Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtQueryInformationProcess(>) 
 7 
NtQueryAttributesFile(>) 
 61 

NtDelayExecution(>) 
 1 
NtNotifyChangeKey(>) 
 2 
NtConnectPort(>) 
 8 
NtContinue(>) 
 82 

NtGdiCreateBitmap(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtCreateFile(>) 
 8 
NtMapViewOfSection(>) 
 99 

NtGdiInit(>) 
 1 
NtQueryDefaultUILanguage(>) 
 2 
NtQueryVirtualMemory(>) 
 9 
NtCreateEvent(>) 
 108 

NtGdiQueryFontAssocInfo(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 
NtWriteVirtualMemory(>) 
 116 

NtGdiSelectBitmap(>) 
 1 
NtSetInformationObject(>) 
 2 
NtFsControlFile(>) 
 10 
NtQuerySystemInformation(>) 
 117 

NtOpenKeyedEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtSetInformationThread(>) 
 11 
NtCreateThread(>) 
 118 

NtOpenSymbolicLinkObject(>) 
 1 
NtOpenProcessToken(>) 
 3 
NtOpenThreadToken(>) 
 12 
NtQueryInformationThread(>) 
 118 

NtQueryObject(>) 
 1 
NtOpenProcessTokenEx(>) 
 3 
NtSetInformationFile(>) 
 12 
NtResumeThread(>) 
 130 

NtQueryPerformanceCounter(>) 
 1 
NtQueryDefaultLocale(>) 
 3 
NtQuerySection(>) 
 14 
NtOpenKey(>) 
 136 

NtQuerySymbolicLinkObject(>) 
 1 
NtQueryVolumeInformationFile(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtTestAlert(>) 
 154 

NtQuerySystemTime(>) 
 1 
NtReadFile(>) 
 3 
NtSetValueKey(>) 
 17 
NtRegisterThreadTerminatePort(>) 
 158 

NtRaiseException(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtCreateKey(>) 
 24 
NtRequestWaitReplyPort(>) 
 168 

NtSetInformationProcess(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtCreateSection(>) 
 26 
NtDuplicateObject(>) 
 179 

NtUserCallNoParam(>) 
 1 
NtOpenThreadTokenEx(>) 
 4 
NtOpenFile(>) 
 27 
NtQueryValueKey(>) 
 258 

NtUserGetObjectInformation(>) 
 1 
NtWriteFile(>) 
 4 
NtOpenProcess(>) 
 29 
NtClose(>) 
 279 

NtUserGetProcessWindowStation(>) 
 1 
NtCreateMutant(>) 
 5 
NtDeviceIoControlFile(>) 
 36 
NtAllocateVirtualMemory(>) 
 331 

NtUserGetThreadDesktop(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtUnmapViewOfSection(>) 
 45 
NtProtectVirtualMemory(>) 
 350 

NtCallbackReturn(>) 
 2 
NtQueryInformationToken(>) 
 6 
NtOpenSection(>) 
 51 
NtSetEventBoostPriority(>) 
 660 

NtCreateIoCompletion(>) 
 2 
NtQueryInformationFile(>) 
 7 
NtFlushInstructionCache(>) 
 58 
NtWaitForSingleObject(>) 
 861 


