>) 
 36 
NtAllocateVirtualMemory(>) 
 351 

NtUserCallNoParam(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtQueryAttributesFile(>) 
 44 
NtClose(>) 
 377 

NtUserGetObjectInformation(>) 
 1 
NtQueryVolumeInformationFile(>) 
 5 
NtUnmapViewOfSection(>) 
 45 
NtSetEventBoostPriority(>) 
 563 

NtUserGetProcessWindowStation(>) 
 1 
NtQueryInformationToken(>) 
 6 
NtOpenSection(>) 
 51 
NtWaitForSingleObject(>) 
 783 

NtUserGetThreadDesktop(>) 
 1 
NtConnectPort(>) 
 7 
NtFlushInstructionCache(>) 
 53 

NtCallbackReturn(>) 
 2 
NtQueryInformationProcess(>) 
 7 
NtCreateSection(>) 
 75 

NtCreateIoCompletion(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 94224, 4, ... (0x409000), 98304, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 98304, 128, ... (0x409000), 98304, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 94224, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40283e,}, 4, ... ) == 0x0
 00260   896   NtQueryVirtualMemory  (-1, 0x402847, Basic, 28, ... {BaseAddress=0x402000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x7000,State=0x1000,Protect=0x80,Type=0x1000000,}, 28, ) == 0x0
 00261   896   NtContinue  (1244280, 0, ...
 00262   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 16, ) }, ... 16, ) == 0x0
 00263   896   NtCreateEvent  (0x1f0003, {24, 16, 0x80, 1245092, 0,  (0x1f0003, {24, 16, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 28, ) }, 1, 0, ... 28, ) == 0x0
 00264   896   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 32, ) }, {27086, 0}, 64, 134217728, 0, ... 32, ) == 0x0
 00265   896   NtMapViewOfSection  (32, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0x320000), 0x0, 28672, ) == 0x0
 00266   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 36, ) }, ... 36, ) == 0x0
 00267   896   NtQueryValueKey  (36,  (36, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00268   896   NtClose  (36, ... ) == 0x0
 00269   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00270   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.DLL"}, ... 36, ) }, ... 36, ) == 0x0
 00271   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00272   896   NtClose  (36, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00276   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00277   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00278   896   NtClose  (36, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00287   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00291   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00293   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00294   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 36, ) }, ... 36, ) == 0x0
 00295   896   NtQueryValueKey  (36,  (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00296   896   NtQueryValueKey  (36,  (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00297   896   NtClose  (36, ... ) == 0x0
 00298   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 36, ) }, ... 36, ) == 0x0
 00299   896   NtQueryValueKey  (36,  (36, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00300   896   NtClose  (36, ... ) == 0x0
 00301   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 36, ) }, ... 36, ) == 0x0
 00302   896   NtSetInformationObject  (36, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00303   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00305   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00306   896   NtOpenProcessToken  (-1, 0x20, ... 40, ) == 0x0
 00307   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00308   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00309   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 44, ) }, ... 44, ) == 0x0
 00310   896   NtQueryValueKey  (44,  (44, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   896   NtClose  (44, ... ) == 0x0
 00312   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00313   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 44, ) == 0x0
 00314   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 48, ) == 0x0
 00315   896   NtQuerySystemTime  (... {1412735414, 29929616}, ) == 0x0
 00316   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00317   896   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00318   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00319   896   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00320   896   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00321   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00322   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 60, ) == 0x0
 00323   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 64, ) }, ... 64, ) == 0x0
 00324   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "ActiveComputerName"}, ... 68, ) }, ... 68, ) == 0x0
 00325   896   NtQueryValueKey  (68,  (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 00326   896   NtClose  (68, ... ) == 0x0
 00327   896   NtClose  (64, ... ) == 0x0
 00328   896   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 64, ) == 0x0
 00329   896   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 68, ) == 0x0
 00330   896   NtDuplicateObject  (-1, 64, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00331   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00332   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00333   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00334   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00335   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00336   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243252,  (0xc0100080, {24, 0, 0x40, 0, 1243252, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) == 0x0
 00337   896   NtSetInformationFile  (80, 1243308, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00338   896   NtSetInformationFile  (80, 1243296, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00339   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00340   896   NtWriteFile  (80, 57, 0, 0,  (80, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00341   896   NtReadFile  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00342   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00343   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0X@\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \0X@\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0X@\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) == 0x103
 00344   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00345   896   NtClose  (76, ... ) == 0x0
 00346   896   NtClose  (80, ... ) == 0x0
 00347   896   NtAdjustPrivilegesToken  (40, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00348   896   NtClose  (40, ... ) == 0x0
 00349   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 3342336, 65536, ) == 0x0
 00350   896   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00351   896   NtCreateSection  (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 40, ) == 0x0
 00352   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00353   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00354   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00355   896   NtFreeVirtualMemory  (-1, (0x330000), 0, 32768, ... (0x330000), 65536, ) == 0x0
 00356   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00357   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00358   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00359   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00360   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00361   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00362   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00363   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00364   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00365   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00366   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00367   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 80, ) == 0x0
 00368   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 76, ) }, ... 76, ) == 0x0
 00369   896   NtMapViewOfSection  (76, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00370   896   NtClose  (76, ... ) == 0x0
 00371   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00372   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00373   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00374   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00375   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00376   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00377   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00378   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00379   896   NtAllocateVirtualMemory  (80, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 00380   896   NtAllocateVirtualMemory  (80, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 00381   896   NtProtectVirtualMemory  (80, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 00382   896   NtCreateThread  (0x1f03ff, 0x0, 80, 1243840, 1243784, 1, ... 76, {580, 2016}, ) == 0x0
 00383   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" )  ) == 0x0
 00384   896   NtResumeThread  (76, ... 1, ) == 0x0
 00385   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00386   896   NtClose  (80, ... ) == 0x0
 00387   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00388   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00389   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 80, ) == 0x0
 00390   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00391   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00392   896   NtClose  (84, ... ) == 0x0
 00393   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00394   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00395   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00396   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00397   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00398   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00399   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00400   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00401   896   NtClose  (80, ... ) == 0x0
 00402   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00403   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00404   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 80, ) == 0x0
 00405   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00406   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00407   896   NtClose  (84, ... ) == 0x0
 00408   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00409   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00410   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00411   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00412   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00413   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00414   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00415   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00416   896   NtClose  (80, ... ) == 0x0
 00417   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00418   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00419   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 80, ) == 0x0
 00420   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00421   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00422   896   NtClose  (84, ... ) == 0x0
 00423   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00424   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00425   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00426   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00427   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00428   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00429   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00430   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00431   896   NtClose  (80, ... ) == 0x0
 00432   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00433   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00434   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 80, ) == 0x0
 00435   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00436   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00437   896   NtClose  (84, ... ) == 0x0
 00438   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00439   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00440   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00441   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00442   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00443   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00444   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00445   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00446   896   NtClose  (80, ... ) == 0x0
 00447   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00448   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00449   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 80, ) == 0x0
 00450   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00451   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff50000), 0x0, 28672, ) == 0x0
 00452   896   NtClose  (84, ... ) == 0x0
 00453   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00454   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Md\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00455   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00456   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00457   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00458   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00459   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00460   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00461   896   NtClose  (80, ... ) == 0x0
 00462   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00463   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00464   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 80, ) == 0x0
 00465   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00466   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00467   896   NtClose  (84, ... ) == 0x0
 00468   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00469   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00470   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00471   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00472   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00473   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00474   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00475   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00476   896   NtClose  (80, ... ) == 0x0
 00477   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00478   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00479   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 80, ) == 0x0
 00480   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00481   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00482   896   NtClose  (84, ... ) == 0x0
 00483   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00484   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00485   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00486   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00487   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00488   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00489   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00490   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00491   896   NtClose  (80, ... ) == 0x0
 00492   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00493   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00494   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 80, ) == 0x0
 00495   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00496   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00497   896   NtClose  (84, ... ) == 0x0
 00498   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00499   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00500   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00501   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00502   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00503   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00504   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00505   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00506   896   NtClose  (80, ... ) == 0x0
 00507   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00508   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00509   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 80, ) == 0x0
 00510   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00511   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00512   896   NtClose  (84, ... ) == 0x0
 00513   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00514   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00515   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00516   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00517   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00518   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00519   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00520   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00521   896   NtClose  (80, ... ) == 0x0
 00522   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00523   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00524   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 80, ) == 0x0
 00525   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00526   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00527   896   NtClose  (84, ... ) == 0x0
 00528   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00529   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00530   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00531   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00532   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00533   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00534   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00535   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00536   896   NtClose  (80, ... ) == 0x0
 00537   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00538   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00539   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 80, ) == 0x0
 00540   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00541   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00542   896   NtClose  (84, ... ) == 0x0
 00543   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00544   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00545   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00546   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00547   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00548   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00549   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00550   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00551   896   NtClose  (80, ... ) == 0x0
 00552   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00553   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00554   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 80, ) == 0x0
 00555   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00556   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00557   896   NtClose  (84, ... ) == 0x0
 00558   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00559   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00560   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00561   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00562   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00563   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00564   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00565   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00566   896   NtClose  (80, ... ) == 0x0
 00567   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00568   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00569   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 80, ) == 0x0
 00570   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00571   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00572   896   NtClose  (84, ... ) == 0x0
 00573   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00574   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00575   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00576   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00577   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00578   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00579   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00580   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00581   896   NtClose  (80, ... ) == 0x0
 00582   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00583   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00584   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 80, ) == 0x0
 00585   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00586   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00587   896   NtClose  (84, ... ) == 0x0
 00588   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00589   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00590   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00591   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00592   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00593   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00594   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00595   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00596   896   NtClose  (80, ... ) == 0x0
 00597   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00598   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00599   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 80, ) == 0x0
 00600   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00601   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00602   896   NtClose  (84, ... ) == 0x0
 00603   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00604   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00605   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00606   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00607   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00608   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00609   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00610   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00611   896   NtClose  (80, ... ) == 0x0
 00612   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00613   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00614   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 80, ) == 0x0
 00615   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00616   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00617   896   NtClose  (84, ... ) == 0x0
 00618   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00619   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00620   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00621   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00622   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00623   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00624   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00625   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00626   896   NtClose  (80, ... ) == 0x0
 00627   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00628   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00629   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 80, ) == 0x0
 00630   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00631   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00632   896   NtClose  (84, ... ) == 0x0
 00633   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00634   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00635   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00636   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00637   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00638   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00639   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00640   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00641   896   NtClose  (80, ... ) == 0x0
 00642   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00643   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00644   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 80, ) == 0x0
 00645   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00646   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00647   896   NtClose  (84, ... ) == 0x0
 00648   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00649   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00650   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00651   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00652   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00653   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00654   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00655   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00656   896   NtClose  (80, ... ) == 0x0
 00657   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00658   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00659   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 80, ) == 0x0
 00660   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00661   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00662   896   NtClose  (84, ... ) == 0x0
 00663   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00664   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00665   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00666   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00667   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00668   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00669   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00670   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00671   896   NtClose  (80, ... ) == 0x0
 00672   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00673   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00674   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 80, ) == 0x0
 00675   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00676   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00677   896   NtClose  (84, ... ) == 0x0
 00678   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00679   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00680   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00681   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00682   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00683   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00684   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00685   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00686   896   NtClose  (80, ... ) == 0x0
 00687   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00688   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00689   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {784, 0}, ... 80, ) == 0x0
 00690   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00691   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00692   896   NtClose  (84, ... ) == 0x0
 00693   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00694   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00695   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00696   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00697   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00698   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00699   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00700   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00701   896   NtClose  (80, ... ) == 0x0
 00702   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00703   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00704   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {488, 0}, ... 80, ) == 0x0
 00705   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00706   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00707   896   NtClose  (84, ... ) == 0x0
 00708   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00709   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00710   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00711   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00712   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00713   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00714   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00715   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00716   896   NtClose  (80, ... ) == 0x0
 00717   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00718   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00719   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1208, 0}, ... 80, ) == 0x0
 00720   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00721   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00722   896   NtClose  (84, ... ) == 0x0
 00723   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00724   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00725   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00726   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00727   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00728   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00729   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00730   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00731   896   NtClose  (80, ... ) == 0x0
 00732   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00733   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00734   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {168, 0}, ... 80, ) == 0x0
 00735   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00736   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00737   896   NtClose  (84, ... ) == 0x0
 00738   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00739   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00740   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00741   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00742   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00743   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00744   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00745   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00746   896   NtClose  (80, ... ) == 0x0
 00747   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00748   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00749   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {764, 0}, ... 80, ) == 0x0
 00750   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00751   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00752   896   NtClose  (84, ... ) == 0x0
 00753   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00754   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00755   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00756   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00757   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00758   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00759   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00760   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00761   896   NtClose  (80, ... ) == 0x0
 00762   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00763   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00764   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {868, 0}, ... 80, ) == 0x0
 00765   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00766   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00767   896   NtClose  (84, ... ) == 0x0
 00768   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00769   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00770   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00771   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00772   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00773   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00774   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00775   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00776   896   NtClose  (80, ... ) == 0x0
 00777   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00778   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00779   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {808, 0}, ... 80, ) == 0x0
 00780   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00781   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00782   896   NtClose  (84, ... ) == 0x0
 00783   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00784   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00785   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00786   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00787   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00788   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00789   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00790   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00791   896   NtClose  (80, ... ) == 0x0
 00792   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00793   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00794   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 80, ) == 0x0
 00795   896   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00796   896   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00797   896   NtClose  (84, ... ) == 0x0
 00798   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00799   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00800   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00801   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00802   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00803   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00804   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00805   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00806   896   NtClose  (80, ... ) == 0x0
 00807   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00808   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00809   896   NtClose  (40, ... ) == 0x0
 00810   896   NtClose  (28, ... ) == 0x0
 00811   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00812   896   NtContinue  (1244400, 0, ...
 00813   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3342336, 4096, ) == 0x0
 00814   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00815   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00816   896   NtClose  (28, ... ) == 0x0
 00817   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00818   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00819   896   NtClose  (28, ... ) == 0x0
 00820   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00821   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00822   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00823   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00824   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00825   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00826   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00827   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00828   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00829   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00830   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00831   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00832   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00833   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00834   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00835   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00836   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00837   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00838   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00839   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00840   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00841   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00842   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00843   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00844   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00845   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00846   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 40, ) == 0x0
 00847   896   NtClose  (28, ... ) == 0x0
 00848   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00849   896   NtClose  (40, ... ) == 0x0
 00850   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00851   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00852   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00853   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 40, ... 28, ) == 0x0
 00854   896   NtClose  (40, ... ) == 0x0
 00855   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00856   896   NtClose  (28, ... ) == 0x0
 00857   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00858   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00859   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00860   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 40, ) == 0x0
 00861   896   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00862   896   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00863   896   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00864   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00865   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00866   896   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00867   896   NtClose  (84, ... ) == 0x0
 00868   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00869   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00870   896   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00871   896   NtClose  (84, ... ) == 0x0
 00872   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00873   896   NtClose  (80, ... ) == 0x0
 00874   896   NtClose  (28, ... ) == 0x0
 00875   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00876   896   NtClose  (40, ... ) == 0x0
 00877   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00878   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00879   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00880   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00881   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00882   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00883   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00884   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00885   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00886   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00887   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00888   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00889   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00890   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00891   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00892   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 40, ) }, ... 40, ) == 0x0
 00893   896   NtQueryValueKey  (40,  (40, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00894   896   NtClose  (40, ... ) == 0x0
 00895   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x500000), 0x0, 1060864, ) == 0x0
 00896   896   NtClose  (-2147482756, ... ) == 0x0
 00897   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 40, ) == 0x0
 00898   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00899   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00900   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00901   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00902   896   NtClose  (-2147482756, ... ) == 0x0
 00903   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00904   896   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00905   896   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00906   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00907   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00908   896   NtClose  (-2147482756, ... ) == 0x0
 00909   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00910   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00911   896   NtClose  (-2147482756, ... ) == 0x0
 00912   896   NtQueryDefaultLocale  (0, -142628532, ... ) == 0x0
 00913   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00914   896   NtUserCallNoParam  (24, ... ) == 0x0
 00915   896   NtGdiCreateCompatibleDC  (0, ...
 00916   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00915   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00917   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00918   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00919   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00920   896   NtGdiCreateSolidBrush  (0, 0, ...
 00921   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00920   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00922   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00923   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00924   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00925   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x50
 00926   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 88, ) }, ... 88, ) == 0x0
 00927   896   NtQueryValueKey  (88,  (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00928   896   NtClose  (88, ... ) == 0x0
 00929   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00930   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00931   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00932   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00933   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00934   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00935   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00936   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00937   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00938   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00939   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00940   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00941   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00942   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00943   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00944   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00945   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00946   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00947   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00948   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00949   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00950   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00951   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00952   896   NtCallbackReturn  (0, 0, 0, ...
 00953   896   NtGdiInit  (... ) == 0x1
 00954   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00955   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00956   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 3538944, 28672, ) == 0x0
 00957   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00958   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00959   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00960   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00961   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 88, ... 92, ) == 0x0
 00962   896   NtQuerySection  (92, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00963   896   NtClose  (88, ... ) == 0x0
 00964   896   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00965   896   NtClose  (92, ... ) == 0x0
 00966   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00967   896   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00968   896   NtClose  (92, ... ) == 0x0
 00969   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00970   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00971   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00972   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00973   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00974   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00975   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00976   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00977   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00978   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00979   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00980   896   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00981   896   NtClose  (92, ... ) == 0x0
 00982   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00983   896   NtClose  (88, ... ) == 0x0
 00984   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00985   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00986   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00987   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00988   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00989   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00990   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00991   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00992   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 00993   896   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 00994   896   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 00995   896   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 00996   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 88, ) }, ... 88, ) == 0x0
 00997   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x380000), 0x0, 12288, ) == 0x0
 00998   896   NtClose  (88, ... ) == 0x0
 00999   896   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 01000   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01001   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01002   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01003   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 01004   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01005   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01006   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01007   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01008   896   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 28672, ) == 0x0
 01009   896   NtFreeVirtualMemory  (-1, (0x330144), 0, 32768, ... (0x330000), 4096, ) == 0x0
 01010   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01011   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3342336, 65536, ) == 0x0
 01012   896   NtAllocateVirtualMemory  (-1, 3342336, 0, 4096, 4096, 4, ... 3342336, 4096, ) == 0x0
 01013   896   NtAllocateVirtualMemory  (-1, 3346432, 0, 20480, 4096, 4, ... 3346432, 20480, ) == 0x0
 01014   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9502720, 1048576, ) == 0x0
 01015   896   NtAllocateVirtualMemory  (-1, 9502720, 0, 32768, 4096, 4, ... 9502720, 32768, ) == 0x0
 01016   896   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "Jobaka3"}, 0, ... 88, ) }, 0, ... 88, ) == 0x0
 01017   896   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01018   896   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01019   896   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01020   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 96, ) == 0x0
 01021   896   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "Protocol_Catalog9"}, ... 100, ) }, ... 100, ) == 0x0
 01022   896   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01023   896   NtNotifyChangeKey  (100, 96, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01024   896   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01025   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01026   896   NtQueryValueKey  (100,  (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01027   896   NtQueryValueKey  (100,  (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01028   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Catalog_Entries"}, ... 104, ) }, ... 104, ) == 0x0
 01029   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000001"}, ... 108, ) }, ... 108, ) == 0x0
 01030   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01031   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 01032   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01033   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\12\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\12\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\13\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\13\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\15\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\12\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\12\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\13\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\13\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\15\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\15\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\12\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\12\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\13\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\13\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\14\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\15\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01034   896   NtClose  (108, ... ) == 0x0
 01035   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000002"}, ... 108, ) }, ... 108, ) == 0x0
 01036   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01037   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01038   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01039   896   NtClose  (108, ... ) == 0x0
 01040   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000003"}, ... 108, ) }, ... 108, ) == 0x0
 01041   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01042   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01043   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01044   896   NtClose  (108, ... ) == 0x0
 01045   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000004"}, ... 108, ) }, ... 108, ) == 0x0
 01046   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01047   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01048   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 01049   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\32\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\32\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\33\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\32\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\32\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\33\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\32\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\32\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\33\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\35\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01050   896   NtClose  (108, ... ) == 0x0
 01051   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000005"}, ... 108, ) }, ... 108, ) == 0x0
 01052   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01053   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01054   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01055   896   NtClose  (108, ... ) == 0x0
 01056   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000006"}, ... 108, ) }, ... 108, ) == 0x0
 01057   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01058   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01059   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01060   896   NtClose  (108, ... ) == 0x0
 01061   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000007"}, ... 108, ) }, ... 108, ) == 0x0
 01062   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01063   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01064   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01065   896   NtClose  (108, ... ) == 0x0
 01066   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000008"}, ... 108, ) }, ... 108, ) == 0x0
 01067   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01068   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01069   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01070   896   NtClose  (108, ... ) == 0x0
 01071   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000009"}, ... 108, ) }, ... 108, ) == 0x0
 01072   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01073   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01074   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 01075   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\04\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\04\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\05\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\05\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\04\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\04\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\05\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\05\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\04\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\04\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\05\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\05\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\07\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01076   896   NtClose  (108, ... ) == 0x0
 01077   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000010"}, ... 108, ) }, ... 108, ) == 0x0
 01078   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01079   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01080   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01081   896   NtClose  (108, ... ) == 0x0
 01082   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000011"}, ... 108, ) }, ... 108, ) == 0x0
 01083   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01084   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01085   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01086   896   NtClose  (108, ... ) == 0x0
 01087   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000012"}, ... 108, ) }, ... 108, ) == 0x0
 01088   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01089   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01090   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01091   896   NtClose  (108, ... ) == 0x0
 01092   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000013"}, ... 108, ) }, ... 108, ) == 0x0
 01093   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01094   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01095   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01096   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0I\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0I\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0J\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0J\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0I\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0I\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0J\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0J\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0I\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0I\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0J\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0J\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0L\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01097   896   NtClose  (108, ... ) == 0x0
 01098   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000014"}, ... 108, ) }, ... 108, ) == 0x0
 01099   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01100   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01101   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01102   896   NtClose  (108, ... ) == 0x0
 01103   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000015"}, ... 108, ) }, ... 108, ) == 0x0
 01104   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01105   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01106   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01107   896   NtClose  (108, ... ) == 0x0
 01108   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000016"}, ... 108, ) }, ... 108, ) == 0x0
 01109   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01110   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01111   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01112   896   NtClose  (108, ... ) == 0x0
 01113   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000017"}, ... 108, ) }, ... 108, ) == 0x0
 01114   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01115   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01116   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01117   896   NtClose  (108, ... ) == 0x0
 01118   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000018"}, ... 108, ) }, ... 108, ) == 0x0
 01119   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01120   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01121   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01122   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0c\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0c\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0d\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0c\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0c\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0d\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0c\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0c\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0d\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0f\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01123   896   NtClose  (108, ... ) == 0x0
 01124   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000019"}, ... 108, ) }, ... 108, ) == 0x0
 01125   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01126   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01127   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01128   896   NtClose  (108, ... ) == 0x0
 01129   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000020"}, ... 108, ) }, ... 108, ) == 0x0
 01130   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01131   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01132   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01133   896   NtClose  (108, ... ) == 0x0
 01134   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000021"}, ... 108, ) }, ... 108, ) == 0x0
 01135   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01136   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01137   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\334\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01138   896   NtClose  (108, ... ) == 0x0
 01139   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000022"}, ... 108, ) }, ... 108, ) == 0x0
 01140   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01141   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01142   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01143   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0x\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0x\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0|\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0X@\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0x\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0x\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0|\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0X@\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0x\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0x\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0{\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0|\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0X@\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01144   896   NtClose  (108, ... ) == 0x0
 01145   896   NtClose  (104, ... ) == 0x0
 01146   896   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01147   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 01148   896   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 108, ) }, ... 108, ) == 0x0
 01149   896   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01150   896   NtNotifyChangeKey  (108, 104, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01151   896   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01152   896   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01153   896   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01154   896   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 01155   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 01156   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01157   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01158   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01159   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01160   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01161   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01162   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01163   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01164   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01165   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01166   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01167   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01168   896   NtClose  (116, ... ) == 0x0
 01169   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 01170   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01171   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01172   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01173   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01174   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01175   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01176   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01177   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01178   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01179   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01180   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01181   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01182   896   NtClose  (116, ... ) == 0x0
 01183   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 01184   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01185   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01186   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01187   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01188   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01189   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01190   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01191   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01192   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01193   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01194   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01195   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01196   896   NtClose  (116, ... ) == 0x0
 01197   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 01198   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01199   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01200   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01201   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01202   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01203   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01204   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01205   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01206   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01207   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01208   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01209   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01210   896   NtClose  (116, ... ) == 0x0
 01211   896   NtClose  (112, ... ) == 0x0
 01212   896   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01213   896   NtClose  (92, ... ) == 0x0
 01214   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01215   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01216   896   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01217   896   NtQueryValueKey  (92,  (92, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   896   NtClose  (92, ... ) == 0x0
 01219   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 92, ) == 0x0
 01220   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01221   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1241400, ... ) }, 1241400, ... ) == 0x0
 01222   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 112, {status=0x0, info=1}, ) }, 7, 2113568, ... 112, {status=0x0, info=1}, ) == 0x0
 01223   896   NtSetInformationFile  (112, 1241376, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 01224   896   NtClose  (112, ... ) == 0x0
 01225   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) == 0x0
 01226   896   NtQueryInformationFile  (112, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01227   896   NtQueryInformationFile  (112, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01228   896   NtQueryInformationFile  (112, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01229   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01230   896   NtQueryInformationFile  (112, 1364040, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01231   896   NtQueryInformationFile  (112, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01232   896   NtQueryInformationFile  (112, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01233   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 1239736, ... ) }, 1239736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01234   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01235   896   NtClose  (-2147482756, ... ) == 0x0
 01234   896   NtCreateFile  ... 116, {status=0x0, info=2}, ) == 0x0
 01236   896   NtQueryVolumeInformationFile  (116, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01237   896   NtQueryInformationFile  (116, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01238   896   NtQueryVolumeInformationFile  (112, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01239   896   NtSetInformationFile  (116, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01240   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 112, ... 120, ) == 0x0
 01241   896   NtMapViewOfSection  (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 28672, ) == 0x0
 01242   896   NtClose  (120, ... ) == 0x0
 01243   896   NtWriteFile  (116, 0, 0, 0,  (116, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\231\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0d\347\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 25600, 0x0, 0, ... {status=0x0, info=25600}, ) \0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 25600, 0x0, 0, ... {status=0x0, info=25600}, ) == 0x0
 01244   896   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 01245   896   NtSetInformationFile  (116, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01246   896   NtClose  (112, ... ) == 0x0
 01247   896   NtClose  (116, ... ) == 0x0
 01248   896   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 116, ) }, ... 116, ) == 0x0
 01249   896   NtSetValueKey  (116,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 01250   896   NtSetInformationFile  (-2147482448, -142629072, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01251   896   NtSetInformationFile  (-2147482448, -142629164, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01252   896   NtSetInformationFile  (-2147482448, -142629472, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01253   896   NtSetInformationFile  (-2147482448, -142629568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01249   896   NtSetValueKey  ... ) == 0x0
 01254   896   NtClose  (116, ... ) == 0x0
 01255   896   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 116, ) }, 0, ... 116, ) == 0x0
 01256   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10551296, 1048576, ) == 0x0
 01257   896   NtAllocateVirtualMemory  (-1, 11591680, 0, 8192, 4096, 4, ... 11591680, 8192, ) == 0x0
 01258   896   NtProtectVirtualMemory  (-1, (0xb0e000), 4096, 260, ... (0xb0e000), 4096, 4, ) == 0x0
 01259   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 112, {1252, 1276}, ) == 0x0
 01260   896   NtQueryInformationThread  (112, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 01261   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\374\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\374\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\374\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 01262   896   NtResumeThread  (112, ... 1, ) == 0x0
 01263   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11599872, 1048576, ) == 0x0
 01264   896   NtAllocateVirtualMemory  (-1, 12640256, 0, 8192, 4096, 4, ... 12640256, 8192, ) == 0x0
 01265  1276   NtTestAlert  (... ) == 0x0
 01266  1276   NtContinue  (11599152, 1, ...
 01267  1276   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01268  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 120, ) == 0x0
 01269  1276   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01270  1276   NtAllocateVirtualMemory  (-1, 11587584, 0, 4096, 4096, 260, ...
 01271   896   NtProtectVirtualMemory  (-1, (0xc0e000), 4096, 260, ... (0xc0e000), 4096, 4, ) == 0x0
 01272   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 124, {1252, 1328}, ) == 0x0
 01273   896   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 01274   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\00\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\00\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 01275   896   NtResumeThread  (124, ... 1, ) == 0x0
 01276   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01270  1276   NtAllocateVirtualMemory  ... 11587584, 4096, ) == 0x0
 01277  1328   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01278  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596276, ... }, 11596276, ...
 01277  1328   NtCreateEvent  ... 128, ) == 0x0
 01278  1276   NtQueryAttributesFile  ... ) == 0x0
 01279  1328   NtWaitForSingleObject  (128, 0, 0x0, ...
 01280  1276   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01281  1276   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 132, ... 136, ) == 0x0
 01282  1276   NtClose  (132, ... ) == 0x0
 01283  1276   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 245760, ) == 0x0
 01284  1276   NtClose  (136, ...
 01276   896   NtAllocateVirtualMemory  ... 12648448, 1048576, ) == 0x0
 01285   896   NtAllocateVirtualMemory  (-1, 13688832, 0, 8192, 4096, 4, ... 13688832, 8192, ) == 0x0
 01286   896   NtProtectVirtualMemory  (-1, (0xd0e000), 4096, 260, ... (0xd0e000), 4096, 4, ) == 0x0
 01287   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 132, {1252, 1636}, ) == 0x0
 01288   896   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 01289   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0d\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0d\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 01284  1276   NtClose  ... ) == 0x0
 01290  1276   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01291  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596584, ... ) }, 11596584, ... ) == 0x0
 01292  1276   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 136, {status=0x0, info=1}, ) }, 5, 96, ... 136, {status=0x0, info=1}, ) == 0x0
 01293  1276   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 136, ... 140, ) == 0x0
 01294  1276   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01295  1276   NtClose  (136, ...
 01296   896   NtResumeThread  (132, ... 1, ) == 0x0
 01297   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13697024, 1048576, ) == 0x0
 01298   896   NtAllocateVirtualMemory  (-1, 14737408, 0, 8192, 4096, 4, ... 14737408, 8192, ) == 0x0
 01299   896   NtProtectVirtualMemory  (-1, (0xe0e000), 4096, 260, ... (0xe0e000), 4096, 4, ) == 0x0
 01300   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 144, {1252, 1152}, ) == 0x0
 01301   896   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 01295  1276   NtClose  ... ) == 0x0
 01302  1636   NtWaitForSingleObject  (128, 0, 0x0, ...
 01303  1276   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 01304  1276   NtClose  (140, ... ) == 0x0
 01305  1276   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01306  1276   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01307  1276   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01308  1276   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 01309   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\200\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\200\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 01310   896   NtResumeThread  (144, ... 1, ) == 0x0
 01311   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14745600, 1048576, ) == 0x0
 01312   896   NtAllocateVirtualMemory  (-1, 15785984, 0, 8192, 4096, 4, ... 15785984, 8192, ) == 0x0
 01313   896   NtProtectVirtualMemory  (-1, (0xf0e000), 4096, 260, ... (0xf0e000), 4096, 4, ) == 0x0
 01314   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01308  1276   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 01315  1152   NtWaitForSingleObject  (128, 0, 0x0, ...
 01316  1276   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01317  1276   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01318  1276   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01319  1276   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01320  1276   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01321  1276   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... }, ...
 01314   896   NtCreateThread  ... 140, {1252, 792}, ) == 0x0
 01322   896   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 01323   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\30\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\30\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\30\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 01324   896   NtResumeThread  (140, ... 1, ) == 0x0
 01325   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15794176, 1048576, ) == 0x0
 01326   896   NtAllocateVirtualMemory  (-1, 16834560, 0, 8192, 4096, 4, ... 16834560, 8192, ) == 0x0
 01321  1276   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01327   792   NtWaitForSingleObject  (128, 0, 0x0, ...
 01328  1276   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01329  1276   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01330  1276   NtSetEventBoostPriority  (128, ...
 01279  1328   NtWaitForSingleObject  ... ) == 0x0
 01331  1328   NtSetEventBoostPriority  (128, ...
 01302  1636   NtWaitForSingleObject  ... ) == 0x0
 01332  1636   NtSetEventBoostPriority  (128, ...
 01315  1152   NtWaitForSingleObject  ... ) == 0x0
 01333  1152   NtSetEventBoostPriority  (128, ...
 01327   792   NtWaitForSingleObject  ... ) == 0x0
 01334   792   NtTestAlert  (... ) == 0x0
 01333  1152   NtSetEventBoostPriority  ... ) == 0x0
 01332  1636   NtSetEventBoostPriority  ... ) == 0x0
 01331  1328   NtSetEventBoostPriority  ... ) == 0x0
 01330  1276   NtSetEventBoostPriority  ... ) == 0x0
 01335   896   NtProtectVirtualMemory  (-1, (0x100e000), 4096, 260, ...
 01336   792   NtContinue  (15793456, 1, ...
 01337  1152   NtTestAlert  (...
 01338  1636   NtTestAlert  (...
 01339  1276   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01335   896   NtProtectVirtualMemory  ... (0x100e000), 4096, 4, ) == 0x0
 01340   792   NtRegisterThreadTerminatePort  (24, ...
 01337  1152   NtTestAlert  ... ) == 0x0
 01338  1636   NtTestAlert  ... ) == 0x0
 01339  1276   NtCreateEvent  ... 136, ) == 0x0
 01341   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01340   792   NtRegisterThreadTerminatePort  ... ) == 0x0
 01342  1152   NtContinue  (14744880, 1, ...
 01343  1636   NtContinue  (13696304, 1, ...
 01344  1276   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 01341   896   NtCreateThread  ... 148, {1252, 1484}, ) == 0x0
 01345   792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01346  1152   NtRegisterThreadTerminatePort  (24, ...
 01347  1636   NtRegisterThreadTerminatePort  (24, ...
 01344  1276   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01348   896   NtQueryInformationThread  (148, Basic, 28, ...
 01345   792   NtDuplicateObject  ... 152, ) == 0x0
 01346  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 01347  1636   NtRegisterThreadTerminatePort  ... ) == 0x0
 01349  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11596196, ... }, 11596196, ...
 01348   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 01350   792   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01351  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01352  1636   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01353  1328   NtTestAlert  (...
 01354   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\314\5\0\0" ...  ...
 01350   792   NtWaitForSingleObject  ... ) == 0x102
 01351  1152   NtDuplicateObject  ... 156, ) == 0x0
 01353  1328   NtTestAlert  ... ) == 0x0
 01354   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 01355   792   NtAllocateVirtualMemory  (-1, 15781888, 0, 4096, 4096, 260, ...
 01356  1152   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01357  1328   NtContinue  (12647728, 1, ...
 01358   896   NtResumeThread  (148, ...