Trace:
 00001  1736   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003  1736   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00006  1736   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007  1736   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00008  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00009  1736   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00010  1736   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00011  1736   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00012  1736   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00013  1736   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00014  1736   NtClose  (12, ... ) == 0x0
 00015  1736   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00016  1736   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00017  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019  1736   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00020  1736   NtClose  (16, ... ) == 0x0
 00021  1736   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00022  1736   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00023  1736   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00024  1736   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00025  1736   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00026  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00027  1736   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00028  1736   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19136512}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19136512}, {0, 0, 0}, 200, 44, ) == 0x0
 00029  1736   NtClose  (16, ... ) == 0x0
 00030  1736   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00031  1736   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00032  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00033  1736   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00034  1736   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00035  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6$\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75469, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75469, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6$\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75469, 0} "\330<\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6$\1\4\0\0\0" )  ) == 0x0
 00036  1736   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00037  1736   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00038  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00039  1736   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00040  1736   NtClose  (16, ... ) == 0x0
 00041  1736   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00042  1736   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00043  1736   NtClose  (16, ... ) == 0x0
 00044  1736   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00045  1736   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00046  1736   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00047  1736   NtClose  (16, ... ) == 0x0
 00048  1736   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00049  1736   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00050  1736   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00051  1736   NtClose  (16, ... ) == 0x0
 00052  1736   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00053  1736   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00054  1736   NtClose  (16, ... ) == 0x0
 00055  1736   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00056  1736   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00057  1736   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058  1736   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00059  1736   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6$\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ... {24, 52, reply, 0, 1636, 1736, 75470, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" )  ... {24, 52, reply, 0, 1636, 1736, 75470, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6$\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" ... {24, 52, reply, 0, 1636, 1736, 75470, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6$\1p\30\0\0" )  ) == 0x0
 00060  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6$\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75471, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75471, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6$\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75471, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6$\18\6\0\0" )  ) == 0x0
 00061  1736   NtProtectVirtualMemory  (-1, (0x409000), 94224, 4, ... (0x409000), 98304, 128, ) == 0x0
 00062  1736   NtProtectVirtualMemory  (-1, (0x409000), 98304, 128, ... (0x409000), 98304, 4, ) == 0x0
 00063  1736   NtFlushInstructionCache  (-1, 4231168, 94224, ... ) == 0x0
 00064  1736   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00065  1736   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00066  1736   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00067  1736   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00068  1736   NtClose  (16, ... ) == 0x0
 00069  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00070  1736   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00071  1736   NtClose  (16, ... ) == 0x0
 00072  1736   NtTestAlert  (... ) == 0x0
 00073  1736   NtContinue  (1244464, 1, ...
 00074  1736   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40283e,}, 4, ... ) == 0x0
 00075  1736   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00076  1736   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00077  1736   NtClose  (16, ... ) == 0x0
 00078  1736   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00079  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00080  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00081  1736   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00082  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00083  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00084  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00085  1736   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00086  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00088  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00089  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00090  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00092  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00093  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00095  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00096  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00097  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00098  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242976, ... ) }, 1242976, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00099  1736   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 16, ) }, ... 16, ) == 0x0
 00100  1736   NtCreateEvent  (0x1f0003, {24, 16, 0x80, 1245092, 0,  (0x1f0003, {24, 16, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 28, ) }, 1, 0, ... 28, ) == 0x0
 00101  1736   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 32, ) }, {27086, 0}, 64, 134217728, 0, ... 32, ) == 0x0
 00102  1736   NtMapViewOfSection  (32, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0x320000), 0x0, 28672, ) == 0x0
 00103  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.DLL"}, ... 36, ) }, ... 36, ) == 0x0
 00104  1736   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00105  1736   NtClose  (36, ... ) == 0x0
 00106  1736   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00107  1736   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00108  1736   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00109  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00110  1736   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00111  1736   NtClose  (36, ... ) == 0x0
 00112  1736   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00113  1736   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00114  1736   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00115  1736   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00116  1736   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00117  1736   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00118  1736   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00119  1736   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00120  1736   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00121  1736   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00122  1736   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00123  1736   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00124  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00125  1736   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00126  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00127  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 36, ) }, ... 36, ) == 0x0
 00128  1736   NtQueryValueKey  (36,  (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00129  1736   NtQueryValueKey  (36,  (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00130  1736   NtClose  (36, ... ) == 0x0
 00131  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 36, ) }, ... 36, ) == 0x0
 00132  1736   NtQueryValueKey  (36,  (36, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00133  1736   NtClose  (36, ... ) == 0x0
 00134  1736   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 36, ) }, ... 36, ) == 0x0
 00135  1736   NtSetInformationObject  (36, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00136  1736   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00137  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00138  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00139  1736   NtOpenProcessToken  (-1, 0x20, ... 40, ) == 0x0
 00140  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00141  1736   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00142  1736   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 44, ) }, ... 44, ) == 0x0
 00143  1736   NtQueryValueKey  (44,  (44, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00144  1736   NtClose  (44, ... ) == 0x0
 00145  1736   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00146  1736   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 44, ) == 0x0
 00147  1736   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 48, ) == 0x0
 00148  1736   NtQuerySystemTime  (... {-1028854174, 29922068}, ) == 0x0
 00149  1736   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00150  1736   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00151  1736   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00152  1736   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00153  1736   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00154  1736   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00155  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 60, ) == 0x0
 00156  1736   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00157  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 64, ) }, ... 64, ) == 0x0
 00158  1736   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "ActiveComputerName"}, ... 68, ) }, ... 68, ) == 0x0
 00159  1736   NtQueryValueKey  (68,  (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 00160  1736   NtClose  (68, ... ) == 0x0
 00161  1736   NtClose  (64, ... ) == 0x0
 00162  1736   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 64, ) == 0x0
 00163  1736   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 68, ) == 0x0
 00164  1736   NtDuplicateObject  (-1, 64, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00165  1736   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00166  1736   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00167  1736   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00168  1736   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00169  1736   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243252,  (0xc0100080, {24, 0, 0x40, 0, 1243252, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) == 0x0
 00170  1736   NtSetInformationFile  (80, 1243308, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00171  1736   NtSetInformationFile  (80, 1243296, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00172  1736   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00173  1736   NtWriteFile  (80, 57, 0, 0,  (80, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00174  1736   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00175  1736   NtReadFile  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00176  1736   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20N+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00177  1736   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340 \0"\0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) \0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340 \0"\0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340\0\0\0\0", ) == 0x103
 00178  1736   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0&H/\254b\363\222I\243j\304#\242z\321\340", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00179  1736   NtClose  (76, ... ) == 0x0
 00180  1736   NtClose  (80, ... ) == 0x0
 00181  1736   NtAdjustPrivilegesToken  (40, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00182  1736   NtClose  (40, ... ) == 0x0
 00183  1736   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 3342336, 65536, ) == 0x0
 00184  1736   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00185  1736   NtCreateSection  (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 40, ) == 0x0
 00186  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00187  1736   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00188  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00189  1736   NtFreeVirtualMemory  (-1, (0x330000), 0, 32768, ... (0x330000), 65536, ) == 0x0
 00190  1736   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00191  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00192  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00193  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00194  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00195  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00196  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00197  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00198  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00199  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00200  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00201  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 80, ) == 0x0
 00202  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 76, ) }, ... 76, ) == 0x0
 00203  1736   NtMapViewOfSection  (76, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00204  1736   NtClose  (76, ... ) == 0x0
 00205  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00206  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00207  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00208  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00209  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00210  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00211  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00212  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00213  1736   NtAllocateVirtualMemory  (80, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 00214  1736   NtAllocateVirtualMemory  (80, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 00215  1736   NtProtectVirtualMemory  (80, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 00216  1736   NtCreateThread  (0x1f03ff, 0x0, 80, 1243840, 1243784, 1, ... 76, {580, 1744}, ) == 0x0
 00217  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\320\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75472, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\320\6\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75472, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\320\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75472, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\320\6\0\0" )  ) == 0x0
 00218  1736   NtResumeThread  (76, ... 1, ) == 0x0
 00219  1736   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00220  1736   NtClose  (80, ... ) == 0x0
 00221  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00222  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00223  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 80, ) == 0x0
 00224  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00225  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00226  1736   NtClose  (84, ... ) == 0x0
 00227  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00228  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00229  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00230  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00231  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00232  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00233  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00234  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00235  1736   NtClose  (80, ... ) == 0x0
 00236  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00237  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00238  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 80, ) == 0x0
 00239  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00240  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00241  1736   NtClose  (84, ... ) == 0x0
 00242  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00243  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00244  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00245  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00246  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00247  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00248  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00249  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00250  1736   NtClose  (80, ... ) == 0x0
 00251  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00252  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00253  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 80, ) == 0x0
 00254  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00255  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00256  1736   NtClose  (84, ... ) == 0x0
 00257  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00258  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00259  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00260  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00261  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00262  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00263  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00264  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00265  1736   NtClose  (80, ... ) == 0x0
 00266  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00267  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00268  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 80, ) == 0x0
 00269  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00270  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00271  1736   NtClose  (84, ... ) == 0x0
 00272  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00273  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00274  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00275  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00276  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00277  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00278  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00279  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00280  1736   NtClose  (80, ... ) == 0x0
 00281  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00282  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00283  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 80, ) == 0x0
 00284  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00285  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff50000), 0x0, 28672, ) == 0x0
 00286  1736   NtClose  (84, ... ) == 0x0
 00287  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00288  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Md\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00289  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00290  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00291  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00292  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00293  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00294  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00295  1736   NtClose  (80, ... ) == 0x0
 00296  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00297  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00298  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 80, ) == 0x0
 00299  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00300  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00301  1736   NtClose  (84, ... ) == 0x0
 00302  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00303  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00304  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00305  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00306  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00307  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00308  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00309  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00310  1736   NtClose  (80, ... ) == 0x0
 00311  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00312  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00313  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 80, ) == 0x0
 00314  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00315  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00316  1736   NtClose  (84, ... ) == 0x0
 00317  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00318  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00319  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00320  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00321  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00322  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00323  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00324  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00325  1736   NtClose  (80, ... ) == 0x0
 00326  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00327  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00328  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 80, ) == 0x0
 00329  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00330  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00331  1736   NtClose  (84, ... ) == 0x0
 00332  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00333  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00334  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00335  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00336  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00337  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00338  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00339  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00340  1736   NtClose  (80, ... ) == 0x0
 00341  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00342  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00343  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 80, ) == 0x0
 00344  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00345  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00346  1736   NtClose  (84, ... ) == 0x0
 00347  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00348  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00349  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00350  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00351  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00352  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00353  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00354  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00355  1736   NtClose  (80, ... ) == 0x0
 00356  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00357  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00358  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 80, ) == 0x0
 00359  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00360  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00361  1736   NtClose  (84, ... ) == 0x0