 01355   792   NtAllocateVirtualMemory  ... 15781888, 4096, ) == 0x0
 01356  1152   NtWaitForSingleObject  ... ) == 0x102
 01359  1328   NtRegisterThreadTerminatePort  (24, ...
 01358   896   NtResumeThread  ... 1, ) == 0x0
 01360   792   NtWaitForSingleObject  (128, 0, 0x0, ...
 01361  1152   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01359  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 01362   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01361  1152   NtCreateEvent  ... 160, ) == 0x0
 01363  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01352  1636   NtDuplicateObject  ... 164, ) == 0x0
 01364  1484   NtWaitForSingleObject  (128, 0, 0x0, ...
 01362   896   NtAllocateVirtualMemory  ... 16842752, 1048576, ) == 0x0
 01365  1152   NtWaitForSingleObject  (160, 0, 0x0, ...
 01349  1276   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01366  1636   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01367   896   NtAllocateVirtualMemory  (-1, 17883136, 0, 8192, 4096, 4, ...
 01368  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11596196, ... }, 11596196, ...
 01366  1636   NtWaitForSingleObject  ... ) == 0x102
 01367   896   NtAllocateVirtualMemory  ... 17883136, 8192, ) == 0x0
 01368  1276   NtQueryAttributesFile  ... ) == 0x0
 01369  1636   NtWaitForSingleObject  (160, 0, 0x0, ...
 01370   896   NtProtectVirtualMemory  (-1, (0x110e000), 4096, 260, ...
 01363  1328   NtDuplicateObject  ... 168, ) == 0x0
 01370   896   NtProtectVirtualMemory  ... (0x110e000), 4096, 4, ) == 0x0
 01371  1328   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01372   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01371  1328   NtWaitForSingleObject  ... ) == 0x102
 01373  1276   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... }, 5, 96, ...
 01374  1328   NtWaitForSingleObject  (160, 0, 0x0, ...
 01373  1276   NtOpenFile  ... 172, {status=0x0, info=1}, ) == 0x0
 01375  1276   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 176, ) == 0x0
 01376  1276   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01377  1276   NtClose  (172, ... ) == 0x0
 01378  1276   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x662b0000), 0x0, 360448, ) == 0x0
 01379  1276   NtClose  (176, ... ) == 0x0
 01372   896   NtCreateThread  ... 176, {1252, 1120}, ) == 0x0
 01380   896   NtQueryInformationThread  (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 01381   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0`\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 01382   896   NtResumeThread  (176, ... 1, ) == 0x0
 01383   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17891328, 1048576, ) == 0x0
 01384   896   NtAllocateVirtualMemory  (-1, 18931712, 0, 8192, 4096, 4, ... 18931712, 8192, ) == 0x0
 01385  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01386  1120   NtWaitForSingleObject  (128, 0, 0x0, ...
 01385  1276   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01387  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01388  1276   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01389  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01390  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01391   896   NtProtectVirtualMemory  (-1, (0x120e000), 4096, 260, ... (0x120e000), 4096, 4, ) == 0x0
 01392   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 172, {1252, 876}, ) == 0x0
 01393   896   NtQueryInformationThread  (172, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 01394   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0l\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 01395   896   NtResumeThread  (172, ... 1, ) == 0x0
 01396   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01390  1276   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01397   876   NtWaitForSingleObject  (128, 0, 0x0, ...
 01398  1276   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01399  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01400  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01401  1276   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01402  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01403  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 01396   896   NtAllocateVirtualMemory  ... 18939904, 1048576, ) == 0x0
 01404   896   NtAllocateVirtualMemory  (-1, 19980288, 0, 8192, 4096, 4, ... 19980288, 8192, ) == 0x0
 01405   896   NtProtectVirtualMemory  (-1, (0x130e000), 4096, 260, ... (0x130e000), 4096, 4, ) == 0x0
 01406   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 180, {1252, 1104}, ) == 0x0
 01407   896   NtQueryInformationThread  (180, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 01408   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0P\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 01403  1276   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 01409  1276   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01410  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01411  1276   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01412  1276   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01413  1276   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01414  1276   NtSetEventBoostPriority  (128, ...
 01415   896   NtResumeThread  (180, ... 1, ) == 0x0
 01416   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19988480, 1048576, ) == 0x0
 01417   896   NtAllocateVirtualMemory  (-1, 21028864, 0, 8192, 4096, 4, ... 21028864, 8192, ) == 0x0
 01418   896   NtProtectVirtualMemory  (-1, (0x140e000), 4096, 260, ... (0x140e000), 4096, 4, ) == 0x0
 01419   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 184, {1252, 1516}, ) == 0x0
 01420   896   NtQueryInformationThread  (184, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 01360   792   NtWaitForSingleObject  ... ) == 0x0
 01414  1276   NtSetEventBoostPriority  ... ) == 0x0
 01421  1104   NtWaitForSingleObject  (128, 0, 0x0, ...
 01422   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15789008, ... }, 15789008, ...
 01423  1276   NtWaitForSingleObject  (128, 0, 0x0, ...
 01422   792   NtQueryAttributesFile  ... ) == 0x0
 01424   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 01425   896   NtResumeThread  (184, ... 1, ) == 0x0
 01426   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21037056, 1048576, ) == 0x0
 01427   896   NtAllocateVirtualMemory  (-1, 22077440, 0, 8192, 4096, 4, ... 22077440, 8192, ) == 0x0
 01428   896   NtProtectVirtualMemory  (-1, (0x150e000), 4096, 260, ... (0x150e000), 4096, 4, ) == 0x0
 01429   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01430   792   NtSetEventBoostPriority  (128, ...
 01431  1516   NtWaitForSingleObject  (128, 0, 0x0, ...
 01364  1484   NtWaitForSingleObject  ... ) == 0x0
 01430   792   NtSetEventBoostPriority  ... ) == 0x0
 01432  1484   NtSetEventBoostPriority  (128, ...
 01386  1120   NtWaitForSingleObject  ... ) == 0x0
 01433  1120   NtSetEventBoostPriority  (128, ...
 01397   876   NtWaitForSingleObject  ... ) == 0x0
 01434   876   NtSetEventBoostPriority  (128, ...
 01421  1104   NtWaitForSingleObject  ... ) == 0x0
 01435  1104   NtSetEventBoostPriority  (128, ...
 01423  1276   NtWaitForSingleObject  ... ) == 0x0
 01436  1276   NtSetEventBoostPriority  (128, ...
 01431  1516   NtWaitForSingleObject  ... ) == 0x0
 01437  1516   NtTestAlert  (... ) == 0x0
 01436  1276   NtSetEventBoostPriority  ... ) == 0x0
 01435  1104   NtSetEventBoostPriority  ... ) == 0x0
 01434   876   NtSetEventBoostPriority  ... ) == 0x0
 01433  1120   NtSetEventBoostPriority  ... ) == 0x0
 01432  1484   NtSetEventBoostPriority  ... ) == 0x0
 01438   792   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01429   896   NtCreateThread  ... 188, {1252, 780}, ) == 0x0
 01439  1516   NtContinue  (21036336, 1, ...
 01440  1276   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01441  1104   NtTestAlert  (...
 01442   876   NtTestAlert  (...
 01443  1120   NtTestAlert  (...
 01438   792   NtCreateEvent  ... 192, ) == 0x0
 01444   896   NtQueryInformationThread  (188, Basic, 28, ...
 01445  1516   NtRegisterThreadTerminatePort  (24, ...
 01440  1276   NtCreateEvent  ... 196, ) == 0x0
 01441  1104   NtTestAlert  ... ) == 0x0
 01442   876   NtTestAlert  ... ) == 0x0
 01443  1120   NtTestAlert  ... ) == 0x0
 01446   792   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 01444   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 01445  1516   NtRegisterThreadTerminatePort  ... ) == 0x0
 01447  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01448  1104   NtContinue  (19987760, 1, ...
 01449   876   NtContinue  (18939184, 1, ...
 01450  1120   NtContinue  (17890608, 1, ...
 01446   792   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01451   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\14\3\0\0" ...  ...
 01452  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01447  1276   NtDuplicateObject  ... 200, ) == 0x0
 01453  1104   NtRegisterThreadTerminatePort  (24, ...
 01454   876   NtRegisterThreadTerminatePort  (24, ...
 01455  1120   NtRegisterThreadTerminatePort  (24, ...
 01456  1484   NtTestAlert  (...
 01451   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81893, 0}  ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 01452  1516   NtDuplicateObject  ... 204, ) == 0x0
 01457  1276   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01453  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 01454   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 01455  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 01456  1484   NtTestAlert  ... ) == 0x0
 01458   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 15789112, ... }, 15789112, ...
 01459  1516   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01457  1276   NtOpenKey  ... 208, ) == 0x0
 01460  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01461   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01462  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01463  1484   NtContinue  (16842032, 1, ...
 01464   896   NtResumeThread  (188, ...
 01459  1516   NtWaitForSingleObject  ... ) == 0x102
 01465  1276   NtQueryValueKey  (208,  (208, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01460  1104   NtDuplicateObject  ... 212, ) == 0x0
 01461   876   NtDuplicateObject  ... 216, ) == 0x0
 01466  1484   NtRegisterThreadTerminatePort  (24, ...
 01464   896   NtResumeThread  ... 1, ) == 0x0
 01467  1516   NtWaitForSingleObject  (160, 0, 0x0, ...
 01465  1276   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01468  1104   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01469   876   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01466  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 01470   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01471  1276   NtClose  (208, ...
 01468  1104   NtWaitForSingleObject  ... ) == 0x102
 01469   876   NtWaitForSingleObject  ... ) == 0x102
 01472  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01470   896   NtAllocateVirtualMemory  ... 22085632, 1048576, ) == 0x0
 01471  1276   NtClose  ... ) == 0x0
 01473  1104   NtWaitForSingleObject  (160, 0, 0x0, ...
 01474   876   NtWaitForSingleObject  (160, 0, 0x0, ...
 01462  1120   NtDuplicateObject  ... 208, ) == 0x0
 01458   792   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01475   780   NtWaitForSingleObject  (128, 0, 0x0, ...
 01476   896   NtAllocateVirtualMemory  (-1, 23126016, 0, 8192, 4096, 4, ...
 01477  1276   NtOpenThreadToken  (-2, 0xc, 1, ...
 01478  1120   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01479   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 15789112, ... }, 15789112, ...
 01476   896   NtAllocateVirtualMemory  ... 23126016, 8192, ) == 0x0
 01477  1276   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01478  1120   NtWaitForSingleObject  ... ) == 0x102
 01472  1484   NtDuplicateObject  ... 220, ) == 0x0
 01479   792   NtQueryAttributesFile  ... ) == 0x0
 01480   896   NtProtectVirtualMemory  (-1, (0x160e000), 4096, 260, ...
 01481  1120   NtWaitForSingleObject  (160, 0, 0x0, ...
 01482  1484   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01483   792   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... }, 5, 96, ...
 01480   896   NtProtectVirtualMemory  ... (0x160e000), 4096, 4, ) == 0x0
 01482  1484   NtWaitForSingleObject  ... ) == 0x102
 01483   792   NtOpenFile  ... 224, {status=0x0, info=1}, ) == 0x0
 01484   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01485  1484   NtWaitForSingleObject  (160, 0, 0x0, ...
 01486   792   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 224, ...
 01484   896   NtCreateThread  ... 228, {1252, 644}, ) == 0x0
 01486   792   NtCreateSection  ... 232, ) == 0x0
 01487   896   NtQueryInformationThread  (228, Basic, 28, ...
 01488   792   NtQuerySection  (232, Image, 48, ...
 01487   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 01489  1276   NtOpenThreadToken  (-2, 0x20008, 1, ...
 01488   792   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01489  1276   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01490   792   NtClose  (224, ...
 01491  1276   NtWaitForSingleObject  (128, 0, 0x0, ...
 01490   792   NtClose  ... ) == 0x0
 01492   792   NtMapViewOfSection  (232, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 01493   792   NtClose  (232, ... ) == 0x0
 01494   792   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01495   792   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01496   792   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01497   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\204\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 01498   896   NtResumeThread  (228, ... 1, ) == 0x0
 01499   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 23134208, 1048576, ) == 0x0
 01500   896   NtAllocateVirtualMemory  (-1, 24174592, 0, 8192, 4096, 4, ... 24174592, 8192, ) == 0x0
 01501   896   NtProtectVirtualMemory  (-1, (0x170e000), 4096, 260, ... (0x170e000), 4096, 4, ) == 0x0
 01502   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01496   792   NtFlushInstructionCache  ... ) == 0x0
 01503   644   NtWaitForSingleObject  (128, 0, 0x0, ...
 01504   792   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01505   792   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01506   792   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01507   792   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01508   792   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01509   792   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01502   896   NtCreateThread  ... 232, {1252, 1736}, ) == 0x0
 01510   896   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 01511   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 01512   896   NtResumeThread  (232, ... 1, ) == 0x0
 01513   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24182784, 1048576, ) == 0x0
 01514   896   NtAllocateVirtualMemory  (-1, 25223168, 0, 8192, 4096, 4, ... 25223168, 8192, ) == 0x0
 01509   792   NtFlushInstructionCache  ... ) == 0x0
 01515  1736   NtWaitForSingleObject  (128, 0, 0x0, ...
 01516   792   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01517   792   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01518   792   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01519   792   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01520   792   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01521   792   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01522   896   NtProtectVirtualMemory  (-1, (0x180e000), 4096, 260, ... (0x180e000), 4096, 4, ) == 0x0
 01523   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 224, {1252, 320}, ) == 0x0
 01524   896   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 01525   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 01526   896   NtResumeThread  (224, ... 1, ) == 0x0
 01527   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01521   792   NtFlushInstructionCache  ... ) == 0x0
 01528   320   NtWaitForSingleObject  (128, 0, 0x0, ...
 01529   792   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01530   792   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01531   792   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01532   792   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01533   792   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 236, 2, ) }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 236, 2, ) , 0, ... 236, 2, ) == 0x0
 01534   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01527   896   NtAllocateVirtualMemory  ... 25231360, 1048576, ) == 0x0
 01535   896   NtAllocateVirtualMemory  (-1, 26271744, 0, 8192, 4096, 4, ... 26271744, 8192, ) == 0x0
 01536   896   NtProtectVirtualMemory  (-1, (0x190e000), 4096, 260, ... (0x190e000), 4096, 4, ) == 0x0
 01537   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 240, {1252, 380}, ) == 0x0
 01538   896   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 01539   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 01534   792   NtOpenKey  ... 244, ) == 0x0
 01540   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01541   792   NtQueryValueKey  (244,  (244, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01542   792   NtQueryValueKey  (236,  (236, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01543   792   NtQueryValueKey  (244,  (244, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01544   792   NtQueryValueKey  (236,  (236, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (236, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01545   792   NtQueryValueKey  (244,  (244, "PrioritizeRecordData", Partial, 144, ... , Partial, 144, ...
 01546   896   NtResumeThread  (240, ... 1, ) == 0x0
 01547   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26279936, 1048576, ) == 0x0
 01548   896   NtAllocateVirtualMemory  (-1, 27320320, 0, 8192, 4096, 4, ... 27320320, 8192, ) == 0x0
 01549   896   NtProtectVirtualMemory  (-1, (0x1a0e000), 4096, 260, ... (0x1a0e000), 4096, 4, ) == 0x0
 01550   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 248, {1252, 1332}, ) == 0x0
 01551   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 01545   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01552   380   NtWaitForSingleObject  (128, 0, 0x0, ...
 01553   792   NtQueryValueKey  (236,  (236, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01554   792   NtQueryValueKey  (244,  (244, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01555   792   NtQueryValueKey  (236,  (236, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01556   792   NtQueryValueKey  (244,  (244, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01557   792   NtQueryValueKey  (244,  (244, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01558   792   NtQueryValueKey  (244,  (244, "ScreenUnreachableServers", Partial, 144, ... , Partial, 144, ...
 01559   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 01560   896   NtResumeThread  (248, ... 1, ) == 0x0
 01561   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27328512, 1048576, ) == 0x0
 01562   896   NtAllocateVirtualMemory  (-1, 28368896, 0, 8192, 4096, 4, ... 28368896, 8192, ) == 0x0
 01563   896   NtProtectVirtualMemory  (-1, (0x1b0e000), 4096, 260, ... (0x1b0e000), 4096, 4, ) == 0x0
 01564   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01558   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01565  1332   NtWaitForSingleObject  (128, 0, 0x0, ...
 01566   792   NtQueryValueKey  (244,  (244, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01567   792   NtQueryValueKey  (244,  (244, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01568   792   NtQueryValueKey  (244,  (244, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01569   792   NtQueryValueKey  (244,  (244, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01570   792   NtQueryValueKey  (244,  (244, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01571   792   NtQueryValueKey  (244,  (244, "RegistrationEnabled", Partial, 144, ... , Partial, 144, ...
 01564   896   NtCreateThread  ... 252, {1252, 1336}, ) == 0x0
 01572   896   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 01573   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 01574   896   NtResumeThread  (252, ... 1, ) == 0x0
 01575   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28377088, 1048576, ) == 0x0
 01576   896   NtAllocateVirtualMemory  (-1, 29417472, 0, 8192, 4096, 4, ... 29417472, 8192, ) == 0x0
 01571   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01577  1336   NtWaitForSingleObject  (128, 0, 0x0, ...
 01578   792   NtQueryValueKey  (236,  (236, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01579   792   NtQueryValueKey  (244,  (244, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01580   792   NtQueryValueKey  (244,  (244, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01581   792   NtQueryValueKey  (236,  (236, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01582   792   NtQueryValueKey  (244,  (244, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01583   792   NtQueryValueKey  (236,  (236, "DisableReverseAddressRegistrations", Partial, 144, ... , Partial, 144, ...
 01584   896   NtProtectVirtualMemory  (-1, (0x1c0e000), 4096, 260, ... (0x1c0e000), 4096, 4, ) == 0x0
 01585   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 256, {1252, 468}, ) == 0x0
 01586   896   NtQueryInformationThread  (256, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 01587   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 01588   896   NtResumeThread  (256, ... 1, ) == 0x0
 01589   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01583   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01590   468   NtWaitForSingleObject  (128, 0, 0x0, ...
 01591   792   NtQueryValueKey  (244,  (244, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01592   792   NtQueryValueKey  (236,  (236, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01593   792   NtQueryValueKey  (244,  (244, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01594   792   NtQueryValueKey  (236,  (236, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01595   792   NtQueryValueKey  (244,  (244, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01596   792   NtQueryValueKey  (236,  (236, "DefaultRegistrationRefreshInterval", Partial, 144, ... , Partial, 144, ...
 01589   896   NtAllocateVirtualMemory  ... 29425664, 1048576, ) == 0x0
 01597   896   NtAllocateVirtualMemory  (-1, 30466048, 0, 8192, 4096, 4, ... 30466048, 8192, ) == 0x0
 01598   896   NtProtectVirtualMemory  (-1, (0x1d0e000), 4096, 260, ... (0x1d0e000), 4096, 4, ) == 0x0
 01599   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 260, {1252, 752}, ) == 0x0
 01600   896   NtQueryInformationThread  (260, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 01601   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 01596   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01602   792   NtQueryValueKey  (244,  (244, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01603   792   NtQueryValueKey  (236,  (236, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01604   792   NtQueryValueKey  (244,  (244, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01605   792   NtQueryValueKey  (236,  (236, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01606   792   NtQueryValueKey  (244,  (244, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01607   792   NtQueryValueKey  (244,  (244, "UpdateTopLevelDomainZones", Partial, 144, ... , Partial, 144, ...
 01608   896   NtResumeThread  (260, ... 1, ) == 0x0
 01609   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30474240, 1048576, ) == 0x0
 01610   896   NtAllocateVirtualMemory  (-1, 31514624, 0, 8192, 4096, 4, ... 31514624, 8192, ) == 0x0
 01611   896   NtProtectVirtualMemory  (-1, (0x1e0e000), 4096, 260, ... (0x1e0e000), 4096, 4, ) == 0x0
 01612   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 264, {1252, 1512}, ) == 0x0
 01613   896   NtQueryInformationThread  (264, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 01607   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01614   752   NtWaitForSingleObject  (128, 0, 0x0, ...
 01615   792   NtQueryValueKey  (244,  (244, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01616   792   NtQueryValueKey  (244,  (244, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01617   792   NtQueryValueKey  (244,  (244, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618   792   NtQueryValueKey  (244,  (244, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01619   792   NtQueryValueKey  (244,  (244, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01620   792   NtQueryValueKey  (244,  (244, "ServerPriorityTimeLimit", Partial, 144, ... , Partial, 144, ...
 01621   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 01622   896   NtResumeThread  (264, ... 1, ) == 0x0
 01623   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31522816, 1048576, ) == 0x0
 01624   896   NtAllocateVirtualMemory  (-1, 32563200, 0, 8192, 4096, 4, ... 32563200, 8192, ) == 0x0
 01625   896   NtProtectVirtualMemory  (-1, (0x1f0e000), 4096, 260, ... (0x1f0e000), 4096, 4, ) == 0x0
 01626   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01620   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01627  1512   NtWaitForSingleObject  (128, 0, 0x0, ...
 01628   792   NtQueryValueKey  (244,  (244, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01629   792   NtQueryValueKey  (244,  (244, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01630   792   NtQueryValueKey  (244,  (244, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01631   792   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\Setup"}, ... 268, ) }, ... 268, ) == 0x0
 01632   792   NtQueryValueKey  (268,  (268, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (268, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01633   792   NtClose  (268, ...
 01626   896   NtCreateThread  ... 272, {1252, 1380}, ) == 0x0
 01634   896   NtQueryInformationThread  (272, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 01635   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\1\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 01636   896   NtResumeThread  (272, ... 1, ) == 0x0
 01637   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32571392, 1048576, ) == 0x0
 01638   896   NtAllocateVirtualMemory  (-1, 33611776, 0, 8192, 4096, 4, ... 33611776, 8192, ) == 0x0
 01633   792   NtClose  ... ) == 0x0
 01639  1380   NtWaitForSingleObject  (128, 0, 0x0, ...
 01640   792   NtClose  (236, ... ) == 0x0
 01641   792   NtClose  (244, ... ) == 0x0
 01642   792   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 244, ) }, ... 244, ) == 0x0
 01643   792   NtQueryValueKey  (244,  (244, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01644   792   NtQueryValueKey  (244,  (244, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01645   792   NtQueryValueKey  (244,  (244, "DnsMulticastQueryTimeouts", Partial, 144, ... , Partial, 144, ...
 01646   896   NtProtectVirtualMemory  (-1, (0x200e000), 4096, 260, ... (0x200e000), 4096, 4, ) == 0x0
 01647   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 236, {1252, 1564}, ) == 0x0
 01648   896   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 01649   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 01650   896   NtResumeThread  (236, ... 1, ) == 0x0
 01651   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01645   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01652  1564   NtWaitForSingleObject  (128, 0, 0x0, ...
 01653   792   NtClose  (244, ... ) == 0x0
 01654   792   NtSetEventBoostPriority  (128, ...
 01475   780   NtWaitForSingleObject  ... ) == 0x0
 01655   780   NtSetEventBoostPriority  (128, ...
 01491  1276   NtWaitForSingleObject  ... ) == 0x0
 01656  1276   NtSetEventBoostPriority  (128, ...
 01503   644   NtWaitForSingleObject  ... ) == 0x0
 01657   644   NtSetEventBoostPriority  (128, ...
 01515  1736   NtWaitForSingleObject  ... ) == 0x0
 01658  1736   NtSetEventBoostPriority  (128, ...
 01528   320   NtWaitForSingleObject  ... ) == 0x0
 01659   320   NtSetEventBoostPriority  (128, ...
 01552   380   NtWaitForSingleObject  ... ) == 0x0
 01660   380   NtSetEventBoostPriority  (128, ...
 01565  1332   NtWaitForSingleObject  ... ) == 0x0
 01661  1332   NtSetEventBoostPriority  (128, ...
 01577  1336   NtWaitForSingleObject  ... ) == 0x0
 01662  1336   NtSetEventBoostPriority  (128, ...
 01590   468   NtWaitForSingleObject  ... ) == 0x0
 01663   468   NtSetEventBoostPriority  (128, ...
 01614   752   NtWaitForSingleObject  ... ) == 0x0
 01664   752   NtSetEventBoostPriority  (128, ...
 01627  1512   NtWaitForSingleObject  ... ) == 0x0
 01665  1512   NtSetEventBoostPriority  (128, ...
 01639  1380   NtWaitForSingleObject  ... ) == 0x0
 01666  1380   NtSetEventBoostPriority  (128, ...
 01652  1564   NtWaitForSingleObject  ... ) == 0x0
 01667  1564   NtTestAlert  (... ) == 0x0
 01666  1380   NtSetEventBoostPriority  ... ) == 0x0
 01665  1512   NtSetEventBoostPriority  ... ) == 0x0
 01664   752   NtSetEventBoostPriority  ... ) == 0x0
 01663   468   NtSetEventBoostPriority  ... ) == 0x0
 01662  1336   NtSetEventBoostPriority  ... ) == 0x0
 01661  1332   NtSetEventBoostPriority  ... ) == 0x0
 01660   380   NtSetEventBoostPriority  ... ) == 0x0
 01659   320   NtSetEventBoostPriority  ... ) == 0x0
 01658  1736   NtSetEventBoostPriority  ... ) == 0x0
 01657   644   NtSetEventBoostPriority  ... ) == 0x0
 01656  1276   NtSetEventBoostPriority  ... ) == 0x0
 01655   780   NtSetEventBoostPriority  ... ) == 0x0
 01654   792   NtSetEventBoostPriority  ... ) == 0x0
 01651   896   NtAllocateVirtualMemory  ... 33619968, 1048576, ) == 0x0
 01668  1564   NtContinue  (33619248, 1, ...
 01669  1380   NtTestAlert  (...
 01670  1512   NtTestAlert  (...
 01671   752   NtTestAlert  (...
 01672   468   NtTestAlert  (...
 01673  1336   NtTestAlert  (...
 01674  1332   NtTestAlert  (...
 01675   380   NtTestAlert  (...
 01676   320   NtTestAlert  (...
 01677  1736   NtTestAlert  (...
 01678   644   NtTestAlert  (...
 01679  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11595888, ... }, 11595888, ...
 01680   792   NtWaitForSingleObject  (128, 0, 0x0, ...
 01681   896   NtAllocateVirtualMemory  (-1, 34660352, 0, 8192, 4096, 4, ...
 01682  1564   NtRegisterThreadTerminatePort  (24, ...
 01669  1380   NtTestAlert  ... ) == 0x0
 01670  1512   NtTestAlert  ... ) == 0x0
 01671   752   NtTestAlert  ... ) == 0x0
 01672   468   NtTestAlert  ... ) == 0x0
 01673  1336   NtTestAlert  ... ) == 0x0
 01674  1332   NtTestAlert  ... ) == 0x0
 01675   380   NtTestAlert  ... ) == 0x0
 01676   320   NtTestAlert  ... ) == 0x0
 01677  1736   NtTestAlert  ... ) == 0x0
 01678   644   NtTestAlert  ... ) == 0x0
 01679  1276   NtQueryAttributesFile  ... ) == 0x0
 01683   780   NtTestAlert  (...
 01681   896   NtAllocateVirtualMemory  ... 34660352, 8192, ) == 0x0
 01682  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 01684  1380   NtContinue  (32570672, 1, ...
 01685  1512   NtContinue  (31522096, 1, ...
 01686   752   NtContinue  (30473520, 1, ...
 01687   468   NtContinue  (29424944, 1, ...
 01688  1336   NtContinue  (28376368, 1, ...
 01689  1332   NtContinue  (27327792, 1, ...
 01690   380   NtContinue  (26279216, 1, ...
 01691   320   NtContinue  (25230640, 1, ...
 01692  1736   NtContinue  (24182064, 1, ...
 01693   644   NtContinue  (23133488, 1, ...
 01694  1276   NtSetEventBoostPriority  (128, ...
 01683   780   NtTestAlert  ... ) == 0x0
 01695   896   NtProtectVirtualMemory  (-1, (0x210e000), 4096, 260, ...
 01696  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01697  1380   NtRegisterThreadTerminatePort  (24, ...
 01698  1512   NtRegisterThreadTerminatePort  (24, ...
 01699   752   NtRegisterThreadTerminatePort  (24, ...
 01700   468   NtRegisterThreadTerminatePort  (24, ...
 01701  1336   NtRegisterThreadTerminatePort  (24, ...
 01702  1332   NtRegisterThreadTerminatePort  (24, ...
 01703   380   NtRegisterThreadTerminatePort  (24, ...
 01704   320   NtRegisterThreadTerminatePort  (24, ...
 01705  1736   NtRegisterThreadTerminatePort  (24, ...
 01706   644   NtRegisterThreadTerminatePort  (24, ...
 01694  1276   NtSetEventBoostPriority  ... ) == 0x0
 01707   780   NtContinue  (22084912, 1, ...
 01695   896   NtProtectVirtualMemory  ... (0x210e000), 4096, 4, ) == 0x0
 01696  1564   NtDuplicateObject  ... 244, ) == 0x0
 01697  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 01698  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 01699   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 01700   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 01701  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 01702  1332   NtRegisterThreadTerminatePort  ... ) == 0x0
 01703   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 01704   320   NtRegisterThreadTerminatePort  ... ) == 0x0
 01705  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 01706   644   NtRegisterThreadTerminatePort  ... ) == 0x0
 01708  1276   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01709   780   NtRegisterThreadTerminatePort  (24, ...
 01710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01711  1564   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01712  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01713  1512   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01714   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01715   468   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01716  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01717  1332   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01718   380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01719   320   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01720  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01721   644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01708  1276   NtOpenKey  ... 268, ) == 0x0
 01709   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 01680   792   NtWaitForSingleObject  ... ) == 0x0
 01710   896   NtCreateThread  ... 276, {1252, 1964}, ) == 0x0
 01711  1564   NtWaitForSingleObject  ... ) == 0x102
 01712  1380   NtDuplicateObject  ... 280, ) == 0x0
 01713  1512   NtDuplicateObject  ... 284, ) == 0x0
 01714   752   NtDuplicateObject  ... 288, ) == 0x0
 01715   468   NtDuplicateObject  ... 292, ) == 0x0
 01716  1336   NtDuplicateObject  ... 296, ) == 0x0
 01717  1332   NtDuplicateObject  ... 300, ) == 0x0
 01718   380   NtDuplicateObject  ... 304, ) == 0x0
 01719   320   NtDuplicateObject  ... 308, ) == 0x0
 01720  1736   NtDuplicateObject  ... 312, ) == 0x0
 01721   644   NtDuplicateObject  ... 316, ) == 0x0
 01722   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01723   792   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01724   896   NtQueryInformationThread  (276, Basic, 28, ...
 01725  1564   NtWaitForSingleObject  (160, 0, 0x0, ...
 01726  1380   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01727  1512   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01728   752   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01729   468   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01730  1336   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01731  1332   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01732   380   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01733   320   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01734  1736   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01735   644   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01736  1276   NtQueryValueKey  (268,  (268, "Transports", Partial, 144, ... , Partial, 144, ...
 01723   792   NtCreateEvent  ... 320, ) == 0x0
 01724   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 01726  1380   NtWaitForSingleObject  ... ) == 0x102
 01727  1512   NtWaitForSingleObject  ... ) == 0x102
 01728   752   NtWaitForSingleObject  ... ) == 0x102
 01729   468   NtWaitForSingleObject  ... ) == 0x102
 01730  1336   NtWaitForSingleObject  ... ) == 0x102
 01731  1332   NtWaitForSingleObject  ... ) == 0x102
 01732   380   NtWaitForSingleObject  ... ) == 0x102
 01733   320   NtWaitForSingleObject  ... ) == 0x102
 01734  1736   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01735   644   NtCreateEvent  ... 324, ) == 0x0
 01736  1276   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01737   792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01738   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\1\0\0\344\4\0\0\254\7\0\0" ...  ...
 01739  1380   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01740  1512   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01741   752   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01742   468   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01743  1336   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01744  1332   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01745   380   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01746   320   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01747  1736   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01748   644   NtWaitForSingleObject  (324, 0, 0x0, ...
 01749  1276   NtQueryValueKey  (268,  (268, "Transports", Partial, 144, ... , Partial, 144, ...
 01737   792   NtDuplicateObject  ... 328, ) == 0x0
 01738   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81905, 0}  ... {28, 56, reply, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\1\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 01739  1380   NtCreateEvent  ... 332, ) == 0x0
 01740  1512   NtCreateEvent  ... 336, ) == 0x0
 01741   752   NtCreateEvent  ... 340, ) == 0x0
 01742   468   NtCreateEvent  ... 344, ) == 0x0
 01743  1336   NtCreateEvent  ... 348, ) == 0x0
 01744  1332   NtCreateEvent  ... 352, ) == 0x0
 01745   380   NtCreateEvent  ... 356, ) == 0x0
 01746   320   NtCreateEvent  ... 360, ) == 0x0
 01747  1736   NtCreateEvent  ... 364, ) == 0x0
 01749  1276   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01722   780   NtDuplicateObject  ... 368, ) == 0x0
 01750   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 01751   896   NtResumeThread  (276, ...
 01752  1380   NtClose  (332, ...
 01753  1512   NtClose  (336, ...
 01754   752   NtClose  (340, ...
 01755   468   NtClose  (344, ...
 01756  1336   NtClose  (348, ...
 01757  1332   NtClose  (352, ...
 01758   380   NtClose  (356, ...
 01759  1736   NtClose  (364, ...
 01760  1276   NtClose  (268, ...
 01761   780   NtWaitForSingleObject  (324, 0, 0x0, ...
 01751   896   NtResumeThread  ... 1, ) == 0x0
 01752  1380   NtClose  ... ) == 0x0
 01753  1512   NtClose  ... ) == 0x0
 01754   752   NtClose  ... ) == 0x0
 01755   468   NtClose  ... ) == 0x0
 01756  1336   NtClose  ... ) == 0x0
 01757  1332   NtClose  ... ) == 0x0
 01758   380   NtClose  ... ) == 0x0
 01762   320   NtClose  (360, ...
 01763  1964   NtTestAlert  (...
 01760  1276   NtClose  ... ) == 0x0
 01764   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01765  1380   NtWaitForSingleObject  (324, 0, 0x0, ...
 01766  1512   NtWaitForSingleObject  (324, 0, 0x0, ...
 01767   752   NtWaitForSingleObject  (324, 0, 0x0, ...
 01768   468   NtWaitForSingleObject  (324, 0, 0x0, ...
 01769  1336   NtWaitForSingleObject  (324, 0, 0x0, ...
 01770  1332   NtWaitForSingleObject  (324, 0, 0x0, ...
 01771   380   NtWaitForSingleObject  (324, 0, 0x0, ...
 01762   320   NtClose  ... ) == 0x0
 01763  1964   NtTestAlert  ... ) == 0x0
 01759  1736   NtClose  ... ) == 0x0
 01764   896   NtAllocateVirtualMemory  ... 34668544, 1048576, ) == 0x0
 01772   320   NtWaitForSingleObject  (324, 0, 0x0, ...
 01773  1964   NtContinue  (34667824, 1, ...
 01774  1736   NtSetEventBoostPriority  (324, ...
 01775   896   NtAllocateVirtualMemory  (-1, 35708928, 0, 8192, 4096, 4, ...
 01776  1964   NtRegisterThreadTerminatePort  (24, ...
 01748   644   NtWaitForSingleObject  ... ) == 0x0
 01774  1736   NtSetEventBoostPriority  ... ) == 0x0
 01775   896   NtAllocateVirtualMemory  ... 35708928, 8192, ) == 0x0
 01777   644   NtSetEventBoostPriority  (324, ...
 01776  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 01778  1736   NtWaitForSingleObject  (324, 0, 0x0, ...
 01779  1276   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01750   792   NtWaitForSingleObject  ... ) == 0x0
 01777   644   NtSetEventBoostPriority  ... ) == 0x0
 01780   896   NtProtectVirtualMemory  (-1, (0x220e000), 4096, 260, ...
 01781   792   NtSetEventBoostPriority  (324, ...
 01779  1276   NtOpenKey  ... 364, ) == 0x0
 01782  1964   NtWaitForSingleObject  (324, 0, 0x0, ...
 01761   780   NtWaitForSingleObject  ... ) == 0x0
 01781   792   NtSetEventBoostPriority  ... ) == 0x0
 01780   896   NtProtectVirtualMemory  ... (0x220e000), 4096, 4, ) == 0x0
 01783  1276   NtQueryValueKey  (364,  (364, "Mapping", Partial, 144, ... , Partial, 144, ...
 01784   780   NtSetEventBoostPriority  (324, ...
 01785   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 01786   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01765  1380   NtWaitForSingleObject  ... ) == 0x0
 01784   780   NtSetEventBoostPriority  ... ) == 0x0
 01783  1276   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01787   644   NtWaitForSingleObject  (324, 0, 0x0, ...
 01788  1380   NtSetEventBoostPriority  (324, ...
 01786   896   NtCreateThread  ... 360, {1252, 1716}, ) == 0x0
 01789  1276   NtWaitForSingleObject  (324, 0, 0x0, ...
 01766  1512   NtWaitForSingleObject  ... ) == 0x0
 01788  1380   NtSetEventBoostPriority  ... ) == 0x0
 01790   896   NtQueryInformationThread  (360, Basic, 28, ...
 01791  1512   NtSetEventBoostPriority  (324, ...
 01792   780   NtWaitForSingleObject  (324, 0, 0x0, ...
 01767   752   NtWaitForSingleObject  ... ) == 0x0
 01791  1512   NtSetEventBoostPriority  ... ) == 0x0
 01790   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 01793   752   NtSetEventBoostPriority  (324, ...
 01794  1380   NtWaitForSingleObject  (160, 0, 0x0, ...
 01795  1512   NtWaitForSingleObject  (160, 0, 0x0, ...
 01768   468   NtWaitForSingleObject  ... ) == 0x0
 01793   752   NtSetEventBoostPriority  ... ) == 0x0
 01796   468   NtSetEventBoostPriority  (324, ...
 01797   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\264\6\0\0" ...  ...
 01769  1336   NtWaitForSingleObject  ... ) == 0x0
 01796   468   NtSetEventBoostPriority  ... ) == 0x0
 01798  1336   NtSetEventBoostPriority  (324, ...
 01797   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81906, 0}  ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 01799   752   NtWaitForSingleObject  (160, 0, 0x0, ...
 01770  1332   NtWaitForSingleObject  ... ) == 0x0
 01798  1336   NtSetEventBoostPriority  ... ) == 0x0
 01800   896   NtResumeThread  (360, ...
 01801  1332   NtSetEventBoostPriority  (324, ...
 01802   468   NtWaitForSingleObject  (160, 0, 0x0, ...
 01771   380   NtWaitForSingleObject  ... ) == 0x0
 01801  1332   NtSetEventBoostPriority  ... ) == 0x0
 01800   896   NtResumeThread  ... 1, ) == 0x0
 01803   380   NtSetEventBoostPriority  (324, ...
 01804  1336   NtWaitForSingleObject  (160, 0, 0x0, ...
 01805  1716   NtTestAlert  (...
 01772   320   NtWaitForSingleObject  ... ) == 0x0
 01803   380   NtSetEventBoostPriority  ... ) == 0x0
 01806   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01807   320   NtSetEventBoostPriority  (324, ...
 01805  1716   NtTestAlert  ... ) == 0x0
 01808  1332   NtWaitForSingleObject  (160, 0, 0x0, ...
 01809   380   NtWaitForSingleObject  (160, 0, 0x0, ...
 01778  1736   NtWaitForSingleObject  ... ) == 0x0
 01807   320   NtSetEventBoostPriority  ... ) == 0x0
 01810  1716   NtContinue  (35716400, 1, ...
 01811  1736   NtSetEventBoostPriority  (324, ...
 01806   896   NtAllocateVirtualMemory  ... 35717120, 1048576, ) == 0x0
 01782  1964   NtWaitForSingleObject  ... ) == 0x0
 01811  1736   NtSetEventBoostPriority  ... ) == 0x0
 01812  1716   NtRegisterThreadTerminatePort  (24, ...
 01813  1964   NtSetEventBoostPriority  (324, ...
 01814   896   NtAllocateVirtualMemory  (-1, 36757504, 0, 8192, 4096, 4, ...
 01815   320   NtWaitForSingleObject  (160, 0, 0x0, ...
 01785   792   NtWaitForSingleObject  ... ) == 0x0
 01813  1964   NtSetEventBoostPriority  ... ) == 0x0
 01812  1716   NtRegisterThreadTerminatePort  ... ) == 0x0
 01814   896   NtAllocateVirtualMemory  ... 36757504, 8192, ) == 0x0
 01816   792   NtSetEventBoostPriority  (324, ...
 01817  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01818  1736   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01787   644   NtWaitForSingleObject  ... ) == 0x0
 01819   896   NtProtectVirtualMemory  (-1, (0x230e000), 4096, 260, ...
 01816   792   NtSetEventBoostPriority  ... ) == 0x0
 01820  1716   NtWaitForSingleObject  (324, 0, 0x0, ...
 01818  1736   NtWaitForSingleObject  ... ) == 0x102
 01821   644   NtSetEventBoostPriority  (324, ...
 01819   896   NtProtectVirtualMemory  ... (0x230e000), 4096, 4, ) == 0x0
 01822   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 01823  1736   NtWaitForSingleObject  (324, 0, 0x0, ...
 01789  1276   NtWaitForSingleObject  ... ) == 0x0
 01821   644   NtSetEventBoostPriority  ... ) == 0x0
 01824   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01825  1276   NtSetEventBoostPriority  (324, ...
 01826   644   NtWaitForSingleObject  (324, 0, 0x0, ...
 01817  1964   NtDuplicateObject  ... 268, ) == 0x0
 01792   780   NtWaitForSingleObject  ... ) == 0x0
 01825  1276   NtSetEventBoostPriority  ... ) == 0x0
 01824   896   NtCreateThread  ... 356, {1252, 1972}, ) == 0x0
 01827   780   NtSetEventBoostPriority  (324, ...
 01828  1964   NtWaitForSingleObject  (324, 0, 0x0, ...
 01820  1716   NtWaitForSingleObject  ... ) == 0x0
 01827   780   NtSetEventBoostPriority  ... ) == 0x0
 01829   896   NtQueryInformationThread  (356, Basic, 28, ...
 01830  1716   NtSetEventBoostPriority  (324, ...
 01831   780   NtWaitForSingleObject  (324, 0, 0x0, ...
 01822   792   NtWaitForSingleObject  ... ) == 0x0
 01830  1716   NtSetEventBoostPriority  ... ) == 0x0
 01829   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 01832  1276   NtQueryValueKey  (364,  (364, "Mapping", Partial, 144, ... , Partial, 144, ...
 01833   792   NtSetEventBoostPriority  (324, ...
 01834  1716   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01835   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\1\0\0\344\4\0\0\264\7\0\0" ...  ...
 01823  1736   NtWaitForSingleObject  ... ) == 0x0
 01833   792   NtSetEventBoostPriority  ... ) == 0x0
 01832  1276   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01836  1736   NtSetEventBoostPriority  (324, ...
 01835   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\1\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 01834  1716   NtDuplicateObject  ... 352, ) == 0x0
 01826   644   NtWaitForSingleObject  ... ) == 0x0
 01836  1736   NtSetEventBoostPriority  ... ) == 0x0
 01837  1276   NtWaitForSingleObject  (324, 0, 0x0, ...
 01838   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 01839   644   NtSetEventBoostPriority  (324, ...
 01840  1716   NtWaitForSingleObject  (324, 0, 0x0, ...
 01841   896   NtResumeThread  (356, ...
 01828  1964   NtWaitForSingleObject  ... ) == 0x0
 01841   896   NtResumeThread  ... 1, ) == 0x0
 01842  1964   NtSetEventBoostPriority  (324, ...
 01843   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01831   780   NtWaitForSingleObject  ... ) == 0x0
 01842  1964   NtSetEventBoostPriority  ... ) == 0x0
 01844   780   NtSetEventBoostPriority  (324, ...
 01843   896   NtAllocateVirtualMemory  ... 36765696, 1048576, ) == 0x0
 01839   644   NtSetEventBoostPriority  ... ) == 0x0
 01845  1736   NtWaitForSingleObject  (160, 0, 0x0, ...
 01846  1972   NtAllocateVirtualMemory  (-1, 3624960, 0, 4096, 4096, 4, ...
 01837  1276   NtWaitForSingleObject  ... ) == 0x0
 01847   896   NtAllocateVirtualMemory  (-1, 37806080, 0, 8192, 4096, 4, ...
 01848   644   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01846  1972   NtAllocateVirtualMemory  ... 3624960, 4096, ) == 0x0
 01849  1276   NtSetEventBoostPriority  (324, ...
 01847   896   NtAllocateVirtualMemory  ... 37806080, 8192, ) == 0x0
 01850  1972   NtTestAlert  (...
 01838   792   NtWaitForSingleObject  ... ) == 0x0
 01849  1276   NtSetEventBoostPriority  ... ) == 0x0
 01844   780   NtSetEventBoostPriority  ... ) == 0x0
 01851  1964   NtWaitForSingleObject  (324, 0, 0x0, ...
 01848   644   NtWaitForSingleObject  ... ) == 0x102
 01852   792   NtSetEventBoostPriority  (324, ...
 01850  1972   NtTestAlert  ... ) == 0x0
 01853   896   NtProtectVirtualMemory  (-1, (0x240e000), 4096, 260, ...
 01854   780   NtWaitForSingleObject  (324, 0, 0x0, ...
 01840  1716   NtWaitForSingleObject  ... ) == 0x0
 01852   792   NtSetEventBoostPriority  ... ) == 0x0
 01855   644   NtWaitForSingleObject  (324, 0, 0x0, ...
 01856  1972   NtContinue  (36764976, 1, ...
 01853   896   NtProtectVirtualMemory  ... (0x240e000), 4096, 4, ) == 0x0
 01857  1716   NtSetEventBoostPriority  (324, ...
 01858   792   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01859  1276   NtQueryValueKey  (364,  (364, "Mapping", Partial, 152, ... , Partial, 152, ...
 01851  1964   NtWaitForSingleObject  ... ) == 0x0
 01857  1716   NtSetEventBoostPriority  ... ) == 0x0
 01860   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01861  1972   NtRegisterThreadTerminatePort  (24, ...
 01862  1964   NtSetEventBoostPriority  (324, ...
 01859  1276   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01858   792   NtCreateEvent  ... 348, ) == 0x0
 01860   896   NtCreateThread  ... 344, {1252, 1036}, ) == 0x0
 01854   780   NtWaitForSingleObject  ... ) == 0x0
 01862  1964   NtSetEventBoostPriority  ... ) == 0x0
 01861  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 01863  1276   NtClose  (364, ...
 01864   792   NtWaitForSingleObject  (348, 0, 0x0, ...
 01865   780   NtSetEventBoostPriority  (324, ...
 01866   896   NtQueryInformationThread  (344, Basic, 28, ...
 01867  1964   NtWaitForSingleObject  (324, 0, 0x0, ...
 01868  1972   NtWaitForSingleObject  (324, 0, 0x0, ...
 01863  1276   NtClose  ... ) == 0x0
 01855   644   NtWaitForSingleObject  ... ) == 0x0
 01865   780   NtSetEventBoostPriority  ... ) == 0x0
 01866   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 01869  1716   NtWaitForSingleObject  (324, 0, 0x0, ...
 01870   644   NtSetEventBoostPriority  (324, ...
 01871  1276   NtWaitForSingleObject  (324, 0, 0x0, ...
 01872   780   NtSetEventBoostPriority  (348, ...
 01868  1972   NtWaitForSingleObject  ... ) == 0x0
 01870   644   NtSetEventBoostPriority  ... ) == 0x0
 01873  1972   NtSetEventBoostPriority  (324, ...
 01864   792   NtWaitForSingleObject  ... ) == 0x0
 01872   780   NtSetEventBoostPriority  ... ) == 0x0
 01874   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\14\4\0\0" ...  ...
 01867  1964   NtWaitForSingleObject  ... ) == 0x0
 01875   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 01873  1972   NtSetEventBoostPriority  ... ) == 0x0
 01876   780   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01877  1964   NtSetEventBoostPriority  (324, ...
 01874   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 01878   644   NtWaitForSingleObject  (160, 0, 0x0, ...
 01869  1716   NtWaitForSingleObject  ... ) == 0x0
 01876   780   NtWaitForSingleObject  ... ) == 0x102
 01879   896   NtResumeThread  (344, ...
 01880  1716   NtSetEventBoostPriority  (324, ...
 01881   780   NtWaitForSingleObject  (160, 0, 0x0, ...
 01879   896   NtResumeThread  ... 1, ) == 0x0
 01871  1276   NtWaitForSingleObject  ... ) == 0x0
 01880  1716   NtSetEventBoostPriority  ... ) == 0x0
 01877  1964   NtSetEventBoostPriority  ... ) == 0x0
 01882  1972   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01883  1036   NtTestAlert  (...
 01884  1276   NtSetEventBoostPriority  (324, ...
 01885   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01886  1716   NtWaitForSingleObject  (348, 0, 0x0, ...
 01887  1964   NtWaitForSingleObject  (348, 0, 0x0, ...
 01882  1972   NtDuplicateObject  ... 364, ) == 0x0
 01875   792   NtWaitForSingleObject  ... ) == 0x0
 01884  1276   NtSetEventBoostPriority  ... ) == 0x0
 01883  1036   NtTestAlert  ... ) == 0x0
 01885   896   NtAllocateVirtualMemory  ... 37814272, 1048576, ) == 0x0
 01888   792   NtSetEventBoostPriority  (348, ...
 01889  1972   NtWaitForSingleObject  (348, 0, 0x0, ...
 01890  1036   NtContinue  (37813552, 1, ...
 01887  1964   NtWaitForSingleObject  ... ) == 0x0
 01888   792   NtSetEventBoostPriority  ... ) == 0x0
 01891   896   NtAllocateVirtualMemory  (-1, 38854656, 0, 8192, 4096, 4, ...
 01892  1964   NtSetEventBoostPriority  (348, ...
 01893  1036   NtRegisterThreadTerminatePort  (24, ...
 01894  1276   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01886  1716   NtWaitForSingleObject  ... ) == 0x0
 01892  1964   NtSetEventBoostPriority  ... ) == 0x0
 01891   896   NtAllocateVirtualMemory  ... 38854656, 8192, ) == 0x0
 01893  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01895  1716   NtWaitForSingleObject  (324, 0, 0x0, ...
 01894  1276   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01896   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 01897   896   NtProtectVirtualMemory  (-1, (0x250e000), 4096, 260, ...
 01898  1964   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01899  1276   NtSetEventBoostPriority  (324, ...
 01897   896   NtProtectVirtualMemory  ... (0x250e000), 4096, 4, ) == 0x0
 01898  1964   NtWaitForSingleObject  ... ) == 0x102
 01895  1716   NtWaitForSingleObject  ... ) == 0x0
 01899  1276   NtSetEventBoostPriority  ... ) == 0x0
 01900   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01901  1716   NtSetEventBoostPriority  (324, ...
 01902  1964   NtWaitForSingleObject  (160, 0, 0x0, ...
 01903  1276   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01904  1036   NtWaitForSingleObject  (324, 0, 0x0, ...
 01896   792   NtWaitForSingleObject  ... ) == 0x0
 01903  1276   NtOpenKey  ... 340, ) == 0x0
 01905   792   NtSetEventBoostPriority  (324, ...
 01901  1716   NtSetEventBoostPriority  ... ) == 0x0
 01900   896   NtCreateThread  ... 336, {1252, 1248}, ) == 0x0
 01904  1036   NtWaitForSingleObject  ... ) == 0x0
 01905   792   NtSetEventBoostPriority  ... ) == 0x0
 01906  1276   NtQueryValueKey  (340,  (340, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01907  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01908   896   NtQueryInformationThread  (336, Basic, 28, ...
 01909   792   NtWaitForSingleObject  (348, 0, 0x0, ...
 01907  1036   NtDuplicateObject  ... 332, ) == 0x0
 01906  1276   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01908   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 01910  1716   NtSetEventBoostPriority  (348, ...
 01911  1036   NtWaitForSingleObject  (348, 0, 0x0, ...
 01912  1276   NtQueryValueKey  (340,  (340, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01913   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0\340\4\0\0" ...  ...
 01889  1972   NtWaitForSingleObject  ... ) == 0x0
 01910  1716   NtSetEventBoostPriority  ... ) == 0x0
 01912  1276   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01914  1972   NtSetEventBoostPriority  (348, ...
 01913   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81909, 0}  ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 01915  1716   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01909   792   NtWaitForSingleObject  ... ) == 0x0
 01914  1972   NtSetEventBoostPriority  ... ) == 0x0
 01916  1276   NtQueryValueKey  (340,  (340, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 01917   792   NtSetEventBoostPriority  (348, ...
 01915  1716   NtWaitForSingleObject  ... ) == 0x102
 01918   896   NtResumeThread  (336, ...
 01911  1036   NtWaitForSingleObject  ... ) == 0x0
 01916  1276   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01919  1716   NtWaitForSingleObject  (160, 0, 0x0, ...
 01918   896   NtResumeThread  ... 1, ) == 0x0
 01920  1036   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01917   792   NtSetEventBoostPriority  ... ) == 0x0
 01921  1972   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01922  1248   NtTestAlert  (...
 01923  1276   NtQueryValueKey  (340,  (340, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01924   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01920  1036   NtWaitForSingleObject  ... ) == 0x102
 01925   792   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01921  1972   NtWaitForSingleObject  ... ) == 0x102
 01922  1248   NtTestAlert  ... ) == 0x0
 01923  1276   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01924   896   NtAllocateVirtualMemory  ... 38862848, 1048576, ) == 0x0
 01926  1036   NtWaitForSingleObject  (160, 0, 0x0, ...
 01925   792   NtOpenFile  ... 372, {status=0x0, info=0}, ) == 0x0
 01927  1972   NtWaitForSingleObject  (160, 0, 0x0, ...
 01928  1248   NtContinue  (38862128, 1, ...
 01929  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11596844, ... }, 11596844, ...
 01930   896   NtAllocateVirtualMemory  (-1, 39903232, 0, 8192, 4096, 4, ...
 01931  1248   NtRegisterThreadTerminatePort  (24, ...
 01929  1276   NtQueryAttributesFile  ... ) == 0x0
 01930   896   NtAllocateVirtualMemory  ... 39903232, 8192, ) == 0x0
 01931  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 01932  1276   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01933   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\25\253Js\255,_n\320\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01934   896   NtProtectVirtualMemory  (-1, (0x260e000), 4096, 260, ...
 01932  1276   NtOpenFile  ... 376, {status=0x0, info=1}, ) == 0x0
 01935   792   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01934   896   NtProtectVirtualMemory  ... (0x260e000), 4096, 4, ) == 0x0
 01936  1248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01935   792   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01937   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01936  1248   NtDuplicateObject  ... 380, ) == 0x0
 01938   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01937   896   NtCreateThread  ... 384, {1252, 1656}, ) == 0x0
 01939  1248   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 01938   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01940   896   NtQueryInformationThread  (384, Basic, 28, ...
 01939  1248   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 01941   792   NtQuerySystemInformation  (Performance, 312, ...
 01940   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 01942  1248   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01943  1276   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 376, ...
 01941   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01943  1276   NtCreateSection  ... 388, ) == 0x0
 01944   792   NtQuerySystemInformation  (Exception, 16, ...
 01945  1276   NtClose  (376, ...
 01944   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01945  1276   NtClose  ... ) == 0x0
 01946   792   NtQuerySystemInformation  (Lookaside, 32, ...
 01947  1276   NtMapViewOfSection  (388, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01946   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01947  1276   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 01948   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01949   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0x\6\0\0" ...  ...
 01942  1248   NtWaitForSingleObject  ... ) == 0x102
 01950  1276   NtClose  (388, ...
 01949   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 01951  1248   NtWaitForSingleObject  (160, 0, 0x0, ...
 01950  1276   NtClose  ... ) == 0x0
 01952   896   NtResumeThread  (384, ... 1, ) == 0x0
 01953   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 39911424, 1048576, ) == 0x0
 01954   896   NtAllocateVirtualMemory  (-1, 40951808, 0, 8192, 4096, 4, ... 40951808, 8192, ) == 0x0
 01955   896   NtProtectVirtualMemory  (-1, (0x270e000), 4096, 260, ... (0x270e000), 4096, 4, ) == 0x0
 01956   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01957  1276   NtUnmapViewOfSection  (-1, 0x360000, ...
 01948   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01958  1656   NtWaitForSingleObject  (128, 0, 0x0, ...
 01957  1276   NtUnmapViewOfSection  ... ) == 0x0
 01959   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01956   896   NtCreateThread  ... 388, {1252, 760}, ) == 0x0
 01959   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01960   896   NtQueryInformationThread  (388, Basic, 28, ...
 01961  1276   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11597152, ... }, 11597152, ...
 01960   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 01961  1276   NtQueryAttributesFile  ... ) == 0x0
 01962   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\370\2\0\0" ...  ...
 01963  1276   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01962   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81911, 0}  ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 01963  1276   NtOpenFile  ... 376, {status=0x0, info=1}, ) == 0x0
 01964   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01965  1276   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 376, ...
 01964   792   NtCreateKey  ... -2147482756, 2, ) == 0x0
 01965  1276   NtCreateSection  ... 392, ) == 0x0
 01966   792   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\352C-kt\322Q\371\7P\3377o\216\34\3366\202A+?\224\240\243sE\363\304\363\274\266d\201H\260\351/r.z21\304%\22\272=\314\250\253V\217-\6\222"\367\312\244'\313\35\2451\305\355\333\230\376\250Xn\27\36\237\242_j\300)", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "\352C-kt\322Q\371\7P\3377o\216\34\3366\202A+?\224\240\243sE\363\304\363\274\266d\201H\260\351/r.z21\304%\22\272=\314\250\253V\217-\6\222"\367\312\244'\313\35\2451\305\355\333\230\376\250Xn\27\36\237\242_j\300)", 80, ... \367\312\244'\313\35\2451\305\355\333\230\376\250Xn\27\36\237\242_j\300)", 80, ...
 01967   896   NtResumeThread  (388, ...
 01966   792   NtSetValueKey  ... ) == 0x0
 01967   896   NtResumeThread  ... 1, ) == 0x0
 01968   792   NtClose  (-2147482756, ...
 01969   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01968   792   NtClose  ... ) == 0x0
 01969   896   NtAllocateVirtualMemory  ... 40960000, 1048576, ) == 0x0
 01970  1276   NtQuerySection  (392, Image, 48, ...
 01971   760   NtWaitForSingleObject  (128, 0, 0x0, ...
 01972   896   NtAllocateVirtualMemory  (-1, 42000384, 0, 8192, 4096, 4, ...
 01970  1276   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01972   896   NtAllocateVirtualMemory  ... 42000384, 8192, ) == 0x0
 01973  1276   NtClose  (376, ...
 01933   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "c\346\334(\246\370\216T\35\327\224I\14\376/u\301"\3667\34ib\227Z\267E\2154X{\271\271\253\366W\23\376;,!\31\277a\204\232x_\320\20n\376j\354\336\307\233\353fN.\366;\301\251\31\324|\257Gk\250\333%Om\261\344\13\264}|\276n\376\275/C\266\33\335*q2\272!\241\315-\267\255\254\234pe\12Z\5\26\212\24\356\240d\356-\265I\317\220\247\342\6\231\304y\341[\306\314\370(\265\36\200q\356\225\205\341\345\356\275|\4\275\242&\26`\304%ke\15'{\267\14r\220\204^J\204\333dl\277\13\273\220\262UZ3CQ\13\320\323\235+\256\306\304\304\25\371x\202\302/\254<\351\323~\321}\11\362Rj\316I]%p\356\21\5D\203\331#p\5\364\312\357(\36c\1\260\356\30\211\250g[\251c\356\315\4\272\307d\252\332\303\330\342\250\377J\221\247\315\203\30d\263\30", ) \3667\34ib\227Z\267E\2154X{\271\271\253\366W\23\376;,!\31\277a\204\232x_\320\20n\376j\354\336\307\233\353fN.\366;\301\251\31\324|\257Gk\250\333%Om\261\344\13\264}|\276n\376\275/C\266\33\335*q2\272!\241\315-\267\255\254\234pe\12Z\5\26\212\24\356\240d\356-\265I\317\220\247\342\6\231\304y\341[\306\314\370(\265\36\200q\356\225\205\341\345\356\275|\4\275\242&\26`\304%ke\15'{\267\14r\220\204^J\204\333dl\277\13\273\220\262UZ3CQ\13\320\323\235+\256\306\304\304\25\371x\202\302/\254<\351\323~\321}\11\362Rj\316I]%p\356\21\5D\203\331#p\5\364\312\357(\36c\1\260\356\30\211\250g[\251c\356\315\4\272\307d\252\332\303\330\342\250\377J\221\247\315\203\30d\263\30", ) == 0x0
 01973  1276   NtClose  ... ) == 0x0
 01974   792   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01975  1276   NtMapViewOfSection  (392, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01974   792   NtCreateEvent  ... 376, ) == 0x0
 01975  1276   NtMapViewOfSection  ... (0x71a90000), 0x0, 32768, ) == 0x0
 01976   792   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789572, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789572, 188, ...
 01977   896   NtProtectVirtualMemory  (-1, (0x280e000), 4096, 260, ... (0x280e000), 4096, 4, ) == 0x0
 01978   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 396, {1252, 1580}, ) == 0x0
 01979   896   NtQueryInformationThread  (396, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 01980   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 01981   896   NtResumeThread  (396, ... 1, ) == 0x0
 01982   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01983  1276   NtClose  (392, ...
 01976   792   NtConnectPort  ... 400, 0x0, 0x0, 0x0, 188, ) == 0x0
 01984  1580   NtWaitForSingleObject  (128, 0, 0x0, ...
 01983  1276   NtClose  ... ) == 0x0
 01982   896   NtAllocateVirtualMemory  ... 42008576, 1048576, ) == 0x0
 01985  1276   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ...
 01986   896   NtAllocateVirtualMemory  (-1, 43048960, 0, 8192, 4096, 4, ...
 01985  1276   NtProtectVirtualMemory  ... (0x71a91000), 4096, 32, ) == 0x0
 01986   896   NtAllocateVirtualMemory  ... 43048960, 8192, ) == 0x0
 01987   896   NtProtectVirtualMemory  (-1, (0x290e000), 4096, 260, ... (0x290e000), 4096, 4, ) == 0x0
 01988   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 392, {1252, 1756}, ) == 0x0
 01989   896   NtQueryInformationThread  (392, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 01990   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 01991   792   NtRequestWaitReplyPort  (400, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721}  (400, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0 !\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0O\206\345\234z\273\200\263\240"\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x"\25\0\10-\313\275x\1\24\0\230"\25\0h\1\24\0\0\0\0\0\0\0\0\0\230"\25\0P\0\0\0\240"\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... \25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x (400, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0 !\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0O\206\345\234z\273\200\263\240"\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x"\25\0\10-\313\275x\1\24\0\230"\25\0h\1\24\0\0\0\0\0\0\0\0\0\230"\25\0P\0\0\0\240"\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... \25\0h\1\24\0\0\0\0\0\0\0\0\0\230 (400, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0 !\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0O\206\345\234z\273\200\263\240"\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x"\25\0\10-\313\275x\1\24\0\230"\25\0h\1\24\0\0\0\0\0\0\0\0\0\230"\25\0P\0\0\0\240"\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... \25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...
 01992  1276   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 01993  1276   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 01991   792   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 792, 81915, 0}  ... {200, 224, reply, 0, 1252, 792, 81915, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0O\206\345\234z\273\200\263\240"\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x"\25\0\10-\313\275x\1\24\0\230"\25\0h\1\24\0\0\0\0\0\0\0\0\0\230"\25\0P\0\0\0\240"\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x ... {200, 224, reply, 0, 1252, 792, 81915, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0O\206\345\234z\273\200\263\240"\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x"\25\0\10-\313\275x\1\24\0\230"\25\0h\1\24\0\0\0\0\0\0\0\0\0\230"\25\0P\0\0\0\240"\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \25\0h\1\24\0\0\0\0\0\0\0\0\0\230 ... {200, 224, reply, 0, 1252, 792, 81915, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0O\206\345\234z\273\200\263\240"\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0x"\25\0\10-\313\275x\1\24\0\230"\25\0h\1\24\0\0\0\0\0\0\0\0\0\230"\25\0P\0\0\0\240"\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) == 0x0
 01994   792   NtRequestWaitReplyPort  (400, {64, 88, new_msg, 0, 0, 0, 0, 0}  (400, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 1252, 792, 81916, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ... {52, 76, reply, 0, 1252, 792, 81916, 0}  (400, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 1252, 792, 81916, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 01995   792   NtClose  (376, ... ) == 0x0
 01996   792   NtClose  (400, ... ) == 0x0
 01997   792   NtWaitForSingleObject  (128, 0, 0x0, ...
 01998   896   NtResumeThread  (392, ... 1, ) == 0x0
 01999   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 43057152, 1048576, ) == 0x0
 02000   896   NtAllocateVirtualMemory  (-1, 44097536, 0, 8192, 4096, 4, ... 44097536, 8192, ) == 0x0
 02001  1276   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... }, ...
 02002  1756   NtWaitForSingleObject  (128, 0, 0x0, ...
 02001  1276   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02003  1276   NtSetEventBoostPriority  (128, ...
 01958  1656   NtWaitForSingleObject  ... ) == 0x0
 02004  1656   NtSetEventBoostPriority  (128, ...
 01971   760   NtWaitForSingleObject  ... ) == 0x0
 02005   760   NtSetEventBoostPriority  (128, ...
 01984  1580   NtWaitForSingleObject  ... ) == 0x0
 02006  1580   NtSetEventBoostPriority  (128, ...
 01997   792   NtWaitForSingleObject  ... ) == 0x0
 02007   792   NtSetEventBoostPriority  (128, ...
 02002  1756   NtWaitForSingleObject  ... ) == 0x0
 02008  1756   NtTestAlert  (... ) == 0x0
 02006  1580   NtSetEventBoostPriority  ... ) == 0x0
 02005   760   NtSetEventBoostPriority  ... ) == 0x0
 02004  1656   NtSetEventBoostPriority  ... ) == 0x0
 02003  1276   NtSetEventBoostPriority  ... ) == 0x0
 02007   792   NtSetEventBoostPriority  ... ) == 0x0
 02009   896   NtProtectVirtualMemory  (-1, (0x2a0e000), 4096, 260, ...
 02010  1756   NtContinue  (43056432, 1, ...
 02011  1580   NtTestAlert  (...
 02012   760   NtTestAlert  (...
 02013  1276   NtClose  (340, ...
 02014  1656   NtTestAlert  (...
 02009   896   NtProtectVirtualMemory  ... (0x2a0e000), 4096, 4, ) == 0x0
 02015  1756   NtRegisterThreadTerminatePort  (24, ...
 02011  1580   NtTestAlert  ... ) == 0x0
 02012   760   NtTestAlert  ... ) == 0x0
 02013  1276   NtClose  ... ) == 0x0
 02014  1656   NtTestAlert  ... ) == 0x0
 02016   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02015  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 02017  1580   NtContinue  (42007856, 1, ...
 02018   760   NtContinue  (40959280, 1, ...
 02019   792   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02020  1656   NtContinue  (39910704, 1, ...
 02016   896   NtCreateThread  ... 340, {1252, 1304}, ) == 0x0
 02021  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02022  1580   NtRegisterThreadTerminatePort  (24, ...
 02023   760   NtRegisterThreadTerminatePort  (24, ...
 02019   792   NtCreateKey  ... 400, 2, ) == 0x0
 02024  1656   NtRegisterThreadTerminatePort  (24, ...
 02025   896   NtQueryInformationThread  (340, Basic, 28, ...
 02021  1756   NtDuplicateObject  ... 376, ) == 0x0
 02022  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 02023   760   NtRegisterThreadTerminatePort  ... ) == 0x0
 02026   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02024  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 02025   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 02027  1756   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02028  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02029   760   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02030  1276   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11599488, 67, ... }, 0x0, 0, 3, 3, 0, 11599488, 67, ...
 02031  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02026   792   NtOpenKey  ... 404, ) == 0x0
 02032   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0\30\5\0\0" ...  ...
 02027  1756   NtWaitForSingleObject  ... ) == 0x102
 02028  1580   NtDuplicateObject  ... 408, ) == 0x0
 02030  1276   NtCreateFile  ... 412, {status=0x0, info=0}, ) == 0x0
 02029   760   NtDuplicateObject  ... 416, ) == 0x0
 02033   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02032   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81918, 0}  ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 02034  1756   NtWaitForSingleObject  (160, 0, 0x0, ...
 02035  1580   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02036  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x1207b,  (412, 136, 0x0, 0x0, 0x1207b, "\7\0\0\0\250q\250q%\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 02037   760   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02033   792   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02038   896   NtResumeThread  (340, ...
 02035  1580   NtWaitForSingleObject  ... ) == 0x102
 02036  1276   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 02037   760   NtWaitForSingleObject  ... ) == 0x102
 02039   792   NtQueryValueKey  (400,  (400, "Hostname", Partial, 144, ... , Partial, 144, ...
 02038   896   NtResumeThread  ... 1, ) == 0x0
 02040  1580   NtWaitForSingleObject  (160, 0, 0x0, ...
 02041  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x1207b,  (412, 136, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", 16, 16, ... , 16, 16, ...
 02042   760   NtWaitForSingleObject  (160, 0, 0x0, ...
 02039   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02043   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02041  1276   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 02044   792   NtQueryValueKey  (400,  (400, "Hostname", Partial, 144, ... , Partial, 144, ...
 02031  1656   NtDuplicateObject  ... 420, ) == 0x0
 02045  1304   NtTestAlert  (...
 02043   896   NtAllocateVirtualMemory  ... 44105728, 1048576, ) == 0x0
 02046  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x12047,  (412, 136, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\224\375\260\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 02047  1656   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02045  1304   NtTestAlert  ... ) == 0x0
 02048   896   NtAllocateVirtualMemory  (-1, 45146112, 0, 8192, 4096, 4, ...