 00362  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00363  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00364  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00365  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00366  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00367  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00368  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00369  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00370  1736   NtClose  (80, ... ) == 0x0
 00371  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00372  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00373  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 80, ) == 0x0
 00374  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00375  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00376  1736   NtClose  (84, ... ) == 0x0
 00377  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00378  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00379  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00380  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00381  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00382  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00383  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00384  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00385  1736   NtClose  (80, ... ) == 0x0
 00386  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00387  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00388  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {180, 0}, ... 80, ) == 0x0
 00389  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00390  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00391  1736   NtClose  (84, ... ) == 0x0
 00392  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00393  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00394  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00395  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00396  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00397  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00398  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00399  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00400  1736   NtClose  (80, ... ) == 0x0
 00401  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00402  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00403  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 80, ) == 0x0
 00404  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00405  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00406  1736   NtClose  (84, ... ) == 0x0
 00407  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00408  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00409  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00410  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00411  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00412  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00413  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00414  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00415  1736   NtClose  (80, ... ) == 0x0
 00416  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00417  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00418  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 80, ) == 0x0
 00419  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00420  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00421  1736   NtClose  (84, ... ) == 0x0
 00422  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00423  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00424  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00425  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00426  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00427  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00428  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00429  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00430  1736   NtClose  (80, ... ) == 0x0
 00431  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00432  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00433  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 80, ) == 0x0
 00434  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00435  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00436  1736   NtClose  (84, ... ) == 0x0
 00437  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00438  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00439  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00440  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00441  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00442  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00443  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00444  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00445  1736   NtClose  (80, ... ) == 0x0
 00446  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00447  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00448  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 80, ) == 0x0
 00449  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00450  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00451  1736   NtClose  (84, ... ) == 0x0
 00452  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00453  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00454  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00455  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00456  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00457  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00458  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00459  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00460  1736   NtClose  (80, ... ) == 0x0
 00461  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00462  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00463  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 80, ) == 0x0
 00464  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00465  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00466  1736   NtClose  (84, ... ) == 0x0
 00467  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00468  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00469  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00470  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00471  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00472  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00473  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00474  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00475  1736   NtClose  (80, ... ) == 0x0
 00476  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00477  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00478  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 80, ) == 0x0
 00479  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00480  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00481  1736   NtClose  (84, ... ) == 0x0
 00482  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00483  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00484  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00485  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00486  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00487  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00488  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00489  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00490  1736   NtClose  (80, ... ) == 0x0
 00491  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00492  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00493  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 80, ) == 0x0
 00494  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00495  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00496  1736   NtClose  (84, ... ) == 0x0
 00497  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00498  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00499  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00500  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00501  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00502  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00503  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00504  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00505  1736   NtClose  (80, ... ) == 0x0
 00506  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00507  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00508  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 80, ) == 0x0
 00509  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00510  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00511  1736   NtClose  (84, ... ) == 0x0
 00512  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00513  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00514  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00515  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00516  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00517  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00518  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00519  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00520  1736   NtClose  (80, ... ) == 0x0
 00521  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00522  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00523  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 80, ) == 0x0
 00524  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00525  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00526  1736   NtClose  (84, ... ) == 0x0
 00527  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00528  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00529  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00530  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00531  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00532  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00533  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00534  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00535  1736   NtClose  (80, ... ) == 0x0
 00536  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00537  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00538  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1200, 0}, ... 80, ) == 0x0
 00539  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00540  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00541  1736   NtClose  (84, ... ) == 0x0
 00542  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00543  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00544  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00545  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00546  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00547  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00548  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00549  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00550  1736   NtClose  (80, ... ) == 0x0
 00551  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00552  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00553  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {164, 0}, ... 80, ) == 0x0
 00554  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00555  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00556  1736   NtClose  (84, ... ) == 0x0
 00557  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00558  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00559  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00560  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00561  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00562  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00563  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00564  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00565  1736   NtClose  (80, ... ) == 0x0
 00566  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00567  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00568  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {888, 0}, ... 80, ) == 0x0
 00569  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00570  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00571  1736   NtClose  (84, ... ) == 0x0
 00572  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00573  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00574  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00575  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00576  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00577  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00578  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00579  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00580  1736   NtClose  (80, ... ) == 0x0