 02046  1276   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 02047  1656   NtWaitForSingleObject  ... ) == 0x102
 02049  1304   NtContinue  (44105008, 1, ...
 02048   896   NtAllocateVirtualMemory  ... 45146112, 8192, ) == 0x0
 02050  1276   NtWaitForSingleObject  (96, 0, {0, 0}, ...
 02051  1656   NtWaitForSingleObject  (160, 0, 0x0, ...
 02052  1304   NtRegisterThreadTerminatePort  (24, ...
 02053   896   NtProtectVirtualMemory  (-1, (0x2b0e000), 4096, 260, ...
 02050  1276   NtWaitForSingleObject  ... ) == 0x102
 02052  1304   NtRegisterThreadTerminatePort  ... ) == 0x0
 02053   896   NtProtectVirtualMemory  ... (0x2b0e000), 4096, 4, ) == 0x0
 02054  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x12003,  (412, 136, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 02044   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02055   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02056  1304   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02057   792   NtClose  (400, ...
 02054  1276   NtDeviceIoControlFile  ... {status=0x0, info=424},  ... {status=0x0, info=424}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02056  1304   NtDuplicateObject  ... 428, ) == 0x0
 02057   792   NtClose  ... ) == 0x0
 02058  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x12047,  (412, 136, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02059  1304   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02060   792   NtClose  (404, ...
 02058  1276   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02059  1304   NtWaitForSingleObject  ... ) == 0x102
 02060   792   NtClose  ... ) == 0x0
 02061  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x12037,  (412, 136, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 02062  1304   NtWaitForSingleObject  (160, 0, 0x0, ...
 02063   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S\376\326?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02061  1276   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02055   896   NtCreateThread  ... 404, {1252, 1956}, ) == 0x0
 02064   792   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02065   896   NtQueryInformationThread  (404, Basic, 28, ...
 02064   792   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02065   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=1956,}, 0x0, ) == 0x0
 02066   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02067   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\244\7\0\0" ...  ...
 02066   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02067   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\244\7\0\0" )  ) == 0x0
 02068   792   NtQuerySystemInformation  (Performance, 312, ...
 02069  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x1200b,  (412, 136, 0x0, 0x0, 0x1200b, "\0\376\260\0\5\0\0\0\0\314\24\0", 12, 0, ... , 12, 0, ...
 02068   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02069  1276   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02070   896   NtResumeThread  (404, ...
 02071  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x12047,  (412, 136, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\260\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02070   896   NtResumeThread  ... 1, ) == 0x0
 02071  1276   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02072   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02073  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 02072   896   NtAllocateVirtualMemory  ... 45154304, 1048576, ) == 0x0
 02073  1276   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02074   896   NtAllocateVirtualMemory  (-1, 46194688, 0, 8192, 4096, 4, ...
 02075   792   NtQuerySystemInformation  (Exception, 16, ...
 02076  1956   NtTestAlert  (...
 02074   896   NtAllocateVirtualMemory  ... 46194688, 8192, ) == 0x0
 02075   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02076  1956   NtTestAlert  ... ) == 0x0
 02077  1276   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02078   792   NtQuerySystemInformation  (Lookaside, 32, ...
 02079  1956   NtContinue  (45153584, 1, ...
 02077  1276   NtCreateEvent  ... 400, ) == 0x0
 02078   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02080  1956   NtRegisterThreadTerminatePort  (24, ...
 02081  1276   NtWaitForSingleObject  (400, 0, 0x0, ...
 02082   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02080  1956   NtRegisterThreadTerminatePort  ... ) == 0x0
 02082   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02083   896   NtProtectVirtualMemory  (-1, (0x2c0e000), 4096, 260, ...
 02084  1956   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02083   896   NtProtectVirtualMemory  ... (0x2c0e000), 4096, 4, ) == 0x0
 02084  1956   NtDuplicateObject  ... 432, ) == 0x0
 02085   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02086  1956   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 02085   896   NtCreateThread  ... 436, {1252, 1480}, ) == 0x0
 02086  1956   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 02087   896   NtQueryInformationThread  (436, Basic, 28, ...
 02088  1956   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02087   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=1480,}, 0x0, ) == 0x0
 02088  1956   NtWaitForSingleObject  ... ) == 0x102
 02089   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02090  1956   NtWaitForSingleObject  (160, 0, 0x0, ...
 02089   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02091   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 02092   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "qN\317\374?\362\207\3328\237\231M\217<\241\367>\203\300\313\342\25]\3679\372\234t)\35S\317\233]GQ\310uK\377\243\233\301V\226\273V\2\256\3055\370\342H\272H\5\10{\343t^\370*\224\203\274=MVV\226H\373\303\221\247\35z\252", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "qN\317\374?\362\207\3328\237\231M\217<\241\367>\203\300\313\342\25]\3679\372\234t)\35S\317\233]GQ\310uK\377\243\233\301V\226\273V\2\256\3055\370\342H\272H\5\10{\343t^\370*\224\203\274=MVV\226H\373\303\221\247\35z\252", 80, ... ) , 80, ... ) == 0x0
 02093   792   NtClose  (-2147481484, ... ) == 0x0
 02063   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "M$C7\361\361\315W\12>\0\251b\200D'\244j\322\370\316\221\376\247<\347\330\305\322\370\257\15\275\21\210\251k\370\363iOt\335\372\211\236Y\2\343\364[\252\255W\226\333\304\212\3078\26}\355\354\240\370{4\257\255!\241\246\205(\23p\318\3\25(\352XVkAC\352\36\320wcb\335d}5Q\342m\260Y\2364W\177\36\27\332p\363\246\241\313\241\230L\33\310$\242\203\30F\306\230\33\270!\7<\265l\256\327\237\22\0\240xF^\245m\200\337oHeV\376\240_\325\1&\30\36\352\353\230\212\224\352nuG\22\334Bs\336\3362Ty\217\33a\255a\370y\376\267g\302\366.\235\17)\321\240\12\375\371?@\306\3\214zd\24\241\275\363\252\214\320%\203\23\253\13\237\224\3316\357"Q\24\34\2310\337\324\233\242x\354-f\243(\35\237\245N7\240\263\302\230\360\334jc\307\355B", ) Q\24\34\2310\337\324\233\242x\354-f\243(\35\237\245N7\240\263\302\230\360\334jc\307\355B", ) == 0x0
 02094   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S:\337\341\326R\237\242\273\361?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02095   792   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02096   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\310\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\310\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\310\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\310\5\0\0" )  ) == 0x0
 02097   896   NtResumeThread  (436, ... 1, ) == 0x0
 02098   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 46202880, 1048576, ) == 0x0
 02099   896   NtAllocateVirtualMemory  (-1, 47243264, 0, 8192, 4096, 4, ... 47243264, 8192, ) == 0x0
 02100   896   NtProtectVirtualMemory  (-1, (0x2d0e000), 4096, 260, ... (0x2d0e000), 4096, 4, ) == 0x0
 02101   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02102   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02103  1480   NtTestAlert  (...
 02102   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02103  1480   NtTestAlert  ... ) == 0x0
 02104   792   NtQuerySystemInformation  (Performance, 312, ...
 02105  1480   NtContinue  (46202160, 1, ...
 02104   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02106  1480   NtRegisterThreadTerminatePort  (24, ...
 02107   792   NtQuerySystemInformation  (Exception, 16, ...
 02106  1480   NtRegisterThreadTerminatePort  ... ) == 0x0
 02107   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02101   896   NtCreateThread  ... 440, {1252, 460}, ) == 0x0
 02108  1480   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02109   896   NtQueryInformationThread  (440, Basic, 28, ...
 02108  1480   NtDuplicateObject  ... 444, ) == 0x0
 02109   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=460,}, 0x0, ) == 0x0
 02110  1480   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02111   792   NtQuerySystemInformation  (Lookaside, 32, ...
 02110  1480   NtWaitForSingleObject  ... ) == 0x102
 02111   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02112  1480   NtWaitForSingleObject  (160, 0, 0x0, ...
 02113   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02114   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0\314\1\0\0" ...  ...
 02113   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02114   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0\314\1\0\0" )  ) == 0x0
 02115   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02116   896   NtResumeThread  (440, ...
 02115   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02116   896   NtResumeThread  ... 1, ) == 0x0
 02117   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 47251456, 1048576, ) == 0x0
 02118   896   NtAllocateVirtualMemory  (-1, 48291840, 0, 8192, 4096, 4, ... 48291840, 8192, ) == 0x0
 02119   896   NtProtectVirtualMemory  (-1, (0x2e0e000), 4096, 260, ... (0x2e0e000), 4096, 4, ) == 0x0
 02120   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02121   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02122   460   NtTestAlert  (...
 02121   792   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02122   460   NtTestAlert  ... ) == 0x0
 02123   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\250\215\276\5\253-jWh_*\253\253\26\0\237P\232\206\207/\317\366\206\\254\362,\212\347\226D\3240(\255\260o\270\226\2665X\302\23o\204\7\230\224,\231\305S\352\12\336\240\337\223H[\3221OA\27m\375\376\1\212o\266|\260\260iV\335", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\250\215\276\5\253-jWh_*\253\253\26\0\237P\232\206\207/\317\366\206\\254\362,\212\347\226D\3240(\255\260o\270\226\2665X\302\23o\204\7\230\224,\231\305S\352\12\336\240\337\223H[\3221OA\27m\375\376\1\212o\266|\260\260iV\335", 80, ... , 80, ...
 02124   460   NtContinue  (47250736, 1, ...
 02123   792   NtSetValueKey  ... ) == 0x0
 02125   460   NtRegisterThreadTerminatePort  (24, ...
 02126   792   NtClose  (-2147481484, ...
 02125   460   NtRegisterThreadTerminatePort  ... ) == 0x0
 02126   792   NtClose  ... ) == 0x0
 02120   896   NtCreateThread  ... 448, {1252, 1856}, ) == 0x0
 02127   460   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02128   896   NtQueryInformationThread  (448, Basic, 28, ...
 02127   460   NtDuplicateObject  ... 452, ) == 0x0
 02128   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=1856,}, 0x0, ) == 0x0
 02129   460   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02130   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0@\7\0\0" ...  ...
 02129   460   NtWaitForSingleObject  ... ) == 0x102
 02130   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0@\7\0\0" )  ) == 0x0
 02131   460   NtWaitForSingleObject  (160, 0, 0x0, ...
 02094   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, ")\211a\251)\3763\37\264\316\264\251H,\327?3)\240D\205l\256\254\333I@\244\213\2\26\377d\202\217;\245'q\200\353\333\345\351\234\3412\362J\211\22Dc\355x\2139\322r\207\274\326\276q\330.\371\214\314\327\202\32#\307-t\212-\300(6\363[\271\262\336\274\266\371\340;\242\217B\276\362\322\203\23M)\34L\263.\375\14H\25ba\310\2717\361\304\337\352\\347L\3318P\326\261M\343\261V\340\202\350l\313\235\324\3c9\200\220>\361v\372\2319\220S\240\337R\220j#t\16\327\236\343}oQ%\14L:\340\255c\2102\245\226\362~\31\253\342f[[9\244\222- /B\300\212M\346\17\362\265\204s\207v\247\33\217\1A\212\213T\4\357\25\367Yqn\325^\202\223fJ\300\30,\372\300\327\256A\325\25\251#[\327\324P\341N\22b\300\373\347\206\22\303r\3255\22\340!\355b", ) , ) == 0x0
 02132   896   NtResumeThread  (448, ...
 02133   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S:\337\341\326R\237\242\177\370\341\326R\237\242\273\361?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02132   896   NtResumeThread  ... 1, ) == 0x0
 02134   792   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02135   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02134   792   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02135   896   NtAllocateVirtualMemory  ... 48300032, 1048576, ) == 0x0
 02136   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02137   896   NtAllocateVirtualMemory  (-1, 49340416, 0, 8192, 4096, 4, ...
 02136   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02137   896   NtAllocateVirtualMemory  ... 49340416, 8192, ) == 0x0
 02138  1856   NtTestAlert  (...
 02139   792   NtQuerySystemInformation  (Performance, 312, ...
 02138  1856   NtTestAlert  ... ) == 0x0
 02139   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02140  1856   NtContinue  (48299312, 1, ...
 02141   792   NtQuerySystemInformation  (Exception, 16, ...
 02142  1856   NtRegisterThreadTerminatePort  (24, ...
 02141   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02142  1856   NtRegisterThreadTerminatePort  ... ) == 0x0
 02143   792   NtQuerySystemInformation  (Lookaside, 32, ...
 02144   896   NtProtectVirtualMemory  (-1, (0x2f0e000), 4096, 260, ...
 02143   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02144   896   NtProtectVirtualMemory  ... (0x2f0e000), 4096, 4, ) == 0x0
 02145  1856   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02146   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02145  1856   NtDuplicateObject  ... 456, ) == 0x0
 02146   896   NtCreateThread  ... 460, {1252, 1604}, ) == 0x0
 02147  1856   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02148   896   NtQueryInformationThread  (460, Basic, 28, ...
 02147  1856   NtWaitForSingleObject  ... ) == 0x102
 02148   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=1604,}, 0x0, ) == 0x0
 02149  1856   NtWaitForSingleObject  (160, 0, 0x0, ...
 02150   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02151   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0D\6\0\0" ...  ...
 02150   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02151   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\1\0\0\344\4\0\0D\6\0\0" )  ) == 0x0
 02152   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02153   896   NtResumeThread  (460, ...
 02152   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02153   896   NtResumeThread  ... 1, ) == 0x0
 02154   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02155   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02154   792   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02156  1604   NtTestAlert  (...
 02155   896   NtAllocateVirtualMemory  ... 49348608, 1048576, ) == 0x0
 02156  1604   NtTestAlert  ... ) == 0x0
 02157   896   NtAllocateVirtualMemory  (-1, 50388992, 0, 8192, 4096, 4, ...
 02158  1604   NtContinue  (49347888, 1, ...
 02157   896   NtAllocateVirtualMemory  ... 50388992, 8192, ) == 0x0
 02159  1604   NtRegisterThreadTerminatePort  (24, ...
 02160   896   NtProtectVirtualMemory  (-1, (0x300e000), 4096, 260, ...
 02159  1604   NtRegisterThreadTerminatePort  ... ) == 0x0
 02160   896   NtProtectVirtualMemory  ... (0x300e000), 4096, 4, ) == 0x0
 02161   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, ">t\17\11\265C(\3206U\253\267Bg\2054\222\233\254%\243\221\\216q\351\376\331\0@\343\233\177ox\315\213\371\320\318\247\36\206\310:\342\302\300\246\24\300\335\30kc#\367\3E\325\230,\217\217\343N\G\210S\234X:\177\275g\256cS", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, ">t\17\11\265C(\3206U\253\267Bg\2054\222\233\254%\243\221\\216q\351\376\331\0@\343\233\177ox\315\213\371\320\318\247\36\206\310:\342\302\300\246\24\300\335\30kc#\367\3E\325\230,\217\217\343N\G\210S\234X:\177\275g\256cS", 80, ... , 80, ...
 02162   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02161   792   NtSetValueKey  ... ) == 0x0
 02163  1604   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02164   792   NtClose  (-2147481484, ...
 02163  1604   NtDuplicateObject  ... 464, ) == 0x0
 02164   792   NtClose  ... ) == 0x0
 02165  1604   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02133   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\205qk\267\350\220P\30\2{\335\7\357\344\355\236\344\251M\272\343\307_o\266\302h\313\365\263\14E\352?\30\311s\2735\22YH\254\15dycIZ\322\340\310JX\242\26\377r\21U\323/q\217\377\233\350\266\322\256\261\205\214C3\]\216\242\20@\20\201\303\307\361\371r\226\374.&\331\333=\24l\23$\11\335\11\374\263|\330\343\16\247\22\230\220U\11\305\237\334\353\310\271t"c\352\26\\216;B\25u\264\336(7\240\350O\365\325Gs\2119\35\315\353\340\200\365\0\331\271\252\363\207\230\30\265\264\367yX\351k"\11d\216\300\14\252;,\2554\271\251\265\34\240\277\325&\217=\365\204`8\342@\253\177:\253T\246:U\3\262\3\226."P\3239\303\230\260O\6\254\227]\3\232^r\213\3\230UP\360\326\253\301c\325\345,\276\363d\331\336hX\243\330c\317\356\15\211\0$\376?z\200\304n", ) c\352\26\\216;B\25u\264\336(7\240\350O\365\325Gs\2119\35\315\353\340\200\365\0\331\271\252\363\207\230\30\265\264\367yX\351k ... {status=0x0, info=256}, "\205qk\267\350\220P\30\2{\335\7\357\344\355\236\344\251M\272\343\307_o\266\302h\313\365\263\14E\352?\30\311s\2735\22YH\254\15dycIZ\322\340\310JX\242\26\377r\21U\323/q\217\377\233\350\266\322\256\261\205\214C3\]\216\242\20@\20\201\303\307\361\371r\226\374.&\331\333=\24l\23$\11\335\11\374\263|\330\343\16\247\22\230\220U\11\305\237\334\353\310\271t"c\352\26\\216;B\25u\264\336(7\240\350O\365\325Gs\2119\35\315\353\340\200\365\0\331\271\252\363\207\230\30\265\264\367yX\351k"\11d\216\300\14\252;,\2554\271\251\265\34\240\277\325&\217=\365\204`8\342@\253\177:\253T\246:U\3\262\3\226."P\3239\303\230\260O\6\254\227]\3\232^r\213\3\230UP\360\326\253\301c\325\345,\276\363d\331\336hX\243\330c\317\356\15\211\0$\376?z\200\304n", ) P\3239\303\230\260O\6\254\227]\3\232^r\213\3\230UP\360\326\253\301c\325\345,\276\363d\331\336hX\243\330c\317\356\15\211\0$\376?z\200\304n", ) == 0x0
 02165  1604   NtWaitForSingleObject  ... ) == 0x102
 02166   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S:\337\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\273\361?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02167  1604   NtWaitForSingleObject  (160, 0, 0x0, ...
 02162   896   NtCreateThread  ... 468, {1252, 1596}, ) == 0x0
 02168   792   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02169   896   NtQueryInformationThread  (468, Basic, 28, ...
 02168   792   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02169   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1596,}, 0x0, ) == 0x0
 02170   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02171   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0<\6\0\0" ...  ...
 02170   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02171   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0<\6\0\0" )  ) == 0x0
 02172   792   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02173   792   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02174   792   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 02175   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 02176   896   NtResumeThread  (468, ... 1, ) == 0x0
 02177   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 50397184, 1048576, ) == 0x0
 02178   896   NtAllocateVirtualMemory  (-1, 51437568, 0, 8192, 4096, 4, ... 51437568, 8192, ) == 0x0
 02179   896   NtProtectVirtualMemory  (-1, (0x310e000), 4096, 260, ... (0x310e000), 4096, 4, ) == 0x0
 02180   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 472, {1252, 1132}, ) == 0x0
 02181   896   NtQueryInformationThread  (472, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=1132,}, 0x0, ) == 0x0
 02182   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02183  1596   NtTestAlert  (...
 02182   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02183  1596   NtTestAlert  ... ) == 0x0
 02184   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02185  1596   NtContinue  (50396464, 1, ...
 02184   792   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02186  1596   NtRegisterThreadTerminatePort  (24, ...
 02187   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "%JD\312\3\13\224\212\270\204\351\343$=\360\257\251\371\234\7\334\325\204g\371\360*\275\312\2513\355W\224\320\207B \331\255\3018\373\376\237\263Z_\300j\241\227\13%EWE\242 @@\321R\10\351/\275|+Z\24\37\352l, 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "%JD\312\3\13\224\212\270\204\351\343$=\360\257\251\371\234\7\334\325\204g\371\360*\275\312\2513\355W\224\320\207B \331\255\3018\373\376\237\263Z_\300j\241\227\13%EWE\242 @@\321R\10\351/\275|+Z\24\37\352l, 80, ... , 80, ...
 02186  1596   NtRegisterThreadTerminatePort  ... ) == 0x0
 02187   792   NtSetValueKey  ... ) == 0x0
 02188   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0l\4\0\0" ...  ...
 02189  1596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02188   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0l\4\0\0" )  ) == 0x0
 02189  1596   NtDuplicateObject  ... 476, ) == 0x0
 02190   896   NtResumeThread  (472, ...
 02191  1596   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02190   896   NtResumeThread  ... 1, ) == 0x0
 02191  1596   NtWaitForSingleObject  ... ) == 0x102
 02192   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02193  1596   NtWaitForSingleObject  (160, 0, 0x0, ...
 02194   792   NtClose  (-2147481484, ...
 02195  1132   NtTestAlert  (...
 02192   896   NtAllocateVirtualMemory  ... 51445760, 1048576, ) == 0x0
 02194   792   NtClose  ... ) == 0x0
 02195  1132   NtTestAlert  ... ) == 0x0
 02196   896   NtAllocateVirtualMemory  (-1, 52486144, 0, 8192, 4096, 4, ...
 02166   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "vd,\315f^\332\304\353\257j(\277\10\306\325a]J\205\267\370\345c8\311\217\3107c^\203\343\22\243?\367\267\344O;\345\264Fg\242\206\24\220>\267\240I\332\340\236\323lD\245\231\304\370\36Z\207\34\200\306s\301@C\320{\347^\26\300\246|<7\262\351\360\352\4\363m\10M\35\225\210\216\356\334<\222\243?V\352h\231\211\31\217&\222s9R\306\347\370\327\24w\201;~\203\315\250\350.\351\226\305\317\322\220\232\335P\217\342\327\231\312(\276\16nR\227m.\3720 E/;6Z\326>Er7c\364&N\251Q?\347p[\303VZ\320+\201:\362\275\27\4\5^\200\263\265\245X\236\25\\213<\15\331&\327\36S\177\2031\266\375\336LP\375\375@\340\345\244\15O\264\317\231\262\277\266\23\340\372q\240\217\336\201R\316\243m\266$\330I7OR&\355Pe\312!\177\14\32\206J\31g", ) , ) == 0x0
 02197  1132   NtContinue  (51445040, 1, ...
 02196   896   NtAllocateVirtualMemory  ... 52486144, 8192, ) == 0x0
 02198   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S:\337\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\273\361?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02199  1132   NtRegisterThreadTerminatePort  (24, ...
 02200   896   NtProtectVirtualMemory  (-1, (0x320e000), 4096, 260, ...
 02201   792   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02199  1132   NtRegisterThreadTerminatePort  ... ) == 0x0
 02200   896   NtProtectVirtualMemory  ... (0x320e000), 4096, 4, ) == 0x0
 02201   792   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02202   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02203  1132   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02204   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02203  1132   NtDuplicateObject  ... 480, ) == 0x0
 02204   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02205  1132   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02206   792   NtQuerySystemInformation  (Performance, 312, ...
 02205  1132   NtWaitForSingleObject  ... ) == 0x102
 02206   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02207  1132   NtWaitForSingleObject  (160, 0, 0x0, ...
 02208   792   NtQuerySystemInformation  (Exception, 16, ...
 02202   896   NtCreateThread  ... 484, {1252, 1064}, ) == 0x0
 02208   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02209   896   NtQueryInformationThread  (484, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1064,}, 0x0, ) == 0x0
 02210   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0(\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0(\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0(\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0(\4\0\0" )  ) == 0x0
 02211   896   NtResumeThread  (484, ... 1, ) == 0x0
 02212   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 52494336, 1048576, ) == 0x0
 02213   896   NtAllocateVirtualMemory  (-1, 53534720, 0, 8192, 4096, 4, ... 53534720, 8192, ) == 0x0
 02214   792   NtQuerySystemInformation  (Lookaside, 32, ...
 02215  1064   NtTestAlert  (...
 02214   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02215  1064   NtTestAlert  ... ) == 0x0
 02216   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02217  1064   NtContinue  (52493616, 1, ...
 02216   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02218  1064   NtRegisterThreadTerminatePort  (24, ...
 02219   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02218  1064   NtRegisterThreadTerminatePort  ... ) == 0x0
 02219   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02220   896   NtProtectVirtualMemory  (-1, (0x330e000), 4096, 260, ...
 02221  1064   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02220   896   NtProtectVirtualMemory  ... (0x330e000), 4096, 4, ) == 0x0
 02221  1064   NtDuplicateObject  ... 488, ) == 0x0
 02222   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02223  1064   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02222   896   NtCreateThread  ... 492, {1252, 184}, ) == 0x0
 02223  1064   NtWaitForSingleObject  ... ) == 0x102
 02224   896   NtQueryInformationThread  (492, Basic, 28, ...
 02225  1064   NtWaitForSingleObject  (160, 0, 0x0, ...
 02224   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=184,}, 0x0, ) == 0x0
 02226   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 02227   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "#s\217\312\0\251\13\327R'Q\333\276\37-\311m\23C\331%\206\370\272_S\3\373V\14 g.7\3\324X\201>\36z\306\2028$\20d\2049\312\250L\212|.\24\31\27\217\233\255\2335>m\354\32l\266!\327\303\27\271liG\243f\272", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "#s\217\312\0\251\13\327R'Q\333\276\37-\311m\23C\331%\206\370\272_S\3\373V\14 g.7\3\324X\201>\36z\306\2028$\20d\2049\312\250L\212|.\24\31\27\217\233\255\2335>m\354\32l\266!\327\303\27\271liG\243f\272", 80, ... ) , 80, ... ) == 0x0
 02228   792   NtClose  (-2147481484, ... ) == 0x0
 02198   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\260\362Ig\203\35%\2154\331.k3\210\21A\266\277\331\33W\262C-\347\177\261wIc\230\327|\217\323\275\231\207(\242\211\141kW\223\377\374@#\356\220\214\361U\34\364\337\6\355-\217\303\356x[\342(?Q(\10\373\311\2151\300&\364P.K\343\34\257G_\177\300 \221\306\304C\374\35\235A\323c\265\36\260\30\253\215L2\300=\33\264\360&\376BG\251\37\374\201b\310\264\260\235\303V5\304=#]a\376=\320\214\220\177\232m\345b\341o\310\211a\243\220\244\6\6\342.\20Z\332\350%>r\2\364\365pU\206\153\236\3769\240\11-\321|\244\6\33q\253\267\333\11Q37\15+G|\2411\16\227Kf\325\17\371\343\307\212w%\3462\30\215\316\24\345\20\267\373\321#\210\213\362uu4\245D6\257\177M\1\213\313\2615'G\11\324\21\25'}\30pzi\17\374T"\206)", ) \206)", ) == 0x0
 02229   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S:\337\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\273\361?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02230   792   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02231   792   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02232   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0\270\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0\270\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0\270\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0\270\0\0\0" )  ) == 0x0
 02233   896   NtResumeThread  (492, ... 1, ) == 0x0
 02234   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 53542912, 1048576, ) == 0x0
 02235   896   NtAllocateVirtualMemory  (-1, 54583296, 0, 8192, 4096, 4, ... 54583296, 8192, ) == 0x0
 02236   896   NtProtectVirtualMemory  (-1, (0x340e000), 4096, 260, ... (0x340e000), 4096, 4, ) == 0x0
 02237   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02238   792   NtQuerySystemInformation  (Performance, 312, ...
 02239   184   NtTestAlert  (...
 02238   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02239   184   NtTestAlert  ... ) == 0x0
 02240   792   NtQuerySystemInformation  (Exception, 16, ...
 02241   184   NtContinue  (53542192, 1, ...
 02240   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02242   184   NtRegisterThreadTerminatePort  (24, ...
 02243   792   NtQuerySystemInformation  (Lookaside, 32, ...
 02242   184   NtRegisterThreadTerminatePort  ... ) == 0x0
 02243   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02237   896   NtCreateThread  ... 496, {1252, 1384}, ) == 0x0
 02244   184   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02245   896   NtQueryInformationThread  (496, Basic, 28, ...
 02244   184   NtDuplicateObject  ... 500, ) == 0x0
 02245   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=1384,}, 0x0, ) == 0x0
 02246   184   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02247   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\0h\5\0\0" ...  ...
 02246   184   NtWaitForSingleObject  ... ) == 0x102
 02247   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\0h\5\0\0" )  ) == 0x0
 02248   184   NtWaitForSingleObject  (160, 0, 0x0, ...
 02249   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02250   896   NtResumeThread  (496, ...
 02249   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02250   896   NtResumeThread  ... 1, ) == 0x0
 02251   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02252   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02251   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02252   896   NtAllocateVirtualMemory  ... 54591488, 1048576, ) == 0x0
 02253   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02254   896   NtAllocateVirtualMemory  (-1, 55631872, 0, 8192, 4096, 4, ...
 02253   792   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02254   896   NtAllocateVirtualMemory  ... 55631872, 8192, ) == 0x0
 02255  1384   NtTestAlert  (...
 02256   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "(L\2238\313\221\325\243,\267@\2371\264\235C\210>/N9\25\224:\235\232\205\6\262\243"\17\377\221\12w2w\366fn\3329sd9\347_3\374uWl\223\274rK5\212\2\262\310R^tT03\370\243]\311\306<\372\255\374\341\4\306", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "(L\2238\313\221\325\243,\267@\2371\264\235C\210>/N9\25\224:\235\232\205\6\262\243"\17\377\221\12w2w\366fn\3329sd9\347_3\374uWl\223\274rK5\212\2\262\310R^tT03\370\243]\311\306<\372\255\374\341\4\306", 80, ... \17\377\221\12w2w\366fn\3329sd9\347_3\374uWl\223\274rK5\212\2\262\310R^tT03\370\243]\311\306<\372\255\374\341\4\306", 80, ...
 02255  1384   NtTestAlert  ... ) == 0x0
 02256   792   NtSetValueKey  ... ) == 0x0
 02257  1384   NtContinue  (54590768, 1, ...
 02258   792   NtClose  (-2147481484, ...
 02259  1384   NtRegisterThreadTerminatePort  (24, ...
 02258   792   NtClose  ... ) == 0x0
 02259  1384   NtRegisterThreadTerminatePort  ... ) == 0x0
 02229   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "j}i\327\325\317f\16D'B\336\300\362\67\220~huN0nr\0+\277\266y/\2662\236\5\325\3426\130\3\246\31\302\372\271Be?\0^\247[U\272\306\357,GhH\277\341\4b\313\254\244t\346gu\30\357\246\207\376\201\42\6\207\342\261\340\0\5\32587\360\245\345\350M9Ri\2\370\366\350\337r\203\207'\304\376_\246\250\7\215\344V\374\34\316k\305g3\\322\320u\350\360>=\220g\373\322`h\3\34\371\26\275|\244\17\27\342y\217r\342\12\260\201\325\5P\3256\377\256A\306\377\321\263\212G:\311\211\303X\14\247zNH\317\344%W\247\23\224g\313f\360O\10\341B\304\201\246\315\24\304Z\304\267;`\311\25\344\375H}\376\25\3154\315\243\325`&Q\5\333\312\262\3327"=$\250\342\365\3\342_q\373\217\201\34N\36\355:\366s\220\344\226;\3435\34\16\203\313", ) =$\250\342\365\3\342_q\373\217\201\34N\36\355:\366s\220\344\226;\3435\34\16\203\313", ) == 0x0
 02260   896   NtProtectVirtualMemory  (-1, (0x350e000), 4096, 260, ...
 02261   792   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "s\210\360Z\247\271\361\321\242\224\276\233;S:\337\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\177\370\341\326R\237\242\273\361?\33d\210\256+\367\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02260   896   NtProtectVirtualMemory  ... (0x350e000), 4096, 4, ) == 0x0
 02262  1384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02263   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02262  1384   NtDuplicateObject  ... 504, ) == 0x0
 02263   896   NtCreateThread  ... 508, {1252, 296}, ) == 0x0
 02264  1384   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02265   896   NtQueryInformationThread  (508, Basic, 28, ...
 02264  1384   NtWaitForSingleObject  ... ) == 0x102
 02265   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=296,}, 0x0, ) == 0x0
 02266  1384   NtWaitForSingleObject  (160, 0, 0x0, ...
 02267   792   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02268   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0(\1\0\0" ...  ...
 02267   792   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02268   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0(\1\0\0" )  ) == 0x0
 02269   792   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02270   896   NtResumeThread  (508, ...
 02269   792   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02270   896   NtResumeThread  ... 1, ) == 0x0
 02271   792   NtQuerySystemInformation  (Performance, 312, ...
 02272   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02271   792   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02273   296   NtTestAlert  (...
 02272   896   NtAllocateVirtualMemory  ... 55640064, 1048576, ) == 0x0
 02273   296   NtTestAlert  ... ) == 0x0
 02274   896   NtAllocateVirtualMemory  (-1, 56680448, 0, 8192, 4096, 4, ...
 02275   296   NtContinue  (55639344, 1, ...
 02274   896   NtAllocateVirtualMemory  ... 56680448, 8192, ) == 0x0
 02276   296   NtRegisterThreadTerminatePort  (24, ...
 02277   896   NtProtectVirtualMemory  (-1, (0x360e000), 4096, 260, ...
 02276   296   NtRegisterThreadTerminatePort  ... ) == 0x0
 02277   896   NtProtectVirtualMemory  ... (0x360e000), 4096, 4, ) == 0x0
 02278   792   NtQuerySystemInformation  (Exception, 16, ...
 02279   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02278   792   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02280   296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02281   792   NtQuerySystemInformation  (Lookaside, 32, ...
 02280   296   NtDuplicateObject  ... 512, ) == 0x0
 02281   792   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02282   296   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 02283   792   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02282   296   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 02283   792   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02284   296   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02279   896   NtCreateThread  ... 516, {1252, 1356}, ) == 0x0
 02285   896   NtQueryInformationThread  (516, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=1356,}, 0x0, ) == 0x0
 02286   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0L\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0L\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0L\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0L\5\0\0" )  ) == 0x0
 02287   896   NtResumeThread  (516, ... 1, ) == 0x0
 02288   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 56688640, 1048576, ) == 0x0
 02289   896   NtAllocateVirtualMemory  (-1, 57729024, 0, 8192, 4096, 4, ... 57729024, 8192, ) == 0x0
 02290   792   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02291  1356   NtTestAlert  (...
 02284   296   NtWaitForSingleObject  ... ) == 0x102
 02290   792   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02291  1356   NtTestAlert  ... ) == 0x0
 02292   296   NtWaitForSingleObject  (160, 0, 0x0, ...
 02293   792   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02294  1356   NtContinue  (56687920, 1, ...
 02293   792   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02295  1356   NtRegisterThreadTerminatePort  (24, ...
 02296   792   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\236.\333[\203\232`eS\203\206\0\300sd\237@\0\30\3755\240\367\233\2402\372\375\353"M\234\336\313\203\14gWG\334\224\357w\213(\327\330.%}\277\227\21t\352\376>\277\0\2011\241\32e\363\326p\231\224\330\345\315()\301\366\301\317@", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\236.\333[\203\232`eS\203\206\0\300sd\237@\0\30\3755\240\367\233\2402\372\375\353"M\234\336\313\203\14gWG\334\224\357w\213(\327\330.%}\277\227\21t\352\376>\277\0\2011\241\32e\363\326p\231\224\330\345\315()\301\366\301\317@", 80, ... M\234\336\313\203\14gWG\334\224\357w\213(\327\330.%}\277\227\21t\352\376>\277\0\2011\241\32e\363\326p\231\224\330\345\315()\301\366\301\317@", 80, ...
 02295  1356   NtRegisterThreadTerminatePort  ... ) == 0x0
 02296   792   NtSetValueKey  ... ) == 0x0
 02297   896   NtProtectVirtualMemory  (-1, (0x370e000), 4096, 260, ...
 02298  1356   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02297   896   NtProtectVirtualMemory  ... (0x370e000), 4096, 4, ) == 0x0
 02298  1356   NtDuplicateObject  ... 520, ) == 0x0
 02299   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02300  1356   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02299   896   NtCreateThread  ... 524, {1252, 1796}, ) == 0x0
 02300  1356   NtWaitForSingleObject  ... ) == 0x102
 02301   896   NtQueryInformationThread  (524, Basic, 28, ...
 02302  1356   NtWaitForSingleObject  (160, 0, 0x0, ...
 02301   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=1796,}, 0x0, ) == 0x0
 02303   792   NtClose  (-2147481484, ... ) == 0x0
 02261   792   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\22\251\266k\314\222\362V\153\272\35Dh\24k\224\360\347\234\2669\11a\36p\363\2622\341\273\353\210\374\207\337q:\2207[\214\214DcE\351\345)F\350V\260\16X\334QA\251B\313\4\237\317\211\220\347\340\345\310\371M\311NG\7t\273'\367u\37\276\332\331c=\315\2647\2076\307\234\255\364\200\50\244\5cu \304\0Y\363\373\301\253\370E\212\352\250\222\250\223\377`\271\210\335S\217U\222\360l\320\31X\240L\320j\202.KJ\7\236\16J\24\2342\311Df\331\374b\205T7\373\363\207Y\313\347\241\252\207\264q\26\301\322\220S\343\336\Z4\202\361\313u\264~E\242\345\215&\327\31]N\273B\315\158h\235\273\346K\22\216[\364\21\15.1\04\311\336\336wo\204\224\233\252\250cRl\377\367{\206FoT\350\315\277\273$\310\48\227\26\2'+\206>\310\367io", ) , ) == 0x0
 02304   792   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 528, ) == 0x0
 02305   792   NtSetEventBoostPriority  (400, ...
 02081  1276   NtWaitForSingleObject  ... ) == 0x0
 02306  1276   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 02307  1276   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 532, ) == 0x0
 02308  1276   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ... 536, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ... 536, 0x0, 0x0, 0x0, 188, ) == 0x0
 02309  1276   NtRequestWaitReplyPort  (536, {200, 224, new_msg, 0, 2883626, 1363432, 12, 2}  (536, {200, 224, new_msg, 0, 2883626, 1363432, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\107\24\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\362>ip\360+\273\201\350X\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\300X\25\0]\257\241wx\1\24\0\340X\25\0h\1\24\0\0\0\0\0\0\0\0\0\340X\25\0P\0\0\0\350X\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 02305   792   NtSetEventBoostPriority  ... ) == 0x0
 02310   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0\344\4\0\0\4\7\0\0" ...  ...
 02311   792   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789420, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789420, 188, ...
 02310   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\2\0\0\344\4\0\0\4\7\0\0" )  ) == 0x0
 02312   896   NtResumeThread  (524, ... 1, ) == 0x0
 02313   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02311   792   NtConnectPort  ... 540, 0x0, 0x0, 0x0, 188, ) == 0x0
 02309  1276   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1276, 81934, 0}  ... {200, 224, reply, 0, 1252, 1276, 81934, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\107\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\362>ip\360+\273\201\350X\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\300X\25\0]\257\241wx\1\24\0\340X\25\0h\1\24\0\0\0\0\0\0\0\0\0\340X\25\0P\0\0\0\350X\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 02314  1796   NtTestAlert  (...
 02315   792   NtRequestWaitReplyPort  (540, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721}  (540, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0]LW:\224\222\364\2038Y\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0PB\25\0|\300&\272x\1\24\00Y\25\0h\1\24\0\0\0\0\0\0\0\0\00Y\25\0P\0\0\08Y\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\360\0\372\31\221|\200\363\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02316  1276   NtRequestWaitReplyPort  (536, {44, 68, new_msg, 56, 0, 0, 0, 0}  (536, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0\230Z\25\0\322\0\0\0" ...  ...
 02314  1796   NtTestAlert  ... ) == 0x0
 02317  1796   NtContinue  (57736496, 1, ...
 02318  1796   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02316  1276   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1276, 81936, 0}  ... {40, 64, reply, 0, 1252, 1276, 81936, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 02313   896   NtAllocateVirtualMemory  ... 57737216, 1048576, ) == 0x0
 02319  1276   NtRequestWaitReplyPort  (536, {64, 88, new_msg, 56, 1310720, 11596276, 1399440, 0}  (536, {64, 88, new_msg, 56, 1310720, 11596276, 1399440, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\220[\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02320   896   NtAllocateVirtualMemory  (-1, 58777600, 0, 8192, 4096, 4, ...
 02321  1796   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02315   792   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 792, 81935, 0}  ... {200, 224, reply, 0, 1252, 792, 81935, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0]LW:\224\222\364\2038Y\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0PB\25\0|\300&\272x\1\24\00Y\25\0h\1\24\0\0\0\0\0\0\0\0\00Y\25\0P\0\0\08Y\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\360\0\372\31\221|\200\363\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02320   896   NtAllocateVirtualMemory  ... 58777600, 8192, ) == 0x0
 02321  1796   NtDuplicateObject  ... 544, ) == 0x0
 02322   792   NtRequestWaitReplyPort  (540, {44, 68, new_msg, 0, 1252, 792, 81916, 0}  (540, {44, 68, new_msg, 0, 1252, 792, 81916, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 02323   896   NtProtectVirtualMemory  (-1, (0x380e000), 4096, 260, ...
 02324  1796   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 02323   896   NtProtectVirtualMemory  ... (0x380e000), 4096, 4, ) == 0x0
 02324  1796   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 02322   792   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 792, 81937, 0}  ... {40, 64, reply, 0, 1252, 792, 81937, 0} "\2\356Q\200\4\0\0\0@\14\250\201\0\320\372\177\220kt\367\370\37`\300lkt\367X\353Q\200\320\1\0\0X-\12\0" )  ) == 0x0
 02325   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02326  1796   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02327   792   NtRequestWaitReplyPort  (540, {64, 88, new_msg, 56, 1378416, 15789932, 15790032, 0}  (540, {64, 88, new_msg, 56, 1378416, 15789932, 15790032, 0} "\10\357\360\0@\0\25\0\346\277\347w\320\357\360\0l\357\360\0\20\0\0\0\250.\362v\344\10\25\0\1\0\0\0 a\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\30\367\24\0" ...  ...
 02319  1276   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1276, 81938, 0}  ... {64, 88, reply, 56, 1252, 1276, 81938, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\220[\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02328  1276   NtRequestWaitReplyPort  (536, {44, 68, new_msg, 56, 1252, 1276, 81936, 0}  (536, {44, 68, new_msg, 56, 1252, 1276, 81936, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\230Z\25\0\322\0\0\0" ... {40, 64, reply, 0, 1252, 1276, 81940, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ... {40, 64, reply, 0, 1252, 1276, 81940, 0}  (536, {44, 68, new_msg, 56, 1252, 1276, 81936, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\230Z\25\0\322\0\0\0" ... {40, 64, reply, 0, 1252, 1276, 81940, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 02329  1276   NtRequestWaitReplyPort  (536, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (536, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\350m\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 1276, 81941, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\350m\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 1252, 1276, 81941, 0}  (536, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\350m\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1252, 1276, 81941, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\350m\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02330  1276   NtRequestWaitReplyPort  (536, {44, 68, new_msg, 56, 1252, 1276, 81940, 0}  (536, {44, 68, new_msg, 56, 1252, 1276, 81940, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0\230Z\25\0\322\0\0\0" ... {40, 64, reply, 0, 1252, 1276, 81942, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ... {40, 64, reply, 0, 1252, 1276, 81942, 0}  (536, {44, 68, new_msg, 56, 1252, 1276, 81940, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0\230Z\25\0\322\0\0\0" ... {40, 64, reply, 0, 1252, 1276, 81942, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 02331  1276   NtRequestWaitReplyPort  (536, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (536, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\00f\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02325   896   NtCreateThread  ... 548, {1252, 1728}, ) == 0x0
 02326  1796   NtWaitForSingleObject  ... ) == 0x102
 02327   792   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 792, 81939, 0}  ... {64, 88, reply, 56, 1252, 792, 81939, 0} "\10\357\360\0@\0\25\0\346\277\347w\320\357\360\0l\357\360\0\20\0\0\0\250.\362v\344\10\25\0\1\0\0\0 a\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\30\367\24\0" )  ) == 0x0
 02332   896   NtQueryInformationThread  (548, Basic, 28, ...
 02333  1796   NtWaitForSingleObject  (160, 0, 0x0, ...
 02334   792   NtClose  (528, ...
 02332   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=1728,}, 0x0, ) == 0x0
 02334   792   NtClose  ... ) == 0x0
 02335   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\300\6\0\0" ...  ...
 02336   792   NtClose  (540, ...
 02335   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\300\6\0\0" )  ) == 0x0
 02336   792   NtClose  ... ) == 0x0
 02331  1276   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1276, 81945, 0}  ... {64, 88, reply, 56, 1252, 1276, 81945, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\00f\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02337   792   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02338  1276   NtClose  (532, ...
 02339   896   NtResumeThread  (548, ...
 02338  1276   NtClose  ... ) == 0x0
 02339   896   NtResumeThread  ... 1, ) == 0x0
 02340  1276   NtClose  (536, ...
 02341   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02340  1276   NtClose  ... ) == 0x0
 02341   896   NtAllocateVirtualMemory  ... 58785792, 1048576, ) == 0x0
 02337   792   NtCreateKey  ... 536, 2, ) == 0x0
 02342  1728   NtTestAlert  (...
 02343   896   NtAllocateVirtualMemory  (-1, 59826176, 0, 8192, 4096, 4, ...
 02344   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02342  1728   NtTestAlert  ... ) == 0x0
 02343   896   NtAllocateVirtualMemory  ... 59826176, 8192, ) == 0x0
 02344   792   NtOpenKey  ... 532, ) == 0x0
 02345  1728   NtContinue  (58785072, 1, ...
 02346  1276   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02347   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02348  1728   NtRegisterThreadTerminatePort  (24, ...
 02346  1276   NtCreateEvent  ... 540, ) == 0x0
 02347   792   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02348  1728   NtRegisterThreadTerminatePort  ... ) == 0x0
 02349  1276   NtOpenThreadToken  (-2, 0xc, 1, ...
 02350   792   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 02351   896   NtProtectVirtualMemory  (-1, (0x390e000), 4096, 260, ...
 02349  1276   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02352  1728   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02351   896   NtProtectVirtualMemory  ... (0x390e000), 4096, 4, ) == 0x0
 02353  1276   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02352  1728   NtDuplicateObject  ... 528, ) == 0x0
 02354   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02353  1276   NtCreateEvent  ... 552, ) == 0x0
 02355  1728   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02354   896   NtCreateThread  ... 556, {1252, 212}, ) == 0x0
 02350   792   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02355  1728   NtWaitForSingleObject  ... ) == 0x102
 02356   896   NtQueryInformationThread  (556, Basic, 28, ...
 02357   792   NtQueryValueKey  (536,  (536, "Domain", Partial, 144, ... , Partial, 144, ...
 02358  1728   NtWaitForSingleObject  (160, 0, 0x0, ...
 02356   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=212,}, 0x0, ) == 0x0
 02357   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02359  1276   NtOpenThreadToken  (-2, 0xc, 1, ...
 02360   792   NtQueryValueKey  (536,  (536, "Domain", Partial, 144, ... , Partial, 144, ...
 02359  1276   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02360   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02361  1276   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02362   792   NtClose  (536, ...
 02361  1276   NtSetInformationThread  ... ) == 0x0
 02363   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\324\0\0\0" ...  ...
 02364  1276   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11595968,  (0xc0100080, {24, 0, 0x40, 0, 11595968, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02363   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\324\0\0\0" )  ) == 0x0
 02364  1276   NtCreateFile  ... 560, {status=0x0, info=1}, ) == 0x0
 02365   896   NtResumeThread  (556, ... 1, ) == 0x0
 02366   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 59834368, 1048576, ) == 0x0
 02367   896   NtAllocateVirtualMemory  (-1, 60874752, 0, 8192, 4096, 4, ... 60874752, 8192, ) == 0x0
 02368   896   NtProtectVirtualMemory  (-1, (0x3a0e000), 4096, 260, ... (0x3a0e000), 4096, 4, ) == 0x0
 02369   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02370  1276   NtSetInformationFile  (560, 11596024, 8, Pipe, ...
 02362   792   NtClose  ... ) == 0x0
 02371   212   NtTestAlert  (...
 02370  1276   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02372   792   NtClose  (532, ...
 02371   212   NtTestAlert  ... ) == 0x0
 02373  1276   NtSetInformationFile  (560, 11596012, 8, Completion, ...
 02372   792   NtClose  ... ) == 0x0
 02374   212   NtContinue  (59833648, 1, ...
 02373  1276   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02375   792   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 02376   212   NtRegisterThreadTerminatePort  (24, ...
 02377  1276   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02375   792   NtOpenKey  ... 532, ) == 0x0
 02376   212   NtRegisterThreadTerminatePort  ... ) == 0x0
 02377  1276   NtSetInformationThread  ... ) == 0x0
 02378   792   NtQueryValueKey  (532,  (532, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 02369   896   NtCreateThread  ... 536, {1252, 1256}, ) == 0x0
 02379   212   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02380  1276   NtWriteFile  (560, 197, 0, 0,  (560, 197, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 02381   896   NtQueryInformationThread  (536, Basic, 28, ...
 02379   212   NtDuplicateObject  ... 564, ) == 0x0
 02380  1276   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 02381   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1256,}, 0x0, ) == 0x0
 02382   212   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02383  1276   NtReadFile  (560, 197, 0, 0, 1024, {0, 0}, 0, ...
 02384   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0\350\4\0\0" ...  ...
 02382   212   NtWaitForSingleObject  ... ) == 0x102
 02383  1276   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02384   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0\350\4\0\0" )  ) == 0x0
 02385   212   NtWaitForSingleObject  (160, 0, 0x0, ...
 02386  1276   NtFsControlFile  (560, 197, 0x0, 0x0, 0x11c017,  (560, 197, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\260\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 02378   792   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02387   896   NtResumeThread  (536, ...
 02386  1276   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02388   792   NtClose  (532, ...
 02387   896   NtResumeThread  ... 1, ) == 0x0
 02388   792   NtClose  ... ) == 0x0
 02389   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02390   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15789008, ... }, 15789008, ...
 02389   896   NtAllocateVirtualMemory  ... 60882944, 1048576, ) == 0x0
 02390   792   NtQueryAttributesFile  ... ) == 0x0
 02391   896   NtAllocateVirtualMemory  (-1, 61923328, 0, 8192, 4096, 4, ...
 02392   792   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02391   896   NtAllocateVirtualMemory  ... 61923328, 8192, ) == 0x0
 02393  1276   NtFsControlFile  (560, 197, 0x0, 0x0, 0x11c017,  (560, 197, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351\1\0\0\0\1\0\0\0&\0(\0\360i\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 02394  1256   NtWaitForSingleObject  (128, 0, 0x0, ...
 02392   792   NtOpenFile  ... 532, {status=0x0, info=1}, ) == 0x0
 02393  1276   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351\0\0\0\0", ) , ) == 0x103
 02395   792   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 532, ...
 02396  1276   NtFsControlFile  (560, 197, 0x0, 0x0, 0x11c017,  (560, 197, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351", 44, 1024, ... , 44, 1024, ...
 02395   792   NtCreateSection  ... 568, ) == 0x0
 02396  1276   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\300J\25\0\1\0\0\0\314J\25\0 \0\0\0\1\0\0\0\30\0\32\0\330J\25\0\364J\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0(K\25\0\1\0\0\0\5\0i\08K\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02397   792   NtClose  (532, ...
 02398  1276   NtClose  (552, ...
 02397   792   NtClose  ... ) == 0x0
 02398  1276   NtClose  ... ) == 0x0
 02399   792   NtMapViewOfSection  (568, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02400   896   NtProtectVirtualMemory  (-1, (0x3b0e000), 4096, 260, ...
 02401  1276   NtClose  (560, ...
 02400   896   NtProtectVirtualMemory  ... (0x3b0e000), 4096, 4, ) == 0x0
 02401  1276   NtClose  ... ) == 0x0
 02402   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02403  1276   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1329576, 0x0, 11597892, 188, ... , {12, 2, 1, 1}, 0x0, 1329576, 0x0, 11597892, 188, ...
 02402   896   NtCreateThread  ... 560, {1252, 464}, ) == 0x0
 02403  1276   NtSecureConnectPort  ... 552, 0x0, 0x0, 0x0, 188, ) == 0x0
 02404   896   NtQueryInformationThread  (560, Basic, 28, ...
 02405  1276   NtOpenThreadToken  (-2, 0xc, 1, ...
 02404   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=464,}, 0x0, ) == 0x0
 02399   792   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 02405  1276   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02406   792   NtClose  (568, ...
 02407  1276   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02406   792   NtClose  ... ) == 0x0
 02407  1276   NtSetInformationThread  ... ) == 0x0
 02408   792   NtUnmapViewOfSection  (-1, 0x360000, ...
 02409  1276   NtRequestWaitReplyPort  (552, {200, 224, new_msg, 0, 1363432, 12, 2, 1310977}  (552, {200, 224, new_msg, 0, 1363432, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\313Y[\260\253"\355\5i\37;\245qc\244\12\0\0\0x\1\3470\250\214\270O\0\0\0\0H.\25\0P\232\357\265[\202\264\243(\0\0\0\340$\0\240\0\0\24\0\240\366\260\0\274c\3\5\0\0\0\0\350X\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... \355\5i\37;\245qc\244\12\0\0\0x\1\3470\250\214\270O\0\0\0\0H.\25\0P\232\357\265[\202\264\243(\0\0\0\340$\0\240\0\0\24\0\240\366\260\0\274c\3\5\0\0\0\0\350X\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...
 02408   792   NtUnmapViewOfSection  ... ) == 0x0
 02410   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15789316, ... }, 15789316, ...
 02409  1276   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1276, 81950, 0}  ... {200, 224, reply, 0, 1252, 1276, 81950, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\313Y[\260\253"\355\5i\37;\245qc\244\12\0\0\0x\1\3470\250\214\270O\0\0\0\0H.\25\0P\232\357\265[\202\264\243(\0\0\0\340$\0\240\0\0\24\0\240\366\260\0\274c\3\5\0\0\0\0\350X\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \355\5i\37;\245qc\244\12\0\0\0x\1\3470\250\214\270O\0\0\0\0H.\25\0P\232\357\265[\202\264\243(\0\0\0\340$\0\240\0\0\24\0\240\366\260\0\274c\3\5\0\0\0\0\350X\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) == 0x0
 02411   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\320\1\0\0" ...  ...
 02410   792   NtQueryAttributesFile  ... ) == 0x0
 02411   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\320\1\0\0" )  ) == 0x0
 02412   792   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02413   896   NtResumeThread  (560, ...
 02412   792   NtOpenFile  ... 568, {status=0x0, info=1}, ) == 0x0
 02413   896   NtResumeThread  ... 1, ) == 0x0
 02414   792   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 568, ...
 02415   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02414   792   NtCreateSection  ... 532, ) == 0x0
 02416  1276   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02417   464   NtWaitForSingleObject  (128, 0, 0x0, ...
 02418   792   NtQuerySection  (532, Image, 48, ...
 02416  1276   NtSetInformationThread  ... ) == 0x0
 02415   896   NtAllocateVirtualMemory  ... 61931520, 1048576, ) == 0x0
 02419  1276   NtRequestWaitReplyPort  (552, {56, 80, new_msg, 0, 44, 3, 20, 0}  (552, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0\32\235JO\235\342d\324\312\304\340\351\1\0\0\0\0\0\0\0&\0(\0\234\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02420   896   NtAllocateVirtualMemory  (-1, 62971904, 0, 8192, 4096, 4, ... 62971904, 8192, ) == 0x0
 02421   896   NtProtectVirtualMemory  (-1, (0x3c0e000), 4096, 260, ... (0x3c0e000), 4096, 4, ) == 0x0
 02422   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02418   792   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02423   792   NtClose  (568, ... ) == 0x0
 02424   792   NtMapViewOfSection  (532, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 32768, ) == 0x0
 02425   792   NtClose  (532, ... ) == 0x0
 02426   792   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02427   792   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02428   792   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02422   896   NtCreateThread  ... 532, {1252, 1936}, ) == 0x0
 02429   896   NtQueryInformationThread  (532, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=1936,}, 0x0, ) == 0x0
 02430   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\220\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\220\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\220\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\220\7\0\0" )  ) == 0x0
 02431   896   NtResumeThread  (532, ... 1, ) == 0x0
 02432   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 62980096, 1048576, ) == 0x0
 02433   896   NtAllocateVirtualMemory  (-1, 64020480, 0, 8192, 4096, 4, ... 64020480, 8192, ) == 0x0
 02428   792   NtFlushInstructionCache  ... ) == 0x0
 02434  1936   NtWaitForSingleObject  (128, 0, 0x0, ...
 02419  1276   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 1276, 81952, 0}  ... {44, 68, reply, 0, 1252, 1276, 81952, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02435   792   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02436  1276   NtRaiseException  (11598352, 11597612, 1, ...
 02435   792   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02437   896   NtProtectVirtualMemory  (-1, (0x3d0e000), 4096, 260, ...
 02438   792   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02437   896   NtProtectVirtualMemory  ... (0x3d0e000), 4096, 4, ) == 0x0
 02438   792   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02439   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02440   792   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02439   896   NtCreateThread  ... 568, {1252, 1648}, ) == 0x0
 02441  1276   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 02442   896   NtQueryInformationThread  (568, Basic, 28, ...
 02441  1276   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 02442   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=1648,}, 0x0, ) == 0x0
 02443  1276   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 02440   792   NtFlushInstructionCache  ... ) == 0x0
 02443  1276   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02444   792   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... }, ...
 02445  1276   NtContinue  (11596580, 0, ...
 02444   792   NtOpenSection  ... 572, ) == 0x0
 02446  1276   NtDeviceIoControlFile  (412, 136, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 02447   792   NtMapViewOfSection  (572, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02448   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0p\6\0\0" ...  ...
 02447   792   NtMapViewOfSection  ... (0x76f60000), 0x0, 180224, ) == 0x0
 02448   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81954, 0}  ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0p\6\0\0" )  ) == 0x0
 02449   792   NtClose  (572, ...
 02450   896   NtResumeThread  (568, ...
 02446  1276   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 02450   896   NtResumeThread  ... 1, ) == 0x0
 02451  1276   NtWaitForSingleObject  (136, 1, {-5000000, -1}, ...
 02452   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02449   792   NtClose  ... ) == 0x0
 02453  1648   NtWaitForSingleObject  (128, 0, 0x0, ...
 02454   792   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02452   896   NtAllocateVirtualMemory  ... 64028672, 1048576, ) == 0x0
 02455   896   NtAllocateVirtualMemory  (-1, 65069056, 0, 8192, 4096, 4, ...
 02456   792   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02457   792   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02458   792   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02459   792   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02460   792   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02455   896   NtAllocateVirtualMemory  ... 65069056, 8192, ) == 0x0
 02461   896   NtProtectVirtualMemory  (-1, (0x3e0e000), 4096, 260, ... (0x3e0e000), 4096, 4, ) == 0x0
 02462   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 572, {1252, 1688}, ) == 0x0
 02463   896   NtQueryInformationThread  (572, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=1688,}, 0x0, ) == 0x0
 02464   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\230\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\230\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\230\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0\230\6\0\0" )  ) == 0x0
 02465   792   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02466   792   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02467   792   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02468   896   NtResumeThread  (572, ... 1, ) == 0x0
 02469   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 65077248, 1048576, ) == 0x0
 02470   896   NtAllocateVirtualMemory  (-1, 66117632, 0, 8192, 4096, 4, ... 66117632, 8192, ) == 0x0
 02471  1688   NtWaitForSingleObject  (128, 0, 0x0, ...
 02472   896   NtProtectVirtualMemory  (-1, (0x3f0e000), 4096, 260, ... (0x3f0e000), 4096, 4, ) == 0x0
 02473   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 576, {1252, 1584}, ) == 0x0
 02474   896   NtQueryInformationThread  (576, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1584,}, 0x0, ) == 0x0
 02475   792   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02476   792   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 580, ) == 0x0
 02477   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 584, ) }, ... 584, ) == 0x0
 02478   792   NtQueryValueKey  (584,  (584, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (584, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02479   792   NtClose  (584, ... ) == 0x0
 02480   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\00\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\00\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\00\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\00\6\0\0" )  ) == 0x0
 02481   896   NtResumeThread  (576, ... 1, ) == 0x0
 02482   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 66125824, 1048576, ) == 0x0
 02483   896   NtAllocateVirtualMemory  (-1, 67166208, 0, 8192, 4096, 4, ... 67166208, 8192, ) == 0x0
 02484   896   NtProtectVirtualMemory  (-1, (0x400e000), 4096, 260, ... (0x400e000), 4096, 4, ) == 0x0
 02485   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02486   792   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... }, ...
 02487  1584   NtWaitForSingleObject  (128, 0, 0x0, ...
 02486   792   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02488   792   NtQueryPerformanceCounter  (... {-1446288268, 16}, {3579545, 0}, ) == 0x0
 02489   792   NtSetEventBoostPriority  (128, ...
 02394  1256   NtWaitForSingleObject  ... ) == 0x0
 02490  1256   NtSetEventBoostPriority  (128, ...
 02417   464   NtWaitForSingleObject  ... ) == 0x0
 02491   464   NtSetEventBoostPriority  (128, ...
 02434  1936   NtWaitForSingleObject  ... ) == 0x0
 02492  1936   NtSetEventBoostPriority  (128, ...
 02453  1648   NtWaitForSingleObject  ... ) == 0x0
 02493  1648   NtAllocateVirtualMemory  (-1, 3629056, 0, 4096, 4096, 4, ... 3629056, 4096, ) == 0x0
 02492  1936   NtSetEventBoostPriority  ... ) == 0x0
 02491   464   NtSetEventBoostPriority  ... ) == 0x0
 02490  1256   NtSetEventBoostPriority  ... ) == 0x0
 02489   792   NtSetEventBoostPriority  ... ) == 0x0
 02485   896   NtCreateThread  ... 584, {1252, 1944}, ) == 0x0
 02494  1648   NtSetEventBoostPriority  (128, ...
 02495  1936   NtTestAlert  (...
 02496   464   NtTestAlert  (...
 02497  1256   NtTestAlert  (...
 02498   896   NtQueryInformationThread  (584, Basic, 28, ...
 02471  1688   NtWaitForSingleObject  ... ) == 0x0
 02494  1648   NtSetEventBoostPriority  ... ) == 0x0
 02495  1936   NtTestAlert  ... ) == 0x0
 02496   464   NtTestAlert  ... ) == 0x0
 02497  1256   NtTestAlert  ... ) == 0x0
 02499  1688   NtSetEventBoostPriority  (128, ...
 02498   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=1944,}, 0x0, ) == 0x0
 02500  1648   NtTestAlert  (...
 02501  1936   NtContinue  (62979376, 1, ...
 02502   464   NtContinue  (61930800, 1, ...
 02487  1584   NtWaitForSingleObject  ... ) == 0x0
 02499  1688   NtSetEventBoostPriority  ... ) == 0x0
 02503  1256   NtContinue  (60882224, 1, ...
 02504   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\230\7\0\0" ...  ...
 02500  1648   NtTestAlert  ... ) == 0x0
 02505  1936   NtRegisterThreadTerminatePort  (24, ...
 02506  1584   NtTestAlert  (...
 02507   464   NtRegisterThreadTerminatePort  (24, ...
 02508   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15789008, ... }, 15789008, ...
 02509  1256   NtRegisterThreadTerminatePort  (24, ...
 02504   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81957, 0}  ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\230\7\0\0" )  ) == 0x0
 02510  1648   NtContinue  (64027952, 1, ...
 02506  1584   NtTestAlert  ... ) == 0x0
 02505  1936   NtRegisterThreadTerminatePort  ... ) == 0x0
 02507   464   NtRegisterThreadTerminatePort  ... ) == 0x0
 02508   792   NtQueryAttributesFile  ... ) == 0x0
 02509  1256   NtRegisterThreadTerminatePort  ... ) == 0x0
 02511  1688   NtTestAlert  (...
 02512  1648   NtRegisterThreadTerminatePort  (24, ...
 02513   896   NtResumeThread  (584, ...
 02514  1936   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02515   464   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02516   792   NtQuerySystemInformation  (Basic, 44, ...
 02517  1256   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02511  1688   NtTestAlert  ... ) == 0x0
 02518  1584   NtContinue  (66125104, 1, ...
 02513   896   NtResumeThread  ... 1, ) == 0x0
 02512  1648   NtRegisterThreadTerminatePort  ... ) == 0x0
 02514  1936   NtDuplicateObject  ... 588, ) == 0x0
 02519  1944   NtTestAlert  (...
 02516   792   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02515   464   NtDuplicateObject  ... 592, ) == 0x0
 02520  1688   NtContinue  (65076528, 1, ...
 02521  1584   NtRegisterThreadTerminatePort  (24, ...
 02522   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02523  1648   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02524  1936   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02519  1944   NtTestAlert  ... ) == 0x0
 02525   792   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ...
 02526   464   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02527  1688   NtRegisterThreadTerminatePort  (24, ...
 02521  1584   NtRegisterThreadTerminatePort  ... ) == 0x0
 02522   896   NtAllocateVirtualMemory  ... 67174400, 1048576, ) == 0x0
 02523  1648   NtDuplicateObject  ... 596, ) == 0x0
 02524  1936   NtWaitForSingleObject  ... ) == 0x102
 02528  1944   NtContinue  (67173680, 1, ...
 02525   792   NtAllocateVirtualMemory  ... 3538944, 65536, ) == 0x0
 02526   464   NtWaitForSingleObject  ... ) == 0x102
 02527  1688   NtRegisterThreadTerminatePort  ... ) == 0x0
 02529  1584   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02530   896   NtAllocateVirtualMemory  (-1, 68214784, 0, 8192, 4096, 4, ...
 02531  1648   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02532  1936   NtWaitForSingleObject  (160, 0, 0x0, ...
 02533  1944   NtRegisterThreadTerminatePort  (24, ...
 02517  1256   NtDuplicateObject  ... 600, ) == 0x0
 02534   464   NtWaitForSingleObject  (160, 0, 0x0, ...
 02535  1688   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02529  1584   NtDuplicateObject  ... 604, ) == 0x0
 02530   896   NtAllocateVirtualMemory  ... 68214784, 8192, ) == 0x0
 02531  1648   NtWaitForSingleObject  ... ) == 0x102
 02533  1944   NtRegisterThreadTerminatePort  ... ) == 0x0
 02536  1256   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02537   792   NtAllocateVirtualMemory  (-1, 3538944, 0, 4096, 4096, 4, ...
 02538  1584   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02535  1688   NtDuplicateObject  ... 608, ) == 0x0
 02539   896   NtProtectVirtualMemory  (-1, (0x410e000), 4096, 260, ...
 02540  1648   NtWaitForSingleObject  (160, 0, 0x0, ...
 02536  1256   NtWaitForSingleObject  ... ) == 0x102
 02537   792   NtAllocateVirtualMemory  ... 3538944, 4096, ) == 0x0
 02541  1944   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02542  1688   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02539   896   NtProtectVirtualMemory  ... (0x410e000), 4096, 4, ) == 0x0
 02543  1256   NtWaitForSingleObject  (160, 0, 0x0, ...
 02544   792   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ...
 02541  1944   NtDuplicateObject  ... 612, ) == 0x0
 02542  1688   NtWaitForSingleObject  ... ) == 0x102
 02545   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02544   792   NtAllocateVirtualMemory  ... 1404928, 4096, ) == 0x0
 02546  1944   NtWaitForSingleObject  (324, 0, 0x0, ...
 02547  1688   NtWaitForSingleObject  (324, 0, 0x0, ...
 02545   896   NtCreateThread  ... 616, {1252, 2032}, ) == 0x0
 02548   792   NtSetEventBoostPriority  (324, ...
 02549   896   NtQueryInformationThread  (616, Basic, 28, ...
 02546  1944   NtWaitForSingleObject  ... ) == 0x0
 02548   792   NtSetEventBoostPriority  ... ) == 0x0
 02550  1944   NtSetEventBoostPriority  (324, ...
 02549   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=2032,}, 0x0, ) == 0x0
 02538  1584   NtWaitForSingleObject  ... ) == 0x102
 02547  1688   NtWaitForSingleObject  ... ) == 0x0
 02550  1944   NtSetEventBoostPriority  ... ) == 0x0
 02551   792   NtAllocateVirtualMemory  (-1, 3543040, 0, 8192, 4096, 4, ...
 02552  1688   NtWaitForSingleObject  (160, 0, 0x0, ...
 02553  1584   NtWaitForSingleObject  (160, 0, 0x0, ...
 02554   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\360\7\0\0" ...  ...
 02551   792   NtAllocateVirtualMemory  ... 3543040, 8192, ) == 0x0
 02554   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81958, 0}  ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\360\7\0\0" )  ) == 0x0
 02555   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15789008, ... }, 15789008, ...
 02556   896   NtResumeThread  (616, ...
 02555   792   NtQueryAttributesFile  ... ) == 0x0
 02556   896   NtResumeThread  ... 1, ) == 0x0
 02557   792   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... }, 5, 96, ...
 02558   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02557   792   NtOpenFile  ... 620, {status=0x0, info=1}, ) == 0x0
 02559  1944   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02560  2032   NtWaitForSingleObject  (128, 0, 0x0, ...
 02558   896   NtAllocateVirtualMemory  ... 68222976, 1048576, ) == 0x0
 02559  1944   NtWaitForSingleObject  ... ) == 0x102
 02561   896   NtAllocateVirtualMemory  (-1, 69263360, 0, 8192, 4096, 4, ...
 02562  1944   NtWaitForSingleObject  (160, 0, 0x0, ...
 02561   896   NtAllocateVirtualMemory  ... 69263360, 8192, ) == 0x0
 02563   896   NtProtectVirtualMemory  (-1, (0x420e000), 4096, 260, ... (0x420e000), 4096, 4, ) == 0x0
 02564   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 1592}, ) == 0x0
 02565   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=1592,}, 0x0, ) == 0x0
 02566   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\6\0\0" )  ) == 0x0
 02567   792   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 620, ... 628, ) == 0x0
 02568   792   NtClose  (620, ... ) == 0x0
 02569   792   NtMapViewOfSection  (628, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 110592, ) == 0x0
 02570   792   NtClose  (628, ... ) == 0x0
 02571   792   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 02572   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15789316, ... ) }, 15789316, ... ) == 0x0
 02573   896   NtResumeThread  (624, ... 1, ) == 0x0
 02574   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 69271552, 1048576, ) == 0x0
 02575   896   NtAllocateVirtualMemory  (-1, 70311936, 0, 8192, 4096, 4, ... 70311936, 8192, ) == 0x0
 02576   896   NtProtectVirtualMemory  (-1, (0x430e000), 4096, 260, ... (0x430e000), 4096, 4, ) == 0x0
 02577   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 628, {1252, 476}, ) == 0x0
 02578   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=476,}, 0x0, ) == 0x0
 02579   792   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... }, 5, 96, ...