 00581  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00582  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00583  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1512, 0}, ... 80, ) == 0x0
 00584  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00585  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00586  1736   NtClose  (84, ... ) == 0x0
 00587  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00588  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00589  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00590  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00591  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00592  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00593  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00594  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00595  1736   NtClose  (80, ... ) == 0x0
 00596  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00597  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00598  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1284, 0}, ... 80, ) == 0x0
 00599  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00600  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00601  1736   NtClose  (84, ... ) == 0x0
 00602  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00603  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00604  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00605  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00606  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00607  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00608  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00609  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00610  1736   NtClose  (80, ... ) == 0x0
 00611  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00612  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00613  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {792, 0}, ... 80, ) == 0x0
 00614  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00615  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00616  1736   NtClose  (84, ... ) == 0x0
 00617  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00618  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00619  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00620  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00621  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00622  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00623  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00624  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00625  1736   NtClose  (80, ... ) == 0x0
 00626  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00627  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00628  1736   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1636, 0}, ... 80, ) == 0x0
 00629  1736   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00630  1736   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00631  1736   NtClose  (84, ... ) == 0x0
 00632  1736   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00633  1736   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00634  1736   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00635  1736   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00636  1736   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00637  1736   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00638  1736   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00639  1736   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00640  1736   NtClose  (80, ... ) == 0x0
 00641  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00642  1736   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00643  1736   NtClose  (40, ... ) == 0x0
 00644  1736   NtClose  (28, ... ) == 0x0
 00645  1736   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x4000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00646  1736   NtContinue  (1244400, 0, ...
 00647  1736   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3342336, 4096, ) == 0x0
 00648  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00649  1736   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00650  1736   NtClose  (28, ... ) == 0x0
 00651  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00652  1736   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00653  1736   NtClose  (28, ... ) == 0x0
 00654  1736   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00655  1736   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00656  1736   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00657  1736   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00658  1736   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00659  1736   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00660  1736   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00661  1736   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00662  1736   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00663  1736   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00664  1736   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00665  1736   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00666  1736   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00667  1736   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00668  1736   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00669  1736   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00670  1736   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00671  1736   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00672  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00673  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00674  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00675  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6$\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75536, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75536, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6$\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75536, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6$\1$\1\0\0" )  ) == 0x0
 00676  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00677  1736   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00678  1736   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 40, ) == 0x0
 00679  1736   NtClose  (28, ... ) == 0x0
 00680  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00681  1736   NtClose  (40, ... ) == 0x0
 00682  1736   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00683  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00684  1736   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00685  1736   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 40, ... 28, ) == 0x0
 00686  1736   NtClose  (40, ... ) == 0x0
 00687  1736   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00688  1736   NtClose  (28, ... ) == 0x0
 00689  1736   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00690  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00691  1736   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00692  1736   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 40, ) == 0x0
 00693  1736   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00694  1736   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00695  1736   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00696  1736   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00697  1736   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00698  1736   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699  1736   NtClose  (84, ... ) == 0x0
 00700  1736   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00701  1736   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00702  1736   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00703  1736   NtClose  (84, ... ) == 0x0
 00704  1736   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00705  1736   NtClose  (80, ... ) == 0x0
 00706  1736   NtClose  (28, ... ) == 0x0
 00707  1736   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00708  1736   NtClose  (40, ... ) == 0x0
 00709  1736   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00710  1736   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00711  1736   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00712  1736   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00713  1736   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00714  1736   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00715  1736   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00716  1736   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00717  1736   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00718  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00719  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00720  1736   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00721  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00722  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00723  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00724  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 40, ) }, ... 40, ) == 0x0
 00725  1736   NtQueryValueKey  (40,  (40, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00726  1736   NtClose  (40, ... ) == 0x0
 00727  1736   NtMapViewOfSection  (-2147481380, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x500000), 0x0, 1060864, ) == 0x0
 00728  1736   NtClose  (-2147481380, ... ) == 0x0
 00729  1736   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 40, ) == 0x0
 00730  1736   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00731  1736   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147481380, ) == 0x0
 00732  1736   NtQueryInformationToken  (-2147481380, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00733  1736   NtQueryInformationToken  (-2147481380, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00734  1736   NtClose  (-2147481380, ... ) == 0x0
 00735  1736   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00736  1736   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00737  1736   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00738  1736   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00739  1736   NtQueryValueKey  (-2147481380,  (-2147481380, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00740  1736   NtClose  (-2147481380, ... ) == 0x0
 00741  1736   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481380, ) }, ... -2147481380, ) == 0x0
 00742  1736   NtQueryValueKey  (-2147481380,  (-2147481380, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00743  1736   NtClose  (-2147481380, ... ) == 0x0
 00744  1736   NtQueryDefaultLocale  (0, -138397364, ... ) == 0x0
 00745  1736   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00746  1736   NtUserCallNoParam  (24, ... ) == 0x0
 00747  1736   NtGdiCreateCompatibleDC  (0, ...
 00748  1736   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00747  1736   NtGdiCreateCompatibleDC  ... ) == 0xf3010663
 00749  1736   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00750  1736   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00751  1736   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0xfd0505f7
 00752  1736   NtGdiCreateSolidBrush  (0, 0, ...
 00753  1736   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00752  1736   NtGdiCreateSolidBrush  ... ) == 0x4210057d
 00754  1736   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00755  1736   NtGdiCreateCompatibleDC  (0, ... ) == 0x69010363
 00756  1736   NtGdiSelectBitmap  (1761674083, -50002441, ... ) == 0x185000f
 00757  1736   NtUserGetThreadDesktop  (1736, 0, ... ) == 0x50
 00758  1736   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 88, ) }, ... 88, ) == 0x0
 00759  1736   NtQueryValueKey  (88,  (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00760  1736   NtClose  (88, ... ) == 0x0
 00761  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00762  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8173c017
 00763  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00764  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8173c01c
 00765  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00766  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8173c01e