 02580  1592   NtWaitForSingleObject  (128, 0, 0x0, ...
 02579   792   NtOpenFile  ... 620, {status=0x0, info=1}, ) == 0x0
 02581   792   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 620, ... 632, ) == 0x0
 02582   792   NtQuerySection  (632, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02583   792   NtClose  (620, ... ) == 0x0
 02584   792   NtMapViewOfSection  (632, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x751d0000), 0x0, 122880, ) == 0x0
 02585   792   NtClose  (632, ... ) == 0x0
 02586   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\334\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\334\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\334\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\334\1\0\0" )  ) == 0x0
 02587   896   NtResumeThread  (628, ... 1, ) == 0x0
 02588   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 70320128, 1048576, ) == 0x0
 02589   896   NtAllocateVirtualMemory  (-1, 71360512, 0, 8192, 4096, 4, ... 71360512, 8192, ) == 0x0
 02590   792   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02591   792   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02592   792   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02593   476   NtWaitForSingleObject  (128, 0, 0x0, ...
 02594   896   NtProtectVirtualMemory  (-1, (0x440e000), 4096, 260, ... (0x440e000), 4096, 4, ) == 0x0
 02595   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 1744}, ) == 0x0
 02596   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1744,}, 0x0, ) == 0x0
 02597   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\320\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\320\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\320\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\320\6\0\0" )  ) == 0x0
 02598   896   NtResumeThread  (632, ... 1, ) == 0x0
 02599   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02600   792   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ...
 02601  1744   NtWaitForSingleObject  (128, 0, 0x0, ...
 02600   792   NtProtectVirtualMemory  ... (0x751d1000), 4096, 32, ) == 0x0
 02602   792   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02603   792   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02604   792   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02605   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 15788492, ... }, 15788492, ...
 02599   896   NtAllocateVirtualMemory  ... 71368704, 1048576, ) == 0x0
 02606   896   NtAllocateVirtualMemory  (-1, 72409088, 0, 8192, 4096, 4, ... 72409088, 8192, ) == 0x0
 02607   896   NtProtectVirtualMemory  (-1, (0x450e000), 4096, 260, ... (0x450e000), 4096, 4, ) == 0x0
 02608   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 1128}, ) == 0x0
 02609   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1128,}, 0x0, ) == 0x0
 02610   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0h\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0h\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0h\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0h\4\0\0" )  ) == 0x0
 02611   896   NtResumeThread  (620, ... 1, ) == 0x0
 02612   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 72417280, 1048576, ) == 0x0
 02613   896   NtAllocateVirtualMemory  (-1, 73457664, 0, 8192, 4096, 4, ... 73457664, 8192, ) == 0x0
 02614  1128   NtWaitForSingleObject  (128, 0, 0x0, ...
 02615   896   NtProtectVirtualMemory  (-1, (0x460e000), 4096, 260, ... (0x460e000), 4096, 4, ) == 0x0
 02616   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1252, 768}, ) == 0x0
 02617   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=768,}, 0x0, ) == 0x0
 02618   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\0\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\0\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\0\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\0\3\0\0" )  ) == 0x0
 02619   896   NtResumeThread  (636, ... 1, ) == 0x0
 02620   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02605   792   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02621   768   NtWaitForSingleObject  (128, 0, 0x0, ...
 02622   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 15788492, ... ) }, 15788492, ... ) == 0x0
 02623   792   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 640, {status=0x0, info=1}, ) }, 5, 96, ... 640, {status=0x0, info=1}, ) == 0x0
 02624   792   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 640, ... 644, ) == 0x0
 02625   792   NtQuerySection  (644, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02626   792   NtClose  (640, ... ) == 0x0
 02627   792   NtMapViewOfSection  (644, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02620   896   NtAllocateVirtualMemory  ... 73465856, 1048576, ) == 0x0
 02628   896   NtAllocateVirtualMemory  (-1, 74506240, 0, 8192, 4096, 4, ... 74506240, 8192, ) == 0x0
 02629   896   NtProtectVirtualMemory  (-1, (0x470e000), 4096, 260, ... (0x470e000), 4096, 4, ) == 0x0
 02630   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 1524}, ) == 0x0
 02631   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=1524,}, 0x0, ) == 0x0
 02632   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\364\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\364\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\364\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\364\5\0\0" )  ) == 0x0
 02627   792   NtMapViewOfSection  ... (0x77920000), 0x0, 995328, ) == 0x0
 02633   792   NtClose  (644, ... ) == 0x0
 02634   792   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02635   896   NtResumeThread  (640, ... 1, ) == 0x0
 02636   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74514432, 1048576, ) == 0x0
 02637   896   NtAllocateVirtualMemory  (-1, 75554816, 0, 8192, 4096, 4, ... 75554816, 8192, ) == 0x0
 02638  1524   NtWaitForSingleObject  (128, 0, 0x0, ...
 02639   792   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02640   792   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02641   792   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02642   792   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02643   792   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02644   792   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ...
 02645   896   NtProtectVirtualMemory  (-1, (0x480e000), 4096, 260, ... (0x480e000), 4096, 4, ) == 0x0
 02646   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 1864}, ) == 0x0
 02647   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=1864,}, 0x0, ) == 0x0
 02648   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0H\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0H\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0H\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0H\7\0\0" )  ) == 0x0
 02649   896   NtResumeThread  (644, ... 1, ) == 0x0
 02650   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02644   792   NtProtectVirtualMemory  ... (0x77921000), 4096, 32, ) == 0x0
 02651  1864   NtWaitForSingleObject  (128, 0, 0x0, ...
 02652   792   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02653   792   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02654   792   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02655   792   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02656   792   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02657   792   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ...
 02650   896   NtAllocateVirtualMemory  ... 75563008, 1048576, ) == 0x0
 02658   896   NtAllocateVirtualMemory  (-1, 76603392, 0, 8192, 4096, 4, ... 76603392, 8192, ) == 0x0
 02659   896   NtProtectVirtualMemory  (-1, (0x490e000), 4096, 260, ... (0x490e000), 4096, 4, ) == 0x0
 02660   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 648, {1252, 1020}, ) == 0x0
 02661   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1020,}, 0x0, ) == 0x0
 02662   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\374\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\374\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\374\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\374\3\0\0" )  ) == 0x0
 02657   792   NtProtectVirtualMemory  ... (0x77921000), 4096, 32, ) == 0x0
 02663   792   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02664   792   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02665   792   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02666   792   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02667   792   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02668   896   NtResumeThread  (648, ... 1, ) == 0x0
 02669   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 76611584, 1048576, ) == 0x0
 02670   896   NtAllocateVirtualMemory  (-1, 77651968, 0, 8192, 4096, 4, ... 77651968, 8192, ) == 0x0
 02671  1020   NtWaitForSingleObject  (128, 0, 0x0, ...
 02672   896   NtProtectVirtualMemory  (-1, (0x4a0e000), 4096, 260, ... (0x4a0e000), 4096, 4, ) == 0x0
 02673   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 1804}, ) == 0x0
 02674   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1804,}, 0x0, ) == 0x0
 02675   792   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02676   792   NtQueryDefaultUILanguage  (2090319928, ...
 02677   792   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02678   792   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481484, ) == 0x0
 02679   792   NtQueryInformationToken  (-2147481484, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02680   792   NtClose  (-2147481484, ... ) == 0x0
 02681   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\14\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\14\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\14\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\14\7\0\0" )  ) == 0x0
 02682   896   NtResumeThread  (652, ... 1, ) == 0x0
 02683   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 77660160, 1048576, ) == 0x0
 02684   896   NtAllocateVirtualMemory  (-1, 78700544, 0, 8192, 4096, 4, ... 78700544, 8192, ) == 0x0
 02685   896   NtProtectVirtualMemory  (-1, (0x4b0e000), 4096, 260, ... (0x4b0e000), 4096, 4, ) == 0x0
 02686   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02687   792   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... }, ...
 02688  1804   NtWaitForSingleObject  (128, 0, 0x0, ...
 02687   792   NtOpenKey  ... -2147481484, ) == 0x0
 02689   792   NtOpenKey  (0x80000000, {24, -2147481484, 0x240, 0, 0,  (0x80000000, {24, -2147481484, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02690   792   NtOpenKey  (0x80000000, {24, -2147481484, 0x640, 0, 0,  (0x80000000, {24, -2147481484, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482104, ) }, ... -2147482104, ) == 0x0
 02691   792   NtQueryValueKey  (-2147482104,  (-2147482104, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02692   792   NtClose  (-2147482104, ... ) == 0x0
 02693   792   NtClose  (-2147481484, ... ) == 0x0
 02686   896   NtCreateThread  ... 656, {1252, 1644}, ) == 0x0
 02694   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=1644,}, 0x0, ) == 0x0
 02695   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0l\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0l\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0l\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0l\6\0\0" )  ) == 0x0
 02696   896   NtResumeThread  (656, ... 1, ) == 0x0
 02697   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78708736, 1048576, ) == 0x0
 02698   896   NtAllocateVirtualMemory  (-1, 79749120, 0, 8192, 4096, 4, ... 79749120, 8192, ) == 0x0
 02676   792   NtQueryDefaultUILanguage  ... ) == 0x0
 02699  1644   NtWaitForSingleObject  (128, 0, 0x0, ...
 02700   792   NtAllocateVirtualMemory  (-1, 15777792, 0, 4096, 4096, 260, ... 15777792, 4096, ) == 0x0
 02701   792   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 02702   792   NtQueryDefaultLocale  (1, 15789212, ... ) == 0x0
 02703   792   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02704   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\Setup"}, ... 660, ) }, ... 660, ) == 0x0
 02705   792   NtQueryValueKey  (660,  (660, "SystemSetupInProgress", Partial, 144, ... , Partial, 144, ...
 02706   896   NtProtectVirtualMemory  (-1, (0x4c0e000), 4096, 260, ... (0x4c0e000), 4096, 4, ) == 0x0
 02707   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 776}, ) == 0x0
 02708   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=776,}, 0x0, ) == 0x0
 02709   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\10\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\10\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\10\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\10\3\0\0" )  ) == 0x0
 02710   896   NtResumeThread  (664, ... 1, ) == 0x0
 02711   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02705   792   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02712   776   NtWaitForSingleObject  (128, 0, 0x0, ...
 02713   792   NtClose  (660, ... ) == 0x0
 02714   792   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 660, ) == 0x0
 02715   792   NtCallbackReturn  (0, 0, 0, ...
 02716   792   NtUserGetProcessWindowStation  (... ) == 0x1c
 02717   792   NtUserGetObjectInformation  (28, 1, 15788808, 12, 15788820, ... ) == 0x1
 02718   792   NtOpenKey  (0xf003f, {24, 36, 0x40, 0, 0,  (0xf003f, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02711   896   NtAllocateVirtualMemory  ... 79757312, 1048576, ) == 0x0
 02719   896   NtAllocateVirtualMemory  (-1, 80797696, 0, 8192, 4096, 4, ... 80797696, 8192, ) == 0x0
 02720   896   NtProtectVirtualMemory  (-1, (0x4d0e000), 4096, 260, ... (0x4d0e000), 4096, 4, ) == 0x0
 02721   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1252, 1920}, ) == 0x0
 02722   896   NtQueryInformationThread  (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=1920,}, 0x0, ) == 0x0
 02723   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\200\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\200\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\200\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0\200\7\0\0" )  ) == 0x0
 02724   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\WPA\PnP"}, ... 672, ) }, ... 672, ) == 0x0
 02725   792   NtQueryValueKey  (672,  (672, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (672, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 02726   792   NtClose  (672, ... ) == 0x0
 02727   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\Setup"}, ... 672, ) }, ... 672, ) == 0x0
 02728   792   NtQueryValueKey  (672,  (672, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02729   792   NtQueryValueKey  (672,  (672, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02730   896   NtResumeThread  (668, ... 1, ) == 0x0
 02731   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 80805888, 1048576, ) == 0x0
 02732   896   NtAllocateVirtualMemory  (-1, 81846272, 0, 8192, 4096, 4, ... 81846272, 8192, ) == 0x0
 02733   896   NtProtectVirtualMemory  (-1, (0x4e0e000), 4096, 260, ... (0x4e0e000), 4096, 4, ) == 0x0
 02734   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1252, 1396}, ) == 0x0
 02735   896   NtQueryInformationThread  (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1396,}, 0x0, ) == 0x0
 02736   792   NtClose  (672, ...
 02737  1920   NtWaitForSingleObject  (128, 0, 0x0, ...
 02736   792   NtClose  ... ) == 0x0
 02738   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\Setup"}, ... 672, ) }, ... 672, ) == 0x0
 02739   792   NtQueryValueKey  (672,  (672, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02740   792   NtQueryValueKey  (672,  (672, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02741   792   NtClose  (672, ... ) == 0x0
 02742   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 672, ) }, ... 672, ) == 0x0
 02743   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0t\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0t\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0t\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0t\5\0\0" )  ) == 0x0
 02744   896   NtResumeThread  (676, ... 1, ) == 0x0
 02745   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 81854464, 1048576, ) == 0x0
 02746   896   NtAllocateVirtualMemory  (-1, 82894848, 0, 8192, 4096, 4, ... 82894848, 8192, ) == 0x0
 02747   896   NtProtectVirtualMemory  (-1, (0x4f0e000), 4096, 260, ... (0x4f0e000), 4096, 4, ) == 0x0
 02748   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02749   792   NtQueryValueKey  (672,  (672, "SourcePath", Partial, 144, ... , Partial, 144, ...
 02750  1396   NtWaitForSingleObject  (128, 0, 0x0, ...
 02749   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02751   792   NtQueryValueKey  (672,  (672, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02752   792   NtClose  (672, ... ) == 0x0
 02753   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 672, ) }, ... 672, ) == 0x0
 02754   792   NtQueryValueKey  (672,  (672, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02755   792   NtQueryValueKey  (672,  (672, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02748   896   NtCreateThread  ... 680, {1252, 1392}, ) == 0x0
 02756   896   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1392,}, 0x0, ) == 0x0
 02757   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0p\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0p\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0p\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0p\5\0\0" )  ) == 0x0
 02758   896   NtResumeThread  (680, ... 1, ) == 0x0
 02759   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 82903040, 1048576, ) == 0x0
 02760   896   NtAllocateVirtualMemory  (-1, 83943424, 0, 8192, 4096, 4, ... 83943424, 8192, ) == 0x0
 02761   792   NtClose  (672, ...
 02762  1392   NtWaitForSingleObject  (128, 0, 0x0, ...
 02761   792   NtClose  ... ) == 0x0
 02763   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 672, ) }, ... 672, ) == 0x0
 02764   792   NtQueryValueKey  (672,  (672, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02765   792   NtQueryValueKey  (672,  (672, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (672, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02766   792   NtClose  (672, ... ) == 0x0
 02767   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 672, ) }, ... 672, ) == 0x0
 02768   896   NtProtectVirtualMemory  (-1, (0x500e000), 4096, 260, ... (0x500e000), 4096, 4, ) == 0x0
 02769   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 684, {1252, 1852}, ) == 0x0
 02770   896   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1852,}, 0x0, ) == 0x0
 02771   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0<\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0<\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0<\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0<\7\0\0" )  ) == 0x0
 02772   896   NtResumeThread  (684, ... 1, ) == 0x0
 02773   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02774   792   NtQueryValueKey  (672,  (672, "DriverCachePath", Partial, 144, ... , Partial, 144, ...
 02775  1852   NtWaitForSingleObject  (128, 0, 0x0, ...
 02774   792   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02776   792   NtQueryValueKey  (672,  (672, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (672, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02777   792   NtClose  (672, ... ) == 0x0
 02778   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 672, ) }, ... 672, ) == 0x0
 02779   792   NtQueryValueKey  (672,  (672, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02780   792   NtQueryValueKey  (672,  (672, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (672, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 02773   896   NtAllocateVirtualMemory  ... 83951616, 1048576, ) == 0x0
 02781   896   NtAllocateVirtualMemory  (-1, 84992000, 0, 8192, 4096, 4, ... 84992000, 8192, ) == 0x0
 02782   896   NtProtectVirtualMemory  (-1, (0x510e000), 4096, 260, ... (0x510e000), 4096, 4, ) == 0x0
 02783   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 688, {1252, 800}, ) == 0x0
 02784   896   NtQueryInformationThread  (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=800,}, 0x0, ) == 0x0
 02785   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0 \3\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0 \3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0 \3\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0 \3\0\0" )  ) == 0x0
 02786   792   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0
 02787   792   NtClose  (672, ... ) == 0x0
 02788   792   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 672, ) == 0x0
 02789   792   NtCreateMutant  (0x1f0001, 0x0, 0, ... 692, ) == 0x0
 02790   792   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 696, ) == 0x0
 02791   792   NtCreateMutant  (0x1f0001, 0x0, 0, ... 700, ) == 0x0
 02792   896   NtResumeThread  (688, ... 1, ) == 0x0
 02793   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 85000192, 1048576, ) == 0x0
 02794   896   NtAllocateVirtualMemory  (-1, 86040576, 0, 8192, 4096, 4, ... 86040576, 8192, ) == 0x0
 02795   896   NtProtectVirtualMemory  (-1, (0x520e000), 4096, 260, ... (0x520e000), 4096, 4, ) == 0x0
 02796   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 1176}, ) == 0x0
 02797   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1176,}, 0x0, ) == 0x0
 02798   792   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02799   800   NtWaitForSingleObject  (128, 0, 0x0, ...
 02798   792   NtCreateEvent  ... 708, ) == 0x0
 02800   792   NtCreateMutant  (0x1f0001, 0x0, 0, ... 712, ) == 0x0
 02801   792   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 716, ) }, ... 716, ) == 0x0
 02802   792   NtQueryValueKey  (716,  (716, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (716, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02803   792   NtQueryValueKey  (716,  (716, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (716, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02804   792   NtQueryValueKey  (716,  (716, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02805   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\230\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\230\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\230\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\230\4\0\0" )  ) == 0x0
 02806   896   NtResumeThread  (704, ... 1, ) == 0x0
 02807   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 86048768, 1048576, ) == 0x0
 02808   896   NtAllocateVirtualMemory  (-1, 87089152, 0, 8192, 4096, 4, ... 87089152, 8192, ) == 0x0
 02809   896   NtProtectVirtualMemory  (-1, (0x530e000), 4096, 260, ... (0x530e000), 4096, 4, ) == 0x0
 02810   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02811   792   NtOpenKey  (0x1, {24, 716, 0x40, 0, 0,  (0x1, {24, 716, 0x40, 0, 0, "AppLogLevels"}, ... }, ...
 02812  1176   NtWaitForSingleObject  (128, 0, 0x0, ...
 02811   792   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02813   792   NtClose  (716, ... ) == 0x0
 02814   792   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 15788724, ... ) }, 15788724, ... ) == 0x0
 02815   792   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 716, ) }, ... 716, ) == 0x0
 02816   792   NtQueryValueKey  (716,  (716, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (716, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (716, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02817   792   NtClose  (716, ...
 02810   896   NtCreateThread  ... 720, {1252, 1700}, ) == 0x0
 02818   896   NtQueryInformationThread  (720, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1700,}, 0x0, ) == 0x0
 02819   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\244\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\244\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\244\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\2\0\0\344\4\0\0\244\6\0\0" )  ) == 0x0
 02820   896   NtResumeThread  (720, ... 1, ) == 0x0
 02821   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 87097344, 1048576, ) == 0x0
 02822   896   NtAllocateVirtualMemory  (-1, 88137728, 0, 8192, 4096, 4, ... 88137728, 8192, ) == 0x0
 02817   792   NtClose  ... ) == 0x0
 02823  1700   NtWaitForSingleObject  (128, 0, 0x0, ...
 02824   792   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 716, ) }, ... 716, ) == 0x0
 02825   792   NtQueryValueKey  (716,  (716, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (716, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (716, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 02826   792   NtClose  (716, ... ) == 0x0
 02827   792   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02828   792   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 716, ) }, ... 716, ) == 0x0
 02829   792   NtQueryValueKey  (716,  (716, "Domain", Full, 128, ... , Full, 128, ...
 02830   896   NtProtectVirtualMemory  (-1, (0x540e000), 4096, 260, ... (0x540e000), 4096, 4, ) == 0x0
 02831   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 724, {1252, 1028}, ) == 0x0
 02832   896   NtQueryInformationThread  (724, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 02833   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\4\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\4\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\2\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 02834   896   NtResumeThread  (724, ... 1, ) == 0x0
 02835   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02829   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 02836  1028   NtWaitForSingleObject  (128, 0, 0x0, ...
 02837   792   NtClose  (716, ... ) == 0x0
 02838   792   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02839   792   NtSetEventBoostPriority  (128, ...
 02560  2032   NtWaitForSingleObject  ... ) == 0x0
 02840  2032   NtSetEventBoostPriority  (128, ...
 02580  1592   NtWaitForSingleObject  ... ) == 0x0
 02841  1592   NtSetEventBoostPriority  (128, ...
 02593   476   NtWaitForSingleObject  ... ) == 0x0
 02842   476   NtSetEventBoostPriority  (128, ...
 02601  1744   NtWaitForSingleObject  ... ) == 0x0
 02843  1744   NtSetEventBoostPriority  (128, ...
 02614  1128   NtWaitForSingleObject  ... ) == 0x0
 02844  1128   NtSetEventBoostPriority  (128, ...
 02621   768   NtWaitForSingleObject  ... ) == 0x0
 02845   768   NtSetEventBoostPriority  (128, ...
 02638  1524   NtWaitForSingleObject  ... ) == 0x0
 02846  1524   NtSetEventBoostPriority  (128, ...
 02651  1864   NtWaitForSingleObject  ... ) == 0x0
 02847  1864   NtSetEventBoostPriority  (128, ...
 02671  1020   NtWaitForSingleObject  ... ) == 0x0
 02848  1020   NtSetEventBoostPriority  (128, ...
 02688  1804   NtWaitForSingleObject  ... ) == 0x0
 02849  1804   NtSetEventBoostPriority  (128, ...
 02699  1644   NtWaitForSingleObject  ... ) == 0x0
 02850  1644   NtSetEventBoostPriority  (128, ...
 02712   776   NtWaitForSingleObject  ... ) == 0x0
 02851   776   NtSetEventBoostPriority  (128, ...
 02737  1920   NtWaitForSingleObject  ... ) == 0x0
 02852  1920   NtSetEventBoostPriority  (128, ...
 02750  1396   NtWaitForSingleObject  ... ) == 0x0
 02853  1396   NtSetEventBoostPriority  (128, ...
 02762  1392   NtWaitForSingleObject  ... ) == 0x0
 02854  1392   NtSetEventBoostPriority  (128, ...
 02775  1852   NtWaitForSingleObject  ... ) == 0x0
 02855  1852   NtSetEventBoostPriority  (128, ...
 02799   800   NtWaitForSingleObject  ... ) == 0x0
 02856   800   NtSetEventBoostPriority  (128, ...
 02812  1176   NtWaitForSingleObject  ... ) == 0x0
 02857  1176   NtSetEventBoostPriority  (128, ...
 02823  1700   NtWaitForSingleObject  ... ) == 0x0
 02858  1700   NtSetEventBoostPriority  (128, ...
 02836  1028   NtWaitForSingleObject  ... ) == 0x0
 02859  1028   NtTestAlert  (... ) == 0x0
 02858  1700   NtSetEventBoostPriority  ... ) == 0x0
 02857  1176   NtSetEventBoostPriority  ... ) == 0x0
 02856   800   NtSetEventBoostPriority  ... ) == 0x0
 02855  1852   NtSetEventBoostPriority  ... ) == 0x0
 02854  1392   NtSetEventBoostPriority  ... ) == 0x0
 02853  1396   NtSetEventBoostPriority  ... ) == 0x0
 02852  1920   NtSetEventBoostPriority  ... ) == 0x0
 02851   776   NtSetEventBoostPriority  ... ) == 0x0
 02850  1644   NtSetEventBoostPriority  ... ) == 0x0
 02849  1804   NtSetEventBoostPriority  ... ) == 0x0
 02848  1020   NtSetEventBoostPriority  ... ) == 0x0
 02847  1864   NtSetEventBoostPriority  ... ) == 0x0
 02846  1524   NtSetEventBoostPriority  ... ) == 0x0
 02845   768   NtSetEventBoostPriority  ... ) == 0x0
 02844  1128   NtSetEventBoostPriority  ... ) == 0x0
 02843  1744   NtSetEventBoostPriority  ... ) == 0x0
 02842   476   NtSetEventBoostPriority  ... ) == 0x0
 02841  1592   NtSetEventBoostPriority  ... ) == 0x0
 02840  2032   NtSetEventBoostPriority  ... ) == 0x0
 02839   792   NtSetEventBoostPriority  ... ) == 0x0
 02835   896   NtAllocateVirtualMemory  ... 88145920, 1048576, ) == 0x0
 02860  1028   NtContinue  (88145200, 1, ...
 02861  1700   NtTestAlert  (...
 02862  1176   NtTestAlert  (...
 02863   800   NtTestAlert  (...
 02864  1852   NtTestAlert  (...
 02865  1392   NtTestAlert  (...
 02866  1396   NtTestAlert  (...
 02867  1920   NtTestAlert  (...
 02868   776   NtTestAlert  (...
 02869  1644   NtTestAlert  (...
 02870  1804   NtTestAlert  (...
 02871  1020   NtTestAlert  (...
 02872  1864   NtTestAlert  (...
 02873  1524   NtTestAlert  (...
 02874   768   NtTestAlert  (...
 02875  1128   NtTestAlert  (...
 02876  1744   NtTestAlert  (...
 02877   476   NtTestAlert  (...
 02878  1592   NtTestAlert  (...
 02879   792   NtSetEventBoostPriority  (160, ...
 02880   896   NtAllocateVirtualMemory  (-1, 89186304, 0, 8192, 4096, 4, ...
 02881  1028   NtRegisterThreadTerminatePort  (24, ...
 02861  1700   NtTestAlert  ... ) == 0x0
 02862  1176   NtTestAlert  ... ) == 0x0
 02863   800   NtTestAlert  ... ) == 0x0
 02864  1852   NtTestAlert  ... ) == 0x0
 02865  1392   NtTestAlert  ... ) == 0x0
 02866  1396   NtTestAlert  ... ) == 0x0
 02867  1920   NtTestAlert  ... ) == 0x0
 02868   776   NtTestAlert  ... ) == 0x0
 02869  1644   NtTestAlert  ... ) == 0x0
 02870  1804   NtTestAlert  ... ) == 0x0
 02871  1020   NtTestAlert  ... ) == 0x0
 02872  1864   NtTestAlert  ... ) == 0x0
 02873  1524   NtTestAlert  ... ) == 0x0
 02874   768   NtTestAlert  ... ) == 0x0
 02875  1128   NtTestAlert  ... ) == 0x0
 02876  1744   NtTestAlert  ... ) == 0x0
 02877   476   NtTestAlert  ... ) == 0x0
 02878  1592   NtTestAlert  ... ) == 0x0
 01365  1152   NtWaitForSingleObject  ... ) == 0x0
 02879   792   NtSetEventBoostPriority  ... ) == 0x0
 02880   896   NtAllocateVirtualMemory  ... 89186304, 8192, ) == 0x0
 02881  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 02882  1700   NtContinue  (87096624, 1, ...
 02883  1176   NtContinue  (86048048, 1, ...
 02884   800   NtContinue  (84999472, 1, ...
 02885  1852   NtContinue  (83950896, 1, ...
 02886  1392   NtContinue  (82902320, 1, ...
 02887  1396   NtContinue  (81853744, 1, ...
 02888  1920   NtContinue  (80805168, 1, ...
 02889   776   NtContinue  (79756592, 1, ...
 02890  1644   NtContinue  (78708016, 1, ...
 02891  1804   NtContinue  (77659440, 1, ...
 02892  1020   NtContinue  (76610864, 1, ...
 02893  1864   NtContinue  (75562288, 1, ...
 02894  1524   NtContinue  (74513712, 1, ...
 02895   768   NtContinue  (73465136, 1, ...
 02896  1128   NtContinue  (72416560, 1, ...
 02897  1744   NtContinue  (71367984, 1, ...
 02898   476   NtContinue  (70319408, 1, ...
 02899  1152   NtSetEventBoostPriority  (160, ...
 02900  1592   NtContinue  (69270832, 1, ...
 02901   792   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02902   896   NtProtectVirtualMemory  (-1, (0x550e000), 4096, 260, ...
 02903  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02904  1700   NtRegisterThreadTerminatePort  (24, ...
 02905  1176   NtRegisterThreadTerminatePort  (24, ...
 02906   800   NtRegisterThreadTerminatePort  (24, ...
 02907  1852   NtRegisterThreadTerminatePort  (24, ...
 02908  1392   NtRegisterThreadTerminatePort  (24, ...
 02909  1396   NtRegisterThreadTerminatePort  (24, ...
 02910  1920   NtRegisterThreadTerminatePort  (24, ...
 02911   776   NtRegisterThreadTerminatePort  (24, ...
 02912  1644   NtRegisterThreadTerminatePort  (24, ...
 02913  1804   NtRegisterThreadTerminatePort  (24, ...
 02914  1020   NtRegisterThreadTerminatePort  (24, ...
 02915  1864   NtRegisterThreadTerminatePort  (24, ...
 02916  1524   NtRegisterThreadTerminatePort  (24, ...
 02917   768   NtRegisterThreadTerminatePort  (24, ...
 02918  1128   NtRegisterThreadTerminatePort  (24, ...
 02919  1744   NtRegisterThreadTerminatePort  (24, ...
 01369  1636   NtWaitForSingleObject  ... ) == 0x0
 02899  1152   NtSetEventBoostPriority  ... ) == 0x0
 02920   476   NtRegisterThreadTerminatePort  (24, ...
 02921  1592   NtRegisterThreadTerminatePort  (24, ...
 02901   792   NtCreateEvent  ... 716, ) == 0x0
 02902   896   NtProtectVirtualMemory  ... (0x550e000), 4096, 4, ) == 0x0
 02903  1028   NtDuplicateObject  ... 728, ) == 0x0
 02904  1700   NtRegisterThreadTerminatePort  ... ) == 0x0
 02905  1176   NtRegisterThreadTerminatePort  ... ) == 0x0
 02906   800   NtRegisterThreadTerminatePort  ... ) == 0x0
 02907  1852   NtRegisterThreadTerminatePort  ... ) == 0x0
 02908  1392   NtRegisterThreadTerminatePort  ... ) == 0x0
 02909  1396   NtRegisterThreadTerminatePort  ... ) == 0x0
 02910  1920   NtRegisterThreadTerminatePort  ... ) == 0x0
 02911   776   NtRegisterThreadTerminatePort  ... ) == 0x0
 02912  1644   NtRegisterThreadTerminatePort  ... ) == 0x0
 02913  1804   NtRegisterThreadTerminatePort  ... ) == 0x0
 02914  1020   NtRegisterThreadTerminatePort  ... ) == 0x0
 02915  1864   NtRegisterThreadTerminatePort  ... ) == 0x0
 02916  1524   NtRegisterThreadTerminatePort  ... ) == 0x0
 02917   768   NtRegisterThreadTerminatePort  ... ) == 0x0
 02918  1128   NtRegisterThreadTerminatePort  ... ) == 0x0
 02922  1636   NtSetEventBoostPriority  (160, ...
 02919  1744   NtRegisterThreadTerminatePort  ... ) == 0x0
 02923  1152   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02920   476   NtRegisterThreadTerminatePort  ... ) == 0x0
 02921  1592   NtRegisterThreadTerminatePort  ... ) == 0x0
 02924   792   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789236, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789236, 188, ...
 02925   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02926  1028   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02927  1700   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02928  1176   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02929   800   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02930  1852   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02931  1392   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02932  1396   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02933  1920   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02934   776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02935  1644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02936  1804   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02937  1020   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02938  1864   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02939  1524   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02940   768   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01374  1328   NtWaitForSingleObject  ... ) == 0x0
 02922  1636   NtSetEventBoostPriority  ... ) == 0x0
 02941  1128   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02942  1744   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02943  2032   NtTestAlert  (...
 02944   476   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02945  1592   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02923  1152   NtCreateEvent  ... 732, ) == 0x0
 02924   792   NtConnectPort  ... 736, 0x0, 0x0, 0x0, 188, ) == 0x0
 02925   896   NtCreateThread  ... 740, {1252, 1180}, ) == 0x0
 02926  1028   NtWaitForSingleObject  ... ) == 0x102
 02927  1700   NtDuplicateObject  ... 744, ) == 0x0
 02928  1176   NtDuplicateObject  ... 748, ) == 0x0
 02929   800   NtDuplicateObject  ... 752, ) == 0x0
 02930  1852   NtDuplicateObject  ... 756, ) == 0x0
 02931  1392   NtDuplicateObject  ... 760, ) == 0x0
 02932  1396   NtDuplicateObject  ... 764, ) == 0x0
 02933  1920   NtDuplicateObject  ... 768, ) == 0x0
 02934   776   NtDuplicateObject  ... 772, ) == 0x0
 02935  1644   NtDuplicateObject  ... 776, ) == 0x0
 02936  1804   NtDuplicateObject  ... 780, ) == 0x0
 02937  1020   NtDuplicateObject  ... 784, ) == 0x0
 02938  1864   NtDuplicateObject  ... 788, ) == 0x0
 02939  1524   NtDuplicateObject  ... 792, ) == 0x0
 02946  1328   NtSetEventBoostPriority  (160, ...
 02940   768   NtDuplicateObject  ... 796, ) == 0x0
 02947  1636   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02941  1128   NtDuplicateObject  ... 800, ) == 0x0
 02943  2032   NtTestAlert  ... ) == 0x0
 02942  1744   NtDuplicateObject  ... 804, ) == 0x0
 02944   476   NtDuplicateObject  ... 808, ) == 0x0
 02948  1152   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 02949   792   NtRequestWaitReplyPort  (736, {200, 224, new_msg, 0, 1379672, 12, 2, 1310721}  (736, {200, 224, new_msg, 0, 1379672, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0r'9\245\277\301\375\322 }\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\370|\25\0\254e\271\221x\1\24\0\30}\25\0h\1\24\0\0\0\0\0\0\0\0\0\30}\25\0P\0\0\0 }\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\360\0\372\31\221|\310\362\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02950   896   NtQueryInformationThread  (740, Basic, 28, ...
 02951  1028   NtWaitForSingleObject  (160, 0, 0x0, ...
 02952  1700   NtWaitForSingleObject  (324, 0, 0x0, ...
 02953  1176   NtWaitForSingleObject  (324, 0, 0x0, ...
 02954   800   NtWaitForSingleObject  (324, 0, 0x0, ...
 02955  1852   NtWaitForSingleObject  (324, 0, 0x0, ...
 02956  1392   NtWaitForSingleObject  (324, 0, 0x0, ...