 00767  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00768  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81738002
 00769  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00770  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8173c018
 00771  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00772  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8173c01a
 00773  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00774  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8173c01d
 00775  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00776  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8173c026
 00777  1736   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00778  1736   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8173c019
 00779  1736   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8173c020
 00780  1736   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8173c022
 00781  1736   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8173c023
 00782  1736   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8173c024
 00783  1736   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8173c025
 00784  1736   NtCallbackReturn  (0, 0, 0, ...
 00785  1736   NtGdiInit  (... ) == 0x1
 00786  1736   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00787  1736   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00788  1736   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 3538944, 28672, ) == 0x0
 00789  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00790  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00791  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00792  1736   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00793  1736   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 88, ... 92, ) == 0x0
 00794  1736   NtQuerySection  (92, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00795  1736   NtClose  (88, ... ) == 0x0
 00796  1736   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00797  1736   NtClose  (92, ... ) == 0x0
 00798  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00799  1736   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00800  1736   NtClose  (92, ... ) == 0x0
 00801  1736   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00802  1736   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00803  1736   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00804  1736   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00805  1736   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00806  1736   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00807  1736   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00808  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00809  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00810  1736   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00811  1736   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00812  1736   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00813  1736   NtClose  (92, ... ) == 0x0
 00814  1736   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00815  1736   NtClose  (88, ... ) == 0x0
 00816  1736   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00817  1736   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00818  1736   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00819  1736   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00820  1736   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00821  1736   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00822  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00823  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00824  1736   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 00825  1736   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 00826  1736   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 00827  1736   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 00828  1736   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 88, ) }, ... 88, ) == 0x0
 00829  1736   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x380000), 0x0, 12288, ) == 0x0
 00830  1736   NtClose  (88, ... ) == 0x0
 00831  1736   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 00832  1736   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00833  1736   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00834  1736   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00835  1736   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00836  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00837  1736   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00838  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00839  1736   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00840  1736   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 28672, ) == 0x0
 00841  1736   NtFreeVirtualMemory  (-1, (0x330144), 0, 32768, ... (0x330000), 4096, ) == 0x0
 00842  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00843  1736   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3342336, 65536, ) == 0x0
 00844  1736   NtAllocateVirtualMemory  (-1, 3342336, 0, 4096, 4096, 4, ... 3342336, 4096, ) == 0x0
 00845  1736   NtAllocateVirtualMemory  (-1, 3346432, 0, 20480, 4096, 4, ... 3346432, 20480, ) == 0x0
 00846  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9502720, 1048576, ) == 0x0
 00847  1736   NtAllocateVirtualMemory  (-1, 9502720, 0, 32768, 4096, 4, ... 9502720, 32768, ) == 0x0
 00848  1736   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "Jobaka3"}, 0, ... 88, ) }, 0, ... 88, ) == 0x0
 00849  1736   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 00850  1736   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00851  1736   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00852  1736   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 96, ) == 0x0
 00853  1736   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "Protocol_Catalog9"}, ... 100, ) }, ... 100, ) == 0x0
 00854  1736   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00855  1736   NtNotifyChangeKey  (100, 96, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00856  1736   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00857  1736   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00858  1736   NtQueryValueKey  (100,  (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 00859  1736   NtQueryValueKey  (100,  (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 00860  1736   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Catalog_Entries"}, ... 104, ) }, ... 104, ) == 0x0
 00861  1736   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00862  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000001"}, ... 108, ) }, ... 108, ) == 0x0
 00863  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00864  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00865  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0b\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0b\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0c\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0c\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0b\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0b\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0c\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0c\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0b\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0b\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0c\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0c\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00866  1736   NtClose  (108, ... ) == 0x0
 00867  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000002"}, ... 108, ) }, ... 108, ) == 0x0
 00868  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00869  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00870  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0g\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0g\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0h\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0g\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0g\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0h\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0g\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0g\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0h\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0h\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0i\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0j\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00871  1736   NtClose  (108, ... ) == 0x0
 00872  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000003"}, ... 108, ) }, ... 108, ) == 0x0
 00873  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00874  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00875  1736   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00876  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0m\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0n\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0m\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0n\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0m\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0n\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00877  1736   NtClose  (108, ... ) == 0x0
 00878  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000004"}, ... 108, ) }, ... 108, ) == 0x0
 00879  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00880  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00881  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0r\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0s\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0r\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0s\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0r\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0s\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00882  1736   NtClose  (108, ... ) == 0x0
 00883  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000005"}, ... 108, ) }, ... 108, ) == 0x0
 00884  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00885  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00886  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0w\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0w\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0x\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0w\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0w\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0x\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0w\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0w\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0x\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00887  1736   NtClose  (108, ... ) == 0x0
 00888  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000006"}, ... 108, ) }, ... 108, ) == 0x0
 00889  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00890  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00891  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0|\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0|\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0}\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0}\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\177\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0|\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0|\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0}\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0}\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\177\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\177\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0|\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0|\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0}\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0}\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0~\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\177\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00892  1736   NtClose  (108, ... ) == 0x0
 00893  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000007"}, ... 108, ) }, ... 108, ) == 0x0