 02957  1396   NtWaitForSingleObject  (324, 0, 0x0, ...
 02958  1920   NtWaitForSingleObject  (324, 0, 0x0, ...
 02959   776   NtWaitForSingleObject  (324, 0, 0x0, ...
 02960  1644   NtWaitForSingleObject  (324, 0, 0x0, ...
 02961  1804   NtWaitForSingleObject  (324, 0, 0x0, ...
 02962  1020   NtWaitForSingleObject  (324, 0, 0x0, ...
 02963  1864   NtWaitForSingleObject  (324, 0, 0x0, ...
 01467  1516   NtWaitForSingleObject  ... ) == 0x0
 02946  1328   NtSetEventBoostPriority  ... ) == 0x0
 02964  1524   NtWaitForSingleObject  (324, 0, 0x0, ...
 02965   768   NtWaitForSingleObject  (324, 0, 0x0, ...
 02947  1636   NtCreateEvent  ... 812, ) == 0x0
 02966  1128   NtWaitForSingleObject  (324, 0, 0x0, ...
 02967  2032   NtContinue  (68222256, 1, ...
 02968  1744   NtWaitForSingleObject  (324, 0, 0x0, ...
 02969   476   NtWaitForSingleObject  (324, 0, 0x0, ...
 02948  1152   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 02950   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 02949   792   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 792, 81979, 0}  ... {200, 224, reply, 0, 1252, 792, 81979, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0r'9\245\277\301\375\322 }\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\370|\25\0\254e\271\221x\1\24\0\30}\25\0h\1\24\0\0\0\0\0\0\0\0\0\30}\25\0P\0\0\0 }\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\360\0\372\31\221|\310\362\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02970  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 02945  1592   NtDuplicateObject  ... 816, ) == 0x0
 02971  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 02972  2032   NtRegisterThreadTerminatePort  (24, ...
 02973  1152   NtSetEventBoostPriority  (324, ...
 02974   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\234\4\0\0" ...  ...
 02975   792   NtRequestWaitReplyPort  (736, {64, 88, new_msg, 0, 1252, 792, 81937, 0}  (736, {64, 88, new_msg, 0, 1252, 792, 81937, 0} "\1\356\0\0A\2\10\0@\14\250\201\0\320\372\177\220kt\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 02976  1592   NtWaitForSingleObject  (324, 0, 0x0, ...
 02972  2032   NtRegisterThreadTerminatePort  ... ) == 0x0
 02952  1700   NtWaitForSingleObject  ... ) == 0x0
 02973  1152   NtSetEventBoostPriority  ... ) == 0x0
 02974   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81980, 0}  ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\2\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 02977  1328   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02978  1700   NtSetEventBoostPriority  (324, ...
 02979  2032   NtWaitForSingleObject  (324, 0, 0x0, ...
 02980  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 02975   792   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 792, 81981, 0}  ... {52, 76, reply, 0, 1252, 792, 81981, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\2000/\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 02953  1176   NtWaitForSingleObject  ... ) == 0x0
 02978  1700   NtSetEventBoostPriority  ... ) == 0x0
 02977  1328   NtCreateEvent  ... 820, ) == 0x0
 02981   896   NtResumeThread  (740, ...
 02982  1176   NtSetEventBoostPriority  (324, ...
 02983   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 02984  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 02954   800   NtWaitForSingleObject  ... ) == 0x0
 02982  1176   NtSetEventBoostPriority  ... ) == 0x0
 02981   896   NtResumeThread  ... 1, ) == 0x0
 02985   800   NtSetEventBoostPriority  (324, ...
 02986  1700   NtWaitForSingleObject  (324, 0, 0x0, ...
 02987  1180   NtWaitForSingleObject  (324, 0, 0x0, ...
 02955  1852   NtWaitForSingleObject  ... ) == 0x0
 02985   800   NtSetEventBoostPriority  ... ) == 0x0
 02988   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02989  1852   NtSetEventBoostPriority  (324, ...
 02990  1176   NtWaitForSingleObject  (324, 0, 0x0, ...
 02956  1392   NtWaitForSingleObject  ... ) == 0x0
 02989  1852   NtSetEventBoostPriority  ... ) == 0x0
 02988   896   NtAllocateVirtualMemory  ... 89194496, 1048576, ) == 0x0
 02991  1392   NtSetEventBoostPriority  (324, ...
 02992   800   NtWaitForSingleObject  (324, 0, 0x0, ...
 02957  1396   NtWaitForSingleObject  ... ) == 0x0
 02991  1392   NtSetEventBoostPriority  ... ) == 0x0
 02993   896   NtAllocateVirtualMemory  (-1, 90234880, 0, 8192, 4096, 4, ...
 02994  1396   NtSetEventBoostPriority  (324, ...
 02995  1852   NtWaitForSingleObject  (324, 0, 0x0, ...
 02958  1920   NtWaitForSingleObject  ... ) == 0x0
 02994  1396   NtSetEventBoostPriority  ... ) == 0x0
 02993   896   NtAllocateVirtualMemory  ... 90234880, 8192, ) == 0x0
 02996  1920   NtSetEventBoostPriority  (324, ...
 02997  1392   NtWaitForSingleObject  (324, 0, 0x0, ...
 02998  1396   NtWaitForSingleObject  (324, 0, 0x0, ...
 02959   776   NtWaitForSingleObject  ... ) == 0x0
 02996  1920   NtSetEventBoostPriority  ... ) == 0x0
 02999   776   NtSetEventBoostPriority  (324, ...
 03000   896   NtProtectVirtualMemory  (-1, (0x560e000), 4096, 260, ...
 02960  1644   NtWaitForSingleObject  ... ) == 0x0
 02999   776   NtSetEventBoostPriority  ... ) == 0x0
 03001  1644   NtSetEventBoostPriority  (324, ...
 03000   896   NtProtectVirtualMemory  ... (0x560e000), 4096, 4, ) == 0x0
 03002  1920   NtWaitForSingleObject  (324, 0, 0x0, ...
 02961  1804   NtWaitForSingleObject  ... ) == 0x0
 03001  1644   NtSetEventBoostPriority  ... ) == 0x0
 03003   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03004  1804   NtSetEventBoostPriority  (324, ...
 03005   776   NtWaitForSingleObject  (324, 0, 0x0, ...
 02962  1020   NtWaitForSingleObject  ... ) == 0x0
 03004  1804   NtSetEventBoostPriority  ... ) == 0x0
 03003   896   NtCreateThread  ... 824, {1252, 1732}, ) == 0x0
 03006  1020   NtSetEventBoostPriority  (324, ...
 03007  1644   NtWaitForSingleObject  (324, 0, 0x0, ...
 02963  1864   NtWaitForSingleObject  ... ) == 0x0
 03006  1020   NtSetEventBoostPriority  ... ) == 0x0
 03008   896   NtQueryInformationThread  (824, Basic, 28, ...
 03009  1864   NtSetEventBoostPriority  (324, ...
 03010  1804   NtWaitForSingleObject  (324, 0, 0x0, ...
 02964  1524   NtWaitForSingleObject  ... ) == 0x0
 03009  1864   NtSetEventBoostPriority  ... ) == 0x0
 03008   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 03011  1524   NtSetEventBoostPriority  (324, ...
 03012  1020   NtWaitForSingleObject  (324, 0, 0x0, ...
 03013  1864   NtWaitForSingleObject  (324, 0, 0x0, ...
 02965   768   NtWaitForSingleObject  ... ) == 0x0
 03011  1524   NtSetEventBoostPriority  ... ) == 0x0
 03014   768   NtSetEventBoostPriority  (324, ...
 03015   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0\304\6\0\0" ...  ...
 02966  1128   NtWaitForSingleObject  ... ) == 0x0
 03014   768   NtSetEventBoostPriority  ... ) == 0x0
 03016  1128   NtSetEventBoostPriority  (324, ...
 03015   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81982, 0}  ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\3\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 03017  1524   NtWaitForSingleObject  (324, 0, 0x0, ...
 02968  1744   NtWaitForSingleObject  ... ) == 0x0
 03016  1128   NtSetEventBoostPriority  ... ) == 0x0
 03018   896   NtResumeThread  (824, ...
 03019  1744   NtSetEventBoostPriority  (324, ...
 03020   768   NtWaitForSingleObject  (324, 0, 0x0, ...
 02969   476   NtWaitForSingleObject  ... ) == 0x0
 03019  1744   NtSetEventBoostPriority  ... ) == 0x0
 03018   896   NtResumeThread  ... 1, ) == 0x0
 03021   476   NtSetEventBoostPriority  (324, ...
 03022  1128   NtWaitForSingleObject  (324, 0, 0x0, ...
 03023  1732   NtWaitForSingleObject  (128, 0, 0x0, ...
 02970  1516   NtWaitForSingleObject  ... ) == 0x0
 03021   476   NtSetEventBoostPriority  ... ) == 0x0
 03024   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03025  1516   NtSetEventBoostPriority  (324, ...
 03026  1744   NtWaitForSingleObject  (324, 0, 0x0, ...
 03027   476   NtWaitForSingleObject  (324, 0, 0x0, ...
 02971  1636   NtWaitForSingleObject  ... ) == 0x0
 03025  1516   NtSetEventBoostPriority  ... ) == 0x0
 03028  1636   NtSetEventBoostPriority  (324, ...
 03024   896   NtAllocateVirtualMemory  ... 90243072, 1048576, ) == 0x0
 02976  1592   NtWaitForSingleObject  ... ) == 0x0
 03028  1636   NtSetEventBoostPriority  ... ) == 0x0
 03029  1592   NtSetEventBoostPriority  (324, ...
 03030   896   NtAllocateVirtualMemory  (-1, 91283456, 0, 8192, 4096, 4, ...
 03031  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 02979  2032   NtWaitForSingleObject  ... ) == 0x0
 03029  1592   NtSetEventBoostPriority  ... ) == 0x0
 03030   896   NtAllocateVirtualMemory  ... 91283456, 8192, ) == 0x0
 03032  2032   NtSetEventBoostPriority  (324, ...
 03033  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 02980  1152   NtWaitForSingleObject  ... ) == 0x0
 03034   896   NtProtectVirtualMemory  (-1, (0x570e000), 4096, 260, ...
 03035  1152   NtSetEventBoostPriority  (324, ...
 03034   896   NtProtectVirtualMemory  ... (0x570e000), 4096, 4, ) == 0x0
 02983   792   NtWaitForSingleObject  ... ) == 0x0
 03036   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03037   792   NtSetEventBoostPriority  (324, ...
 03035  1152   NtSetEventBoostPriority  ... ) == 0x0
 03032  2032   NtSetEventBoostPriority  ... ) == 0x0
 03038  1592   NtWaitForSingleObject  (324, 0, 0x0, ...
 02984  1328   NtWaitForSingleObject  ... ) == 0x0
 03037   792   NtSetEventBoostPriority  ... ) == 0x0
 03039  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03040  2032   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03041  1328   NtSetEventBoostPriority  (324, ...
 03036   896   NtCreateThread  ... 828, {1252, 1388}, ) == 0x0
 02986  1700   NtWaitForSingleObject  ... ) == 0x0
 03041  1328   NtSetEventBoostPriority  ... ) == 0x0
 03040  2032   NtDuplicateObject  ... 832, ) == 0x0
 03042  1700   NtSetEventBoostPriority  (324, ...
 03043   896   NtQueryInformationThread  (828, Basic, 28, ...
 03044   792   NtClose  (716, ...
 03045  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 02987  1180   NtWaitForSingleObject  ... ) == 0x0
 03042  1700   NtSetEventBoostPriority  ... ) == 0x0
 03043   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 03044   792   NtClose  ... ) == 0x0
 03046  1180   NtSetEventBoostPriority  (324, ...
 03047  1700   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03048   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0l\5\0\0" ...  ...
 02990  1176   NtWaitForSingleObject  ... ) == 0x0
 03046  1180   NtSetEventBoostPriority  ... ) == 0x0
 03049   792   NtClose  (736, ...
 03050  2032   NtWaitForSingleObject  (324, 0, 0x0, ...
 03051  1176   NtSetEventBoostPriority  (324, ...
 03048   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81983, 0}  ... {28, 56, reply, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 03047  1700   NtWaitForSingleObject  ... ) == 0x102
 03049   792   NtClose  ... ) == 0x0
 02992   800   NtWaitForSingleObject  ... ) == 0x0
 03051  1176   NtSetEventBoostPriority  ... ) == 0x0
 03052  1180   NtSetEventBoostPriority  (128, ...
 03053  1700   NtWaitForSingleObject  (160, 0, 0x0, ...
 03054   800   NtSetEventBoostPriority  (324, ...
 03055   792   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 03056  1176   NtWaitForSingleObject  (324, 0, 0x0, ...
 03023  1732   NtWaitForSingleObject  ... ) == 0x0
 03052  1180   NtSetEventBoostPriority  ... ) == 0x0
 02995  1852   NtWaitForSingleObject  ... ) == 0x0
 03054   800   NtSetEventBoostPriority  ... ) == 0x0
 03055   792   NtCreateKey  ... 736, 2, ) == 0x0
 03057   896   NtResumeThread  (828, ...
 03058  1732   NtTestAlert  (...
 03059  1852   NtSetEventBoostPriority  (324, ...
 03060  1180   NtTestAlert  (...
 03061   800   NtWaitForSingleObject  (324, 0, 0x0, ...
 03058  1732   NtTestAlert  ... ) == 0x0
 02997  1392   NtWaitForSingleObject  ... ) == 0x0
 03059  1852   NtSetEventBoostPriority  ... ) == 0x0
 03057   896   NtResumeThread  ... 1, ) == 0x0
 03060  1180   NtTestAlert  ... ) == 0x0
 03062   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 03063  1388   NtTestAlert  (...
 03064  1392   NtSetEventBoostPriority  (324, ...
 03065  1852   NtWaitForSingleObject  (324, 0, 0x0, ...
 03066   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03067  1180   NtContinue  (89193776, 1, ...
 03062   792   NtOpenKey  ... 716, ) == 0x0
 02998  1396   NtWaitForSingleObject  ... ) == 0x0
 03064  1392   NtSetEventBoostPriority  ... ) == 0x0
 03063  1388   NtTestAlert  ... ) == 0x0
 03068  1732   NtContinue  (90242352, 1, ...
 03066   896   NtAllocateVirtualMemory  ... 91291648, 1048576, ) == 0x0
 03069  1180   NtRegisterThreadTerminatePort  (24, ...
 03070  1396   NtSetEventBoostPriority  (324, ...
 03071   792   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 03072  1392   NtWaitForSingleObject  (324, 0, 0x0, ...
 03073  1388   NtContinue  (91290928, 1, ...
 03074  1732   NtRegisterThreadTerminatePort  (24, ...
 03075   896   NtAllocateVirtualMemory  (-1, 92332032, 0, 8192, 4096, 4, ...
 03002  1920   NtWaitForSingleObject  ... ) == 0x0
 03070  1396   NtSetEventBoostPriority  ... ) == 0x0
 03071   792   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03069  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 03076  1388   NtRegisterThreadTerminatePort  (24, ...
 03074  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 03077  1920   NtSetEventBoostPriority  (324, ...
 03075   896   NtAllocateVirtualMemory  ... 92332032, 8192, ) == 0x0
 03078  1396   NtWaitForSingleObject  (324, 0, 0x0, ...
 03079   792   NtQueryValueKey  (736,  (736, "Hostname", Partial, 144, ... , Partial, 144, ...
 03080  1180   NtWaitForSingleObject  (324, 0, 0x0, ...
 03076  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 03005   776   NtWaitForSingleObject  ... ) == 0x0
 03077  1920   NtSetEventBoostPriority  ... ) == 0x0
 03081  1732   NtWaitForSingleObject  (324, 0, 0x0, ...
 03082   896   NtProtectVirtualMemory  (-1, (0x580e000), 4096, 260, ...
 03079   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 03083   776   NtSetEventBoostPriority  (324, ...
 03084  1920   NtWaitForSingleObject  (324, 0, 0x0, ...
 03082   896   NtProtectVirtualMemory  ... (0x580e000), 4096, 4, ) == 0x0
 03085  1388   NtWaitForSingleObject  (324, 0, 0x0, ...
 03007  1644   NtWaitForSingleObject  ... ) == 0x0
 03083   776   NtSetEventBoostPriority  ... ) == 0x0
 03086   792   NtQueryValueKey  (736,  (736, "Hostname", Partial, 144, ... , Partial, 144, ...
 03087   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03088  1644   NtSetEventBoostPriority  (324, ...
 03089   776   NtWaitForSingleObject  (324, 0, 0x0, ...
 03086   792   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 03010  1804   NtWaitForSingleObject  ... ) == 0x0
 03088  1644   NtSetEventBoostPriority  ... ) == 0x0
 03087   896   NtCreateThread  ... 836, {1252, 1600}, ) == 0x0
 03090  1804   NtSetEventBoostPriority  (324, ...
 03091   792   NtClose  (736, ...
 03092  1644   NtWaitForSingleObject  (324, 0, 0x0, ...
 03012  1020   NtWaitForSingleObject  ... ) == 0x0
 03090  1804   NtSetEventBoostPriority  ... ) == 0x0
 03093   896   NtQueryInformationThread  (836, Basic, 28, ...
 03091   792   NtClose  ... ) == 0x0
 03094  1020   NtSetEventBoostPriority  (324, ...
 03095  1804   NtWaitForSingleObject  (324, 0, 0x0, ...
 03093   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 03013  1864   NtWaitForSingleObject  ... ) == 0x0
 03094  1020   NtSetEventBoostPriority  ... ) == 0x0
 03096   792   NtClose  (716, ...
 03097  1864   NtSetEventBoostPriority  (324, ...
 03098  1020   NtWaitForSingleObject  (324, 0, 0x0, ...
 03017  1524   NtWaitForSingleObject  ... ) == 0x0
 03097  1864   NtSetEventBoostPriority  ... ) == 0x0
 03096   792   NtClose  ... ) == 0x0
 03099   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81983, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0@\6\0\0" ...  ...
 03100  1524   NtSetEventBoostPriority  (324, ...
 03101  1864   NtWaitForSingleObject  (324, 0, 0x0, ...
 03020   768   NtWaitForSingleObject  ... ) == 0x0
 03100  1524   NtSetEventBoostPriority  ... ) == 0x0
 03099   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81985, 0}  ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\3\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 03102   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 03103   768   NtSetEventBoostPriority  (324, ...
 03104  1524   NtWaitForSingleObject  (324, 0, 0x0, ...
 03105   896   NtResumeThread  (836, ...
 03022  1128   NtWaitForSingleObject  ... ) == 0x0
 03103   768   NtSetEventBoostPriority  ... ) == 0x0
 03106  1128   NtSetEventBoostPriority  (324, ...
 03105   896   NtResumeThread  ... 1, ) == 0x0
 03026  1744   NtWaitForSingleObject  ... ) == 0x0
 03106  1128   NtSetEventBoostPriority  ... ) == 0x0
 03107   768   NtWaitForSingleObject  (324, 0, 0x0, ...
 03108  1744   NtSetEventBoostPriority  (324, ...
 03109   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03110  1128   NtWaitForSingleObject  (324, 0, 0x0, ...
 03111  1600   NtTestAlert  (...
 03027   476   NtWaitForSingleObject  ... ) == 0x0
 03108  1744   NtSetEventBoostPriority  ... ) == 0x0
 03109   896   NtAllocateVirtualMemory  ... 92340224, 1048576, ) == 0x0
 03112   476   NtSetEventBoostPriority  (324, ...
 03111  1600   NtTestAlert  ... ) == 0x0
 03113  1744   NtWaitForSingleObject  (324, 0, 0x0, ...
 03031  1516   NtWaitForSingleObject  ... ) == 0x0
 03112   476   NtSetEventBoostPriority  ... ) == 0x0
 03114   896   NtAllocateVirtualMemory  (-1, 93380608, 0, 8192, 4096, 4, ...
 03115  1600   NtContinue  (92339504, 1, ...
 03116  1516   NtSetEventBoostPriority  (324, ...
 03117   476   NtWaitForSingleObject  (324, 0, 0x0, ...
 03114   896   NtAllocateVirtualMemory  ... 93380608, 8192, ) == 0x0
 03033  1636   NtWaitForSingleObject  ... ) == 0x0
 03116  1516   NtSetEventBoostPriority  ... ) == 0x0
 03118  1600   NtRegisterThreadTerminatePort  (24, ...
 03119  1636   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 03120   896   NtProtectVirtualMemory  (-1, (0x590e000), 4096, 260, ...
 03121  1516   NtSetEventBoostPriority  (160, ...
 03119  1636   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 03118  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 03120   896   NtProtectVirtualMemory  ... (0x590e000), 4096, 4, ) == 0x0
 03122  1636   NtSetEventBoostPriority  (324, ...
 01473  1104   NtWaitForSingleObject  ... ) == 0x0
 03121  1516   NtSetEventBoostPriority  ... ) == 0x0
 03123   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03124  1600   NtWaitForSingleObject  (324, 0, 0x0, ...
 03125  1104   NtWaitForSingleObject  (324, 0, 0x0, ...
 03126  1516   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03038  1592   NtWaitForSingleObject  ... ) == 0x0
 03122  1636   NtSetEventBoostPriority  ... ) == 0x0
 03126  1516   NtCreateEvent  ... 716, ) == 0x0
 03127  1592   NtSetEventBoostPriority  (324, ...
 03128  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03129  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 03039  1152   NtWaitForSingleObject  ... ) == 0x0
 03127  1592   NtSetEventBoostPriority  ... ) == 0x0
 03130  1152   NtSetEventBoostPriority  (324, ...
 03045  1328   NtWaitForSingleObject  ... ) == 0x0
 03131  1328   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 03132  1328   NtSetEventBoostPriority  (324, ...
 03130  1152   NtSetEventBoostPriority  ... ) == 0x0
 03133  1592   NtWaitForSingleObject  (324, 0, 0x0, ...
 03123   896   NtCreateThread  ... 736, {1252, 1948}, ) == 0x0
 03050  2032   NtWaitForSingleObject  ... ) == 0x0
 03132  1328   NtSetEventBoostPriority  ... ) == 0x0
 03134  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03135   896   NtQueryInformationThread  (736, Basic, 28, ...
 03136  2032   NtSetEventBoostPriority  (324, ...
 03137  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 03135   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 03056  1176   NtWaitForSingleObject  ... ) == 0x0
 03136  2032   NtSetEventBoostPriority  ... ) == 0x0
 03138  1176   NtSetEventBoostPriority  (324, ...
 03139   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\234\7\0\0" ...  ...
 03061   800   NtWaitForSingleObject  ... ) == 0x0
 03140  2032   NtWaitForSingleObject  (324, 0, 0x0, ...
 03139   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81986, 0}  ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\2\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 03141   800   NtSetEventBoostPriority  (324, ...
 03138  1176   NtSetEventBoostPriority  ... ) == 0x0
 03065  1852   NtWaitForSingleObject  ... ) == 0x0
 03142  1176   NtWaitForSingleObject  (348, 0, 0x0, ...
 03143  1852   NtSetEventBoostPriority  (324, ...
 03072  1392   NtWaitForSingleObject  ... ) == 0x0
 03144  1392   NtSetEventBoostPriority  (324, ...
 03080  1180   NtWaitForSingleObject  ... ) == 0x0
 03145  1180   NtSetEventBoostPriority  (324, ...
 03078  1396   NtWaitForSingleObject  ... ) == 0x0
 03146  1396   NtSetEventBoostPriority  (324, ...
 03081  1732   NtWaitForSingleObject  ... ) == 0x0
 03147  1732   NtSetEventBoostPriority  (324, ...
 03085  1388   NtWaitForSingleObject  ... ) == 0x0
 03148  1388   NtSetEventBoostPriority  (324, ...
 03084  1920   NtWaitForSingleObject  ... ) == 0x0
 03149  1920   NtSetEventBoostPriority  (324, ...
 03089   776   NtWaitForSingleObject  ... ) == 0x0
 03150   776   NtSetEventBoostPriority  (324, ...
 03092  1644   NtWaitForSingleObject  ... ) == 0x0
 03151  1644   NtSetEventBoostPriority  (324, ...
 03095  1804   NtWaitForSingleObject  ... ) == 0x0
 03152  1804   NtSetEventBoostPriority  (324, ...
 03098  1020   NtWaitForSingleObject  ... ) == 0x0
 03153  1020   NtSetEventBoostPriority  (324, ...
 03102   792   NtWaitForSingleObject  ... ) == 0x0
 03154   792   NtSetEventBoostPriority  (324, ...
 03101  1864   NtWaitForSingleObject  ... ) == 0x0
 03155  1864   NtSetEventBoostPriority  (324, ...
 03104  1524   NtWaitForSingleObject  ... ) == 0x0
 03156  1524   NtSetEventBoostPriority  (324, ...
 03107   768   NtWaitForSingleObject  ... ) == 0x0
 03157   768   NtSetEventBoostPriority  (324, ...
 03110  1128   NtWaitForSingleObject  ... ) == 0x0
 03158  1128   NtSetEventBoostPriority  (324, ...
 03113  1744   NtWaitForSingleObject  ... ) == 0x0
 03159  1744   NtSetEventBoostPriority  (324, ...
 03117   476   NtWaitForSingleObject  ... ) == 0x0
 03160   476   NtSetEventBoostPriority  (324, ...
 03124  1600   NtWaitForSingleObject  ... ) == 0x0
 03161  1600   NtSetEventBoostPriority  (324, ...
 03125  1104   NtWaitForSingleObject  ... ) == 0x0
 03162  1104   NtSetEventBoostPriority  (324, ...
 03128  1636   NtWaitForSingleObject  ... ) == 0x0
 03163  1636   NtSetEventBoostPriority  (324, ...
 03129  1516   NtWaitForSingleObject  ... ) == 0x0
 03164  1516   NtSetEventBoostPriority  (324, ...
 03134  1152   NtWaitForSingleObject  ... ) == 0x0
 03165  1152   NtSetEventBoostPriority  (324, ...
 03137  1328   NtWaitForSingleObject  ... ) == 0x0
 03166  1328   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ... 1425408, 4096, ) == 0x0
 03165  1152   NtSetEventBoostPriority  ... ) == 0x0
 03164  1516   NtSetEventBoostPriority  ... ) == 0x0
 03163  1636   NtSetEventBoostPriority  ... ) == 0x0
 03162  1104   NtSetEventBoostPriority  ... ) == 0x0
 03161  1600   NtSetEventBoostPriority  ... ) == 0x0
 03154   792   NtSetEventBoostPriority  ... ) == 0x0
 03148  1388   NtSetEventBoostPriority  ... ) == 0x0
 03147  1732   NtSetEventBoostPriority  ... ) == 0x0
 03145  1180   NtSetEventBoostPriority  ... ) == 0x0
 03160   476   NtSetEventBoostPriority  ... ) == 0x0
 03159  1744   NtSetEventBoostPriority  ... ) == 0x0
 03158  1128   NtSetEventBoostPriority  ... ) == 0x0
 03157   768   NtSetEventBoostPriority  ... ) == 0x0
 03156  1524   NtSetEventBoostPriority  ... ) == 0x0
 03155  1864   NtSetEventBoostPriority  ... ) == 0x0
 03153  1020   NtSetEventBoostPriority  ... ) == 0x0
 03152  1804   NtSetEventBoostPriority  ... ) == 0x0
 03151  1644   NtSetEventBoostPriority  ... ) == 0x0
 03150   776   NtSetEventBoostPriority  ... ) == 0x0
 03149  1920   NtSetEventBoostPriority  ... ) == 0x0
 03146  1396   NtSetEventBoostPriority  ... ) == 0x0
 03144  1392   NtSetEventBoostPriority  ... ) == 0x0
 03143  1852   NtSetEventBoostPriority  ... ) == 0x0
 03141   800   NtSetEventBoostPriority  ... ) == 0x0
 03167   896   NtResumeThread  (736, ...
 03168  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03169  1328   NtSetEventBoostPriority  (324, ...
 03170  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 03171  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03172  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03173   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 03174  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03175  1104   NtWaitForSingleObject  (324, 0, 0x0, ...
 03176  1732   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03177   476   NtWaitForSingleObject  (324, 0, 0x0, ...
 03178  1744   NtWaitForSingleObject  (324, 0, 0x0, ...
 03179  1128   NtWaitForSingleObject  (324, 0, 0x0, ...
 03180   768   NtWaitForSingleObject  (324, 0, 0x0, ...
 03181  1524   NtWaitForSingleObject  (324, 0, 0x0, ...
 03182  1864   NtWaitForSingleObject  (324, 0, 0x0, ...
 03183  1020   NtWaitForSingleObject  (324, 0, 0x0, ...
 03184  1804   NtWaitForSingleObject  (324, 0, 0x0, ...
 03185  1644   NtWaitForSingleObject  (324, 0, 0x0, ...
 03186   776   NtWaitForSingleObject  (324, 0, 0x0, ...
 03187  1920   NtWaitForSingleObject  (324, 0, 0x0, ...
 03188  1396   NtWaitForSingleObject  (324, 0, 0x0, ...
 03189  1392   NtWaitForSingleObject  (348, 0, 0x0, ...
 03190  1852   NtWaitForSingleObject  (348, 0, 0x0, ...
 03191   800   NtWaitForSingleObject  (348, 0, 0x0, ...
 03167   896   NtResumeThread  ... 1, ) == 0x0
 03192  1180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03133  1592   NtWaitForSingleObject  ... ) == 0x0
 03169  1328   NtSetEventBoostPriority  ... ) == 0x0
 03193  1948   NtAllocateVirtualMemory  (-1, 3633152, 0, 4096, 4096, 4, ...
 03172  1600   NtDuplicateObject  ... 840, ) == 0x0
 03176  1732   NtDuplicateObject  ... 844, ) == 0x0
 03194   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03195  1592   NtSetEventBoostPriority  (324, ...
 03192  1180   NtDuplicateObject  ... 848, ) == 0x0
 03196  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 03193  1948   NtAllocateVirtualMemory  ... 3633152, 4096, ) == 0x0
 03197  1600   NtWaitForSingleObject  (324, 0, 0x0, ...
 03198  1732   NtWaitForSingleObject  (324, 0, 0x0, ...
 03140  2032   NtWaitForSingleObject  ... ) == 0x0
 03194   896   NtAllocateVirtualMemory  ... 93388800, 1048576, ) == 0x0
 03199  1180   NtWaitForSingleObject  (324, 0, 0x0, ...
 03200  1948   NtWaitForSingleObject  (324, 0, 0x0, ...
 03201  2032   NtSetEventBoostPriority  (324, ...
 03202   896   NtAllocateVirtualMemory  (-1, 94429184, 0, 8192, 4096, 4, ...
 03170  1516   NtWaitForSingleObject  ... ) == 0x0
 03202   896   NtAllocateVirtualMemory  ... 94429184, 8192, ) == 0x0
 03203  1516   NtSetEventBoostPriority  (324, ...
 03201  2032   NtSetEventBoostPriority  ... ) == 0x0
 03195  1592   NtSetEventBoostPriority  ... ) == 0x0
 03174  1388   NtDuplicateObject  ... 852, ) == 0x0
 03171  1636   NtWaitForSingleObject  ... ) == 0x0
 03203  1516   NtSetEventBoostPriority  ... ) == 0x0
 03204  2032   NtSetEventBoostPriority  (348, ...
 03205  1592   NtWaitForSingleObject  (324, 0, 0x0, ...
 03206  1636   NtSetEventBoostPriority  (324, ...
 03207  1388   NtWaitForSingleObject  (324, 0, 0x0, ...
 03208  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 03142  1176   NtWaitForSingleObject  ... ) == 0x0
 03204  2032   NtSetEventBoostPriority  ... ) == 0x0
 03168  1152   NtWaitForSingleObject  ... ) == 0x0
 03206  1636   NtSetEventBoostPriority  ... ) == 0x0
 03209   896   NtProtectVirtualMemory  (-1, (0x5a0e000), 4096, 260, ...
 03210  1176   NtWaitForSingleObject  (324, 0, 0x0, ...
 03211  1152   NtSetEventBoostPriority  (324, ...
 03212  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03173   792   NtWaitForSingleObject  ... ) == 0x0
 03209   896   NtProtectVirtualMemory  ... (0x5a0e000), 4096, 4, ) == 0x0
 03211  1152   NtSetEventBoostPriority  ... ) == 0x0
 03213  2032   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03214   792   NtSetEventBoostPriority  (324, ...
 03215   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03216  1152   NtAllocateVirtualMemory  (-1, 14733312, 0, 4096, 4096, 260, ...
 03213  2032   NtWaitForSingleObject  ... ) == 0x102
 03175  1104   NtWaitForSingleObject  ... ) == 0x0
 03215   896   NtCreateThread  ... 856, {1252, 252}, ) == 0x0
 03216  1152   NtAllocateVirtualMemory  ... 14733312, 4096, ) == 0x0
 03217  2032   NtWaitForSingleObject  (324, 0, 0x0, ...
 03218  1104   NtSetEventBoostPriority  (324, ...
 03219   896   NtQueryInformationThread  (856, Basic, 28, ...
 03214   792   NtSetEventBoostPriority  ... ) == 0x0
 03177   476   NtWaitForSingleObject  ... ) == 0x0
 03218  1104   NtSetEventBoostPriority  ... ) == 0x0
 03219   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 03220   476   NtSetEventBoostPriority  (324, ...
 03221   792   NtWaitForSingleObject  (348, 0, 0x0, ...
 03222  1104   NtWaitForSingleObject  (324, 0, 0x0, ...
 03223  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03178  1744   NtWaitForSingleObject  ... ) == 0x0
 03220   476   NtSetEventBoostPriority  ... ) == 0x0
 03224   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0\344\4\0\0\374\0\0\0" ...  ...
 03225  1744   NtSetEventBoostPriority  (324, ...
 03179  1128   NtWaitForSingleObject  ... ) == 0x0
 03226  1128   NtSetEventBoostPriority  (324, ...
 03180   768   NtWaitForSingleObject  ... ) == 0x0
 03227   768   NtSetEventBoostPriority  (324, ...
 03181  1524   NtWaitForSingleObject  ... ) == 0x0
 03228  1524   NtSetEventBoostPriority  (324, ...
 03182  1864   NtWaitForSingleObject  ... ) == 0x0
 03229  1864   NtSetEventBoostPriority  (324, ...
 03183  1020   NtWaitForSingleObject  ... ) == 0x0
 03230  1020   NtSetEventBoostPriority  (324, ...
 03184  1804   NtWaitForSingleObject  ... ) == 0x0
 03231  1804   NtSetEventBoostPriority  (324, ...
 03185  1644   NtWaitForSingleObject  ... ) == 0x0
 03232  1644   NtSetEventBoostPriority  (324, ...
 03186   776   NtWaitForSingleObject  ... ) == 0x0
 03233   776   NtSetEventBoostPriority  (324, ...
 03187  1920   NtWaitForSingleObject  ... ) == 0x0
 03234  1920   NtSetEventBoostPriority  (324, ...
 03188  1396   NtWaitForSingleObject  ... ) == 0x0
 03235  1396   NtSetEventBoostPriority  (324, ...
 03196  1328   NtWaitForSingleObject  ... ) == 0x0
 03236  1328   NtSetEventBoostPriority  (324, ...
 03197  1600   NtWaitForSingleObject  ... ) == 0x0
 03237  1600   NtSetEventBoostPriority  (324, ...
 03198  1732   NtWaitForSingleObject  ... ) == 0x0
 03238  1732   NtSetEventBoostPriority  (324, ...
 03199  1180   NtWaitForSingleObject  ... ) == 0x0
 03239  1180   NtSetEventBoostPriority  (324, ...
 03200  1948   NtWaitForSingleObject  ... ) == 0x0
 03240  1948   NtSetEventBoostPriority  (324, ...
 03205  1592   NtWaitForSingleObject  ... ) == 0x0
 03241  1592   NtSetEventBoostPriority  (324, ...
 03207  1388   NtWaitForSingleObject  ... ) == 0x0
 03242  1388   NtSetEventBoostPriority  (324, ...
 03208  1516   NtWaitForSingleObject  ... ) == 0x0
 03243  1516   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ... 1429504, 4096, ) == 0x0
 03244  1516   NtSetEventBoostPriority  (324, ...
 03242  1388   NtSetEventBoostPriority  ... ) == 0x0
 03241  1592   NtSetEventBoostPriority  ... ) == 0x0
 03240  1948   NtSetEventBoostPriority  ... ) == 0x0
 03239  1180   NtSetEventBoostPriority  ... ) == 0x0
 03238  1732   NtSetEventBoostPriority  ... ) == 0x0
 03237  1600   NtSetEventBoostPriority  ... ) == 0x0
 03236  1328   NtSetEventBoostPriority  ... ) == 0x0
 03235  1396   NtSetEventBoostPriority  ... ) == 0x0
 03234  1920   NtSetEventBoostPriority  ... ) == 0x0
 03233   776   NtSetEventBoostPriority  ... ) == 0x0
 03232  1644   NtSetEventBoostPriority  ... ) == 0x0
 03231  1804   NtSetEventBoostPriority  ... ) == 0x0
 03230  1020   NtSetEventBoostPriority  ... ) == 0x0
 03229  1864   NtSetEventBoostPriority  ... ) == 0x0
 03228  1524   NtSetEventBoostPriority  ... ) == 0x0
 03227   768   NtSetEventBoostPriority  ... ) == 0x0
 03226  1128   NtSetEventBoostPriority  ... ) == 0x0
 03225  1744   NtSetEventBoostPriority  ... ) == 0x0
 03224   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81987, 0}  ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 03244  1516   NtSetEventBoostPriority  ... ) == 0x0
 03245   476   NtWaitForSingleObject  (348, 0, 0x0, ...
 03210  1176   NtWaitForSingleObject  ... ) == 0x0
 03246  1388   NtWaitForSingleObject  (324, 0, 0x0, ...
 03247  1592   NtWaitForSingleObject  (348, 0, 0x0, ...
 03248  1948   NtTestAlert  (...
 03249  1180   NtWaitForSingleObject  (348, 0, 0x0, ...
 03250  1732   NtWaitForSingleObject  (348, 0, 0x0, ...
 03251  1600   NtWaitForSingleObject  (348, 0, 0x0, ...
 03252  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 03253  1396   NtWaitForSingleObject  (348, 0, 0x0, ...
 03254  1920   NtWaitForSingleObject  (348, 0, 0x0, ...
 03255   776   NtWaitForSingleObject  (348, 0, 0x0, ...
 03256  1644   NtWaitForSingleObject  (348, 0, 0x0, ...
 03257  1804   NtWaitForSingleObject  (348, 0, 0x0, ...
 03258  1020   NtWaitForSingleObject  (348, 0, 0x0, ...
 03259  1864   NtWaitForSingleObject  (348, 0, 0x0, ...
 03260  1524   NtWaitForSingleObject  (348, 0, 0x0, ...
 03261   768   NtWaitForSingleObject  (348, 0, 0x0, ...
 03262  1128   NtWaitForSingleObject  (348, 0, 0x0, ...
 03263   896   NtResumeThread  (856, ...
 03264  1744   NtWaitForSingleObject  (348, 0, 0x0, ...
 03265  1176   NtSetEventBoostPriority  (324, ...
 03248  1948   NtTestAlert  ... ) == 0x0
 03263   896   NtResumeThread  ... 1, ) == 0x0
 03212  1636   NtWaitForSingleObject  ... ) == 0x0
 03265  1176   NtSetEventBoostPriority  ... ) == 0x0
 03266  1948   NtContinue  (93388080, 1, ...
 03267  1636   NtSetEventBoostPriority  (324, ...
 03268   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03269  1176   NtSetEventBoostPriority  (348, ...
 03217  2032   NtWaitForSingleObject  ... ) == 0x0
 03270  1948   NtRegisterThreadTerminatePort  (24, ...
 03267  1636   NtSetEventBoostPriority  ... ) == 0x0
 03271  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 03272   252   NtWaitForSingleObject  (324, 0, 0x0, ...
 03189  1392   NtWaitForSingleObject  ... ) == 0x0
 03269  1176   NtSetEventBoostPriority  ... ) == 0x0
 03273  2032   NtSetEventBoostPriority  (324, ...
 03270  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 03274  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03275  1392   NtWaitForSingleObject  (324, 0, 0x0, ...
 03276  1176   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03223  1152   NtWaitForSingleObject  ... ) == 0x0
 03273  2032   NtSetEventBoostPriority  ... ) == 0x0
 03277  1948   NtWaitForSingleObject  (324, 0, 0x0, ...
 03268   896   NtAllocateVirtualMemory  ... 94437376, 1048576, ) == 0x0
 03278  1152   NtSetEventBoostPriority  (324, ...
 03276  1176   NtWaitForSingleObject  ... ) == 0x102
 03279  2032   NtWaitForSingleObject  (160, 0, 0x0, ...
 03222  1104   NtWaitForSingleObject  ... ) == 0x0
 03278  1152   NtSetEventBoostPriority  ... ) == 0x0
 03280   896   NtAllocateVirtualMemory  (-1, 95477760, 0, 8192, 4096, 4, ...
 03281  1176   NtWaitForSingleObject  (160, 0, 0x0, ...
 03282  1104   NtSetEventBoostPriority  (324, ...
 03283  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03280   896   NtAllocateVirtualMemory  ... 95477760, 8192, ) == 0x0
 03246  1388   NtWaitForSingleObject  ... ) == 0x0
 03282  1104   NtSetEventBoostPriority  ... ) == 0x0
 03284   896   NtProtectVirtualMemory  (-1, (0x5b0e000), 4096, 260, ...
 03285  1388   NtSetEventBoostPriority  (324, ...
 03286  1104   NtSetEventBoostPriority  (160, ...
 03284   896   NtProtectVirtualMemory  ... (0x5b0e000), 4096, 4, ) == 0x0
 03252  1328   NtWaitForSingleObject  ... ) == 0x0
 03285  1388   NtSetEventBoostPriority  ... ) == 0x0
 01474   876   NtWaitForSingleObject  ... ) == 0x0
 03286  1104   NtSetEventBoostPriority  ... ) == 0x0
 03287  1328   NtSetEventBoostPriority  (324, ...
 03288   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03289   876   NtWaitForSingleObject  (324, 0, 0x0, ...
 03290  1388   NtWaitForSingleObject  (348, 0, 0x0, ...
 03271  1516   NtWaitForSingleObject  ... ) == 0x0
 03287  1328   NtSetEventBoostPriority  ... ) == 0x0
 03291  1104   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03288   896   NtCreateThread  ... 860, {1252, 1300}, ) == 0x0
 03292  1516   NtSetEventBoostPriority  (324, ...
 03293  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 03291  1104   NtCreateEvent  ... 864, ) == 0x0
 03272   252   NtWaitForSingleObject  ... ) == 0x0
 03292  1516   NtSetEventBoostPriority  ... ) == 0x0
 03294   896   NtQueryInformationThread  (860, Basic, 28, ...
 03295   252   NtSetEventBoostPriority  (324, ...
 03296  1104   NtWaitForSingleObject  (324, 0, 0x0, ...
 03297  1516   NtWaitForSingleObject  (324, 0, 0x0, ...
 03275  1392   NtWaitForSingleObject  ... ) == 0x0
 03295   252   NtSetEventBoostPriority  ... ) == 0x0
 03294   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 03298  1392   NtSetEventBoostPriority  (324, ...
 03274  1636   NtWaitForSingleObject  ... ) == 0x0
 03299  1636   NtSetEventBoostPriority  (324, ...
 03277  1948   NtWaitForSingleObject  ... ) == 0x0
 03300  1948   NtSetEventBoostPriority  (324, ...
 03283  1152   NtWaitForSingleObject  ... ) == 0x0
 03301  1152   NtSetEventBoostPriority  (324, ...
 03289   876   NtWaitForSingleObject  ... ) == 0x0
 03302   876   NtSetEventBoostPriority  (324, ...
 03296  1104   NtWaitForSingleObject  ... ) == 0x0
 03303  1104   NtSetEventBoostPriority  (324, ...
 03293  1328   NtWaitForSingleObject  ... ) == 0x0
 03304  1328   NtSetEventBoostPriority  (324, ...
 03297  1516   NtWaitForSingleObject  ... ) == 0x0
 03305  1516   NtAllocateVirtualMemory  (-1, 21024768, 0, 4096, 4096, 260, ... 21024768, 4096, ) == 0x0
 03306  1516   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 868, ) == 0x0
 03303  1104   NtSetEventBoostPriority  ... ) == 0x0
 03302   876   NtSetEventBoostPriority  ... ) == 0x0
 03299  1636   NtSetEventBoostPriority  ... ) == 0x0
 03298  1392   NtSetEventBoostPriority  ... ) == 0x0
 03307   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\3\0\0\344\4\0\0\24\5\0\0" ...  ...
 03304  1328   NtSetEventBoostPriority  ... ) == 0x0
 03301  1152   NtSetEventBoostPriority  ... ) == 0x0
 03300  1948   NtSetEventBoostPriority  ... ) == 0x0
 03308   252   NtTestAlert  (...
 03309  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03310  1104   NtAllocateVirtualMemory  (-1, 19976192, 0, 4096, 4096, 260, ...
 03311   876   NtSetEventBoostPriority  (160, ...
 03312  1636   NtAllocateVirtualMemory  (-1, 13684736, 0, 4096, 4096, 260, ...
 03307   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81988, 0}  ... {28, 56, reply, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\3\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 03313  1328   NtAllocateVirtualMemory  (-1, 12636160, 0, 4096, 4096, 260, ...
 03314  1152   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03315  1948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03308   252   NtTestAlert  ... ) == 0x0
 03309  1516   NtDuplicateObject  ... 872, ) == 0x0
 03310  1104   NtAllocateVirtualMemory  ... 19976192, 4096, ) == 0x0
 01481  1120   NtWaitForSingleObject  ... ) == 0x0
 03311   876   NtSetEventBoostPriority  ... ) == 0x0
 03312  1636   NtAllocateVirtualMemory  ... 13684736, 4096, ) == 0x0
 03316  1392   NtSetEventBoostPriority  (348, ...
 03313  1328   NtAllocateVirtualMemory  ... 12636160, 4096, ) == 0x0
 03314  1152   NtCreateEvent  ... 876, ) == 0x0
 03315  1948   NtDuplicateObject  ... 880, ) == 0x0
 03317   252   NtContinue  (94436656, 1, ...
 03318  1516   NtWaitForSingleObject  (348, 0, 0x0, ...
 03319  1120   NtSetEventBoostPriority  (160, ...
 03320  1104   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03321   876   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03322  1636   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03190  1852   NtWaitForSingleObject  ... ) == 0x0
 03316  1392   NtSetEventBoostPriority  ... ) == 0x0
 03323   896   NtResumeThread  (860, ...
 03324  1328   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03325  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03326   252   NtRegisterThreadTerminatePort  (24, ...
 01485  1484   NtWaitForSingleObject  ... ) == 0x0
 03319  1120   NtSetEventBoostPriority  ... ) == 0x0
 03320  1104   NtCreateEvent  ... 884, ) == 0x0
 03321   876   NtCreateEvent  ... 888, ) == 0x0
 03327  1852   NtSetEventBoostPriority  (348, ...
 03322  1636   NtCreateEvent  ... 892, ) == 0x0
 03328  1392   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03323   896   NtResumeThread  ... 1, ) == 0x0
 03324  1328   NtCreateEvent  ... 896, ) == 0x0
 03325  1152   NtDuplicateObject  ... 900, ) == 0x0
 03329  1484   NtSetEventBoostPriority  (160, ...
 03326   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 03330  1948   NtWaitForSingleObject  (348, 0, 0x0, ...
 03331  1300   NtTestAlert  (...
 03332  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03191   800   NtWaitForSingleObject  ... ) == 0x0
 03327  1852   NtSetEventBoostPriority  ... ) == 0x0
 03333   876   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ...
 03334  1636   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03328  1392   NtWaitForSingleObject  ... ) == 0x102
 03335   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03336  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01725  1564   NtWaitForSingleObject  ... ) == 0x0
 03329  1484   NtSetEventBoostPriority  ... ) == 0x0
 03337  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03338   252   NtWaitForSingleObject  (324, 0, 0x0, ...
 03331  1300   NtTestAlert  ... ) == 0x0
 03339   800   NtWaitForSingleObject  (324, 0, 0x0, ...
 03332  1104   NtDuplicateObject  ... 904, ) == 0x0
 03340  1120   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03333   876   NtAllocateVirtualMemory  ... 1433600, 4096, ) == 0x0
 03334  1636   NtDuplicateObject  ... 908, ) == 0x0
 03341  1392   NtWaitForSingleObject  (160, 0, 0x0, ...
 03335   896   NtAllocateVirtualMemory  ... 95485952, 1048576, ) == 0x0
 03342  1564   NtWaitForSingleObject  (324, 0, 0x0, ...
 03336  1328   NtDuplicateObject  ... 912, ) == 0x0
 03343  1852   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03344  1484   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03345  1300   NtContinue  (95485232, 1, ...
 03340  1120   NtCreateEvent  ... 916, ) == 0x0
 03346  1104   NtWaitForSingleObject  (324, 0, 0x0, ...
 03347   876   NtSetEventBoostPriority  (324, ...
 03348  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03349   896   NtAllocateVirtualMemory  (-1, 96526336, 0, 8192, 4096, 4, ...
 03350  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 03343  1852   NtWaitForSingleObject  ... ) == 0x102
 03344  1484   NtCreateEvent  ... 920, ) == 0x0
 03351  1300   NtRegisterThreadTerminatePort  (24, ...
 03352  1120   NtWaitForSingleObject  (324, 0, 0x0, ...
 03337  1152   NtWaitForSingleObject  ... ) == 0x0
 03347   876   NtSetEventBoostPriority  ... ) == 0x0
 03349   896   NtAllocateVirtualMemory  ... 96526336, 8192, ) == 0x0
 03353  1852   NtWaitForSingleObject  (160, 0, 0x0, ...
 03354  1484   NtWaitForSingleObject  (324, 0, 0x0, ...
 03351  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 03355  1152   NtSetEventBoostPriority  (324, ...
 03356   876   NtWaitForSingleObject  (324, 0, 0x0, ...
 03357   896   NtProtectVirtualMemory  (-1, (0x5c0e000), 4096, 260, ...
 03339   800   NtWaitForSingleObject  ... ) == 0x0
 03355  1152   NtSetEventBoostPriority  ... ) == 0x0
 03358   800   NtSetEventBoostPriority  (324, ...
 03357   896   NtProtectVirtualMemory  ... (0x5c0e000), 4096, 4, ) == 0x0
 03359  1300   NtWaitForSingleObject  (324, 0, 0x0, ...
 03338   252   NtWaitForSingleObject  ... ) == 0x0
 03358   800   NtSetEventBoostPriority  ... ) == 0x0
 03360   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03361   252   NtSetEventBoostPriority  (324, ...
 03362  1152   NtWaitForSingleObject  (324, 0, 0x0, ...
 03342  1564   NtWaitForSingleObject  ... ) == 0x0
 03360   896   NtCreateThread  ... 924, {1252, 248}, ) == 0x0
 03363  1564   NtSetEventBoostPriority  (324, ...
 03346  1104   NtWaitForSingleObject  ... ) == 0x0
 03364  1104   NtSetEventBoostPriority  (324, ...
 03348  1636   NtWaitForSingleObject  ... ) == 0x0
 03365  1636   NtSetEventBoostPriority  (324, ...
 03350  1328   NtWaitForSingleObject  ... ) == 0x0
 03366  1328   NtSetEventBoostPriority  (324, ...
 03352  1120   NtWaitForSingleObject  ... ) == 0x0
 03367  1120   NtSetEventBoostPriority  (324, ...
 03354  1484   NtWaitForSingleObject  ... ) == 0x0
 03368  1484   NtSetEventBoostPriority  (324, ...
 03356   876   NtWaitForSingleObject  ... ) == 0x0
 03369   876   NtSetEventBoostPriority  (324, ...
 03359  1300   NtWaitForSingleObject  ... ) == 0x0
 03370  1300   NtSetEventBoostPriority  (324, ...
 03362  1152   NtWaitForSingleObject  ... ) == 0x0
 03371  1152   NtWaitForSingleObject  (348, 0, 0x0, ...
 03370  1300   NtSetEventBoostPriority  ... ) == 0x0
 03372  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03369   876   NtSetEventBoostPriority  ... ) == 0x0
 03368  1484   NtSetEventBoostPriority  ... ) == 0x0
 03367  1120   NtSetEventBoostPriority  ... ) == 0x0
 03366  1328   NtSetEventBoostPriority  ... ) == 0x0
 03365  1636   NtSetEventBoostPriority  ... ) == 0x0
 03364  1104   NtSetEventBoostPriority  ... ) == 0x0
 03363  1564   NtSetEventBoostPriority  ... ) == 0x0
 03373   896   NtQueryInformationThread  (924, Basic, 28, ...
 03361   252   NtSetEventBoostPriority  ... ) == 0x0
 03374   800   NtSetEventBoostPriority  (348, ...
 03372  1300   NtDuplicateObject  ... 928, ) == 0x0
 03375   876   NtAllocateVirtualMemory  (-1, 18927616, 0, 4096, 4096, 260, ...
 03376  1484   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ...
 03377  1120   NtWaitForSingleObject  (324, 0, 0x0, ...
 03378  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03379  1104   NtWaitForSingleObject  (324, 0, 0x0, ...
 03380  1328   NtWaitForSingleObject  (324, 0, 0x0, ...
 03373   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 03381   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03221   792   NtWaitForSingleObject  ... ) == 0x0
 03374   800   NtSetEventBoostPriority  ... ) == 0x0
 03382  1300   NtWaitForSingleObject  (324, 0, 0x0, ...
 03375   876   NtAllocateVirtualMemory  ... 18927616, 4096, ) == 0x0
 03376  1484   NtAllocateVirtualMemory  ... 1437696, 4096, ) == 0x0
 03383  1564   NtWaitForSingleObject  (324, 0, 0x0, ...
 03384   792   NtWaitForSingleObject  (324, 0, 0x0, ...
 03381   252   NtDuplicateObject  ... 932, ) == 0x0
 03385   800   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03386   876   NtWaitForSingleObject  (324, 0, 0x0, ...
 03387  1484   NtSetEventBoostPriority  (324, ...
 03388   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81988, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\370\0\0\0" ...  ...
 03385   800   NtWaitForSingleObject  ... ) == 0x102
 03377  1120   NtWaitForSingleObject  ... ) == 0x0
 03387  1484   NtSetEventBoostPriority  ... ) == 0x0
 03388   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81989, 0}  ... {28, 56, reply, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 03389  1120   NtSetEventBoostPriority  (324, ...
 03390   800   NtWaitForSingleObject  (160, 0, 0x0, ...
 03391  1484   NtWaitForSingleObject  (324, 0, 0x0, ...
 03378  1636   NtWaitForSingleObject  ... ) == 0x0
 03389  1120   NtSetEventBoostPriority  ... ) == 0x0
 03392   896   NtResumeThread  (924, ...
 03393   252   NtWaitForSingleObject  (324, 0, 0x0, ...
 03394  1636   NtSetEventBoostPriority  (324, ...
 03395  1120   NtWaitForSingleObject  (324, 0, 0x0, ...
 03392   896   NtResumeThread  ... 1, ) == 0x0
 03380  1328   NtWaitForSingleObject  ... ) == 0x0
 03394  1636   NtSetEventBoostPriority  ... ) == 0x0
 03396   248   NtWaitForSingleObject  (324, 0, 0x0, ...
 03397   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03398  1328   NtSetEventBoostPriority  (324, ...
 03399  1636   NtWaitForSingleObject  (324, 0, 0x0, ...
 03379  1104   NtWaitForSingleObject  ... ) == 0x0
 03398  1328   NtSetEventBoostPriority  ... ) == 0x0
 03400  1104   NtSetEventBoostPriority  (324, ...
 03382  1300   NtWaitForSingleObject  ... ) == 0x0
 03401  1300   NtSetEventBoostPriority  (324, ...
 03384   792   NtWaitForSingleObject  ... ) == 0x0
 03402   792   NtSetEventBoostPriority  (324, ...
 03383  1564   NtWaitForSingleObject  ... ) == 0x0
 03403  1564   NtSetEventBoostPriority  (324, ...
 03386   876   NtWaitForSingleObject  ... ) == 0x0
 03404   876   NtSetEventBoostPriority  (324, ...
 03391  1484   NtWaitForSingleObject  ... ) == 0x0
 03405  1484   NtSetEventBoostPriority  (324, ...
 03393   252   NtWaitForSingleObject  ... ) == 0x0
 03406   252   NtSetEventBoostPriority  (324, ...
 03396   248   NtWaitForSingleObject  ... ) == 0x0
 03407   248   NtSetEventBoostPriority  (324, ...
 03395  1120   NtWaitForSingleObject  ... ) == 0x0
 03408  1120   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ... 1441792, 4096, ) == 0x0
 03409  1120   NtSetEventBoostPriority  (324, ...
 03399  1636   NtWaitForSingleObject  ... ) == 0x0
 03410  1636   NtWaitForSingleObject  (348, 0, 0x0, ...
 03407   248   NtSetEventBoostPriority  ... ) == 0x0
 03406   252   NtSetEventBoostPriority  ... ) == 0x0
 03405  1484   NtSetEventBoostPriority  ... ) == 0x0
 03404   876   NtSetEventBoostPriority  ... ) == 0x0
 03403  1564   NtSetEventBoostPriority  ... ) == 0x0
 03402   792   NtSetEventBoostPriority  ... ) == 0x0
 03401  1300   NtSetEventBoostPriority  ... ) == 0x0
 03411  1328   NtWaitForSingleObject  (348, 0, 0x0, ...
 03409  1120   NtSetEventBoostPriority  ... ) == 0x0
 03400  1104   NtSetEventBoostPriority  ... ) == 0x0
 03397   896   NtAllocateVirtualMemory  ... 96534528, 1048576, ) == 0x0
 03412   252   NtWaitForSingleObject  (348, 0, 0x0, ...
 03413   248   NtTestAlert  (...
 03414  1484   NtAllocateVirtualMemory  (-1, 16830464, 0, 4096, 4096, 260, ...
 03415  1564   NtSetEventBoostPriority  (160, ...
 03416   876   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03417   792   NtSetEventBoostPriority  (348, ...
 03418  1300   NtWaitForSingleObject  (348, 0, 0x0, ...
 03419  1104   NtWaitForSingleObject  (348, 0, 0x0, ...
 03420   896   NtAllocateVirtualMemory  (-1, 97574912, 0, 8192, 4096, 4, ...
 03421  1120   NtAllocateVirtualMemory  (-1, 17879040, 0, 4096, 4096, 260, ...
 03413   248   NtTestAlert  ... ) == 0x0
 03414  1484   NtAllocateVirtualMemory  ... 16830464, 4096, ) == 0x0
 03416   876   NtCreateEvent  ... 936, ) == 0x0
 03245   476   NtWaitForSingleObject  ... ) == 0x0
 03417   792   NtSetEventBoostPriority  ... ) == 0x0
 03420   896   NtAllocateVirtualMemory  ... 97574912, 8192, ) == 0x0
 03421  1120   NtAllocateVirtualMemory  ... 17879040, 4096, ) == 0x0
 03422   248   NtContinue  (96533808, 1, ...
 03423  1484   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03424   476   NtSetEventBoostPriority  (348, ...
 03425   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03426   792   NtWaitForSingleObject  (348, 0, 0x0, ...
 03427   896   NtProtectVirtualMemory  (-1, (0x5d0e000), 4096, 260, ...
 03428  1120   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03429   248   NtRegisterThreadTerminatePort  (24, ...
 03247  1592   NtWaitForSingleObject  ... ) == 0x0
 03424   476   NtSetEventBoostPriority  ... ) == 0x0
 03423  1484   NtCreateEvent  ... 940, ) == 0x0
 03425   876   NtDuplicateObject  ... 944, ) == 0x0
 03427   896   NtProtectVirtualMemory  ... (0x5d0e000), 4096, 4, ) == 0x0
 03428  1120   NtCreateEvent  ... 948, ) == 0x0
 03430  1592   NtSetEventBoostPriority  (348, ...
 03429   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 03431   476   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03432  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03433   876   NtWaitForSingleObject  (348, 0, 0x0, ...
 03434   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03249  1180   NtWaitForSingleObject  ... ) == 0x0
 03430  1592   NtSetEventBoostPriority  ... ) == 0x0
 03435  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03436   248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01794  1380   NtWaitForSingleObject  ... ) == 0x0
 03415  1564   NtSetEventBoostPriority  ... ) == 0x0
 03432  1484   NtDuplicateObject  ... 952, ) == 0x0
 03431   476   NtWaitForSingleObject  ... ) == 0x102
 03437  1180   NtSetEventBoostPriority  (348, ...
 03438  1592   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03435  1120   NtDuplicateObject  ... 956, ) == 0x0
 03434   896   NtCreateThread  ... 960, {1252, 1296}, ) == 0x0
 03439  1380   NtSetEventBoostPriority  (160, ...
 03440  1564   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03436   248   NtDuplicateObject  ... 964, ) == 0x0
 03250  1732   NtWaitForSingleObject  ... ) == 0x0
 03437  1180   NtSetEventBoostPriority  ... ) == 0x0
 03441   476   NtWaitForSingleObject  (160, 0, 0x0, ...
 03442  1484   NtWaitForSingleObject  (348, 0, 0x0, ...
 03438  1592   NtWaitForSingleObject  ... ) == 0x102
 03443   896   NtQueryInformationThread  (960, Basic, 28, ...
 01795  1512   NtWaitForSingleObject  ... ) == 0x0
 03439  1380   NtSetEventBoostPriority  ... ) == 0x0
 03440  1564   NtCreateEvent  ... 968, ) == 0x0
 03444  1732   NtSetEventBoostPriority  (348, ...
 03445   248   NtWaitForSingleObject  (348, 0, 0x0, ...
 03446  1180   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03447  1592   NtWaitForSingleObject  (160, 0, 0x0, ...
 03448  1512   NtSetEventBoostPriority  (160, ...
 03443   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 03449  1380   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03251  1600   NtWaitForSingleObject  ... ) == 0x0
 03444  1732   NtSetEventBoostPriority  ... ) == 0x0
 03450  1564   NtAllocateVirtualMemory  (-1, 1445888, 0, 4096, 4096, 4, ...
 03451  1120   NtWaitForSingleObject  (324, 0, 0x0, ...
 01799   752   NtWaitForSingleObject  ... ) == 0x0
 03448  1512   NtSetEventBoostPriority  ... ) == 0x0
 03452   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81989, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\20\5\0\0" ...  ...
 03446  1180   NtWaitForSingleObject  ... ) == 0x102
 03453  1600   NtWaitForSingleObject  (324, 0, 0x0, ...
 03454  1732   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03450  1564   NtAllocateVirtualMemory  ... 1445888, 4096, ) == 0x0
 03455   752   NtWaitForSingleObject  (324, 0, 0x0, ...
 03456  1512   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03452   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81990, 0}  ... {28, 56, reply, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 03457  1180   NtWaitForSingleObject  (324, 0, 0x0, ...
 03449  1380   NtCreateEvent  ... 972, ) == 0x0
 03458  1564   NtSetEventBoostPriority  (324, ...
 03454  1732   NtWaitForSingleObject  ... ) == 0x102
 03456  1512   NtCreateEvent  ... 976, ) == 0x0
 03459  1380   NtWaitForSingleObject  (324, 0, 0x0, ...
 03460   896   NtResumeThread  (960, ...
 03461  1732   NtWaitForSingleObject  (324, 0, 0x0, ...
 03462  1512   NtWaitForSingleObject  (324, 0, 0x0, ...
 03460   896   NtResumeThread  ... 1, ) == 0x0
 03463   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 97583104, 1048576, ) == 0x0
 03464   896   NtAllocateVirtualMemory  (-1, 98623488, 0, 8192, 4096, 4, ... 98623488, 8192, ) == 0x0
 03465   896   NtProtectVirtualMemory  (-1, (0x5e0e000), 4096, 260, ... (0x5e0e000), 4096, 4, ) == 0x0
 03466   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 980, {1252, 440}, ) == 0x0
 03467   896   NtQueryInformationThread  (980, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 03451  1120   NtWaitForSingleObject  ... ) == 0x0
 03458  1564   NtSetEventBoostPriority  ... ) == 0x0
 03468  1296   NtWaitForSingleObject  (324, 0, 0x0, ...
 03469  1120   NtSetEventBoostPriority  (324, ...
 03470  1564   NtWaitForSingleObject  (324, 0, 0x0, ...
 03453  1600   NtWaitForSingleObject  ... ) == 0x0
 03469  1120   NtSetEventBoostPriority  ... ) == 0x0
 03471  1600   NtSetEventBoostPriority  (324, ...
 03455   752   NtWaitForSingleObject  ... ) == 0x0
 03472   752   NtSetEventBoostPriority  (324, ...
 03457  1180   NtWaitForSingleObject  ... ) == 0x0
 03473  1180   NtSetEventBoostPriority  (324, ...
 03459  1380   NtWaitForSingleObject  ... ) == 0x0
 03474  1380   NtSetEventBoostPriority  (324, ...
 03461  1732   NtWaitForSingleObject  ... ) == 0x0
 03475  1732   NtSetEventBoostPriority  (324, ...
 03462  1512   NtWaitForSingleObject  ... ) == 0x0
 03476  1512   NtSetEventBoostPriority  (324, ...
 03468  1296   NtWaitForSingleObject  ... ) == 0x0
 03477  1296   NtSetEventBoostPriority  (324, ...
 03470  1564   NtWaitForSingleObject  ... ) == 0x0
 03478  1564   NtAllocateVirtualMemory  (-1, 33607680, 0, 4096, 4096, 260, ... 33607680, 4096, ) == 0x0
 03477  1296   NtSetEventBoostPriority  ... ) == 0x0
 03476  1512   NtSetEventBoostPriority  ... ) == 0x0
 03475  1732   NtSetEventBoostPriority  ... ) == 0x0
 03474  1380   NtSetEventBoostPriority  ... ) == 0x0
 03473  1180   NtSetEventBoostPriority  ... ) == 0x0
 03472   752   NtSetEventBoostPriority  ... ) == 0x0
 03471  1600   NtSetEventBoostPriority  ... ) == 0x0
 03479  1120   NtWaitForSingleObject  (348, 0, 0x0, ...
 03480   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81990, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\3\0\0\344\4\0\0\270\1\0\0" ...  ...
 03481  1564   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03482  1296   NtTestAlert  (...
 03483  1512   NtAllocateVirtualMemory  (-1, 1449984, 0, 4096, 4096, 4, ...
 03484  1732   NtWaitForSingleObject  (160, 0, 0x0, ...
 03485  1380   NtWaitForSingleObject  (324, 0, 0x0, ...
 03486  1180   NtWaitForSingleObject  (160, 0, 0x0, ...
 03487   752   NtWaitForSingleObject  (324, 0, 0x0, ...
 03488  1600   NtSetEventBoostPriority  (348, ...
 03480   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81991, 0}  ... {28, 56, reply, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\3\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 03481  1564   NtCreateEvent  ... 984, ) == 0x0
 03482  1296   NtTestAlert  ... ) == 0x0
 03483  1512   NtAllocateVirtualMemory  ... 1449984, 4096, ) == 0x0
 03253  1396   NtWaitForSingleObject  ... ) == 0x0
 03488  1600   NtSetEventBoostPriority  ... ) == 0x0
 03489   896   NtResumeThread  (980, ...
 03490  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03491  1296   NtContinue  (97582384, 1, ...
 03492  1396   NtSetEventBoostPriority  (348, ...
 03493  1512   NtSetEventBoostPriority  (324, ...
 03494  1600   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03489   896   NtResumeThread  ... 1, ) == 0x0
 03490  1564   NtDuplicateObject  ... 988, ) == 0x0
 03254  1920   NtWaitForSingleObject  ... ) == 0x0
 03492  1396   NtSetEventBoostPriority  ... ) == 0x0
 03495  1296   NtRegisterThreadTerminatePort  (24, ...
 03485  1380   NtWaitForSingleObject  ... ) == 0x0
 03493  1512   NtSetEventBoostPriority  ... ) == 0x0
 03494  1600   NtWaitForSingleObject  ... ) == 0x102
 03496   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03497  1920   NtWaitForSingleObject  (324, 0, 0x0, ...
 03498  1564   NtWaitForSingleObject  (324, 0, 0x0, ...
 03499  1396   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03500  1380   NtAllocateVirtualMemory  (-1, 1454080, 0, 4096, 4096, 4, ...
 03495  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 03501  1512   NtWaitForSingleObject  (324, 0, 0x0, ...
 03502  1600   NtWaitForSingleObject  (160, 0, 0x0, ...
 03503   440   NtWaitForSingleObject  (324, 0, 0x0, ...
 03496   896   NtAllocateVirtualMemory  ... 98631680, 1048576, ) == 0x0
 03500  1380   NtAllocateVirtualMemory  ... 1454080, 4096, ) == 0x0
 03504  1296   NtWaitForSingleObject  (324, 0, 0x0, ...
 03499  1396   NtWaitForSingleObject  ... ) == 0x102
 03505  1380   NtSetEventBoostPriority  (324, ...
 03506   896   NtAllocateVirtualMemory  (-1, 99672064, 0, 8192, 4096, 4, ...
 03507  1396   NtWaitForSingleObject  (324, 0, 0x0, ...
 03506   896   NtAllocateVirtualMemory  ... 99672064, 8192, ) == 0x0
 03508   896   NtProtectVirtualMemory  (-1, (0x5f0e000), 4096, 260, ... (0x5f0e000), 4096, 4, ) == 0x0
 03509   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 992, {1252, 2044}, ) == 0x0
 03510   896   NtQueryInformationThread  (992, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 03511   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\374\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81992, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81991, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\374\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81992, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\3\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 03487   752   NtWaitForSingleObject  ... ) == 0x0
 03505  1380   NtSetEventBoostPriority  ... ) == 0x0
 03512   752   NtSetEventBoostPriority  (324, ...
 03513  1380   NtWaitForSingleObject  (324, 0, 0x0, ...
 03497  1920   NtWaitForSingleObject  ... ) == 0x0