 00894  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00895  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00896  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\201\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\201\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\202\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\202\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\204\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\201\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\201\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\202\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\202\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\204\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\204\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\201\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\201\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\202\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\202\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\203\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\204\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00897  1736   NtClose  (108, ... ) == 0x0
 00898  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000008"}, ... 108, ) }, ... 108, ) == 0x0
 00899  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00900  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00901  1736   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00902  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\207\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\207\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\210\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\212\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\207\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\207\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\210\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\212\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\212\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0\207\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\207\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\210\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\210\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\211\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\212\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00903  1736   NtClose  (108, ... ) == 0x0
 00904  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000009"}, ... 108, ) }, ... 108, ) == 0x0
 00905  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00906  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00907  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\214\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\214\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\215\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\215\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\217\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\214\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\214\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\215\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\215\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\217\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\217\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\214\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\214\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\215\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\215\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\216\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\217\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00908  1736   NtClose  (108, ... ) == 0x0
 00909  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000010"}, ... 108, ) }, ... 108, ) == 0x0
 00910  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00911  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00912  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\221\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\221\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\222\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\221\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\221\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\222\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\221\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\221\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\222\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\223\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\224\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00913  1736   NtClose  (108, ... ) == 0x0
 00914  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000011"}, ... 108, ) }, ... 108, ) == 0x0
 00915  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00916  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00917  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\226\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\226\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\227\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\227\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\226\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\226\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\227\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\227\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\226\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\226\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\227\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\227\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\230\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\231\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00918  1736   NtClose  (108, ... ) == 0x0
 00919  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000012"}, ... 108, ) }, ... 108, ) == 0x0
 00920  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00921  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00922  1736   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00923  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\234\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\234\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\235\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\235\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\234\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\234\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\235\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\235\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\234\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\234\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\235\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\235\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\236\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\237\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00924  1736   NtClose  (108, ... ) == 0x0
 00925  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000013"}, ... 108, ) }, ... 108, ) == 0x0
 00926  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00927  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00928  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\241\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\241\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\242\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\242\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\244\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\241\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\241\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\242\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\242\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\244\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\244\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\241\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\241\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\242\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\242\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\243\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\244\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00929  1736   NtClose  (108, ... ) == 0x0
 00930  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000014"}, ... 108, ) }, ... 108, ) == 0x0
 00931  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00932  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00933  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\246\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\246\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\247\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\247\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\251\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\246\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\246\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\247\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\247\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\251\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\251\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\246\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\246\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\247\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\247\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\250\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\251\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00934  1736   NtClose  (108, ... ) == 0x0
 00935  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000015"}, ... 108, ) }, ... 108, ) == 0x0
 00936  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00937  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00938  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\253\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\253\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\254\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\254\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\253\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\253\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\254\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\254\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\253\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\253\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\254\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0\254\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\255\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\256\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00939  1736   NtClose  (108, ... ) == 0x0
 00940  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000016"}, ... 108, ) }, ... 108, ) == 0x0
 00941  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00942  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00943  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\260\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\260\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\261\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\261\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\260\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\260\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\261\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\261\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\260\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\260\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\261\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\261\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\262\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\263\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00944  1736   NtClose  (108, ... ) == 0x0
 00945  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000017"}, ... 108, ) }, ... 108, ) == 0x0
 00946  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00947  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00948  1736   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00949  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\266\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\266\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\267\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\267\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\271\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\266\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\266\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\267\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\267\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\271\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\271\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\266\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\266\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\267\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\267\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\270\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\271\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00950  1736   NtClose  (108, ... ) == 0x0
 00951  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000018"}, ... 108, ) }, ... 108, ) == 0x0
 00952  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00953  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00954  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\273\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\273\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\274\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\274\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\276\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\273\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\273\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\274\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\274\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\276\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\276\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\273\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\273\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\274\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\274\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\275\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\276\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00955  1736   NtClose  (108, ... ) == 0x0
 00956  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000019"}, ... 108, ) }, ... 108, ) == 0x0
 00957  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00958  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00959  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\300\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\300\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\301\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\301\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\300\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\300\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\301\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\301\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\300\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\300\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\301\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\301\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\302\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\303\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00960  1736   NtClose  (108, ... ) == 0x0
 00961  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000020"}, ... 108, ) }, ... 108, ) == 0x0
 00962  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00963  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00964  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\305\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\305\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\306\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\306\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\305\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\305\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\306\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\306\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\305\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\305\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\306\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\306\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\307\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\310\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00965  1736   NtClose  (108, ... ) == 0x0
 00966  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000021"}, ... 108, ) }, ... 108, ) == 0x0
 00967  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00968  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00969  1736   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00970  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\313\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\313\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\314\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\314\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\313\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\313\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\314\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\314\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\313\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\313\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\314\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\230n\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\314\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\315\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\316\3\0\0d\6\0\0\310\6\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00971  1736   NtClose  (108, ... ) == 0x0
 00972  1736   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000022"}, ... 108, ) }, ... 108, ) == 0x0
 00973  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00974  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00975  1736   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\320\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\320\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\321\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0\321\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\322\3\0\0d\6\0\0\310\6\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\322\3\0\0d\6\0\0\310\6\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\323\3\0\0d\6\0\0\310\6\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\323\3\0\0d\6\0\0\310\6\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\324\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\320\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\320\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\321\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0\321\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\322\3\0\0d\6\0\0\310\6\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\322\3\0\0d\6\0\0\310\6\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\323\3\0\0d\6\0\0\310\6\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\323\3\0\0d\6\0\0\310\6\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\324\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\320\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\320\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\321\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0\321\3\0\0d\6\0\0\310\6\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\322\3\0\0d\6\0\0\310\6\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\322\3\0\0d\6\0\0\310\6\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\323\3\0\0d\6\0\0\310\6\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\323\3\0\0d\6\0\0\310\6\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\324\3\0\0d\6\0\0\310\6\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 00976  1736   NtClose  (108, ... ) == 0x0
 00977  1736   NtClose  (104, ... ) == 0x0
 00978  1736   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 00979  1736   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 00980  1736   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 108, ) }, ... 108, ) == 0x0
 00981  1736   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00982  1736   NtNotifyChangeKey  (108, 104, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00983  1736   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00984  1736   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00985  1736   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00986  1736   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 00987  1736   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 00988  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00989  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00990  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00991  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00992  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00993  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00994  1736   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00995  1736   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00996  1736   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00997  1736   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00998  1736   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00999  1736   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01000  1736   NtClose  (116, ... ) == 0x0
 01001  1736   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 01002  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01003  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01004  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01005  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01006  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01007  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01008  1736   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01009  1736   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01010  1736   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01011  1736   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01012  1736   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01013  1736   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01014  1736   NtClose  (116, ... ) == 0x0
 01015  1736   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 01016  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01017  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01018  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01019  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01020  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01021  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01022  1736   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01023  1736   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01024  1736   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01025  1736   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01026  1736   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01027  1736   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01028  1736   NtClose  (116, ... ) == 0x0
 01029  1736   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 01030  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01031  1736   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01032  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01033  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01034  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01035  1736   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01036  1736   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01037  1736   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01038  1736   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01039  1736   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01040  1736   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01041  1736   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01042  1736   NtClose  (116, ... ) == 0x0
 01043  1736   NtClose  (112, ... ) == 0x0
 01044  1736   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01045  1736   NtClose  (92, ... ) == 0x0
 01046  1736   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01047  1736   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01048  1736   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01049  1736   NtQueryValueKey  (92,  (92, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01050  1736   NtClose  (92, ... ) == 0x0
 01051  1736   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01052  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 92, ) == 0x0
 01053  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1241400, ... ) }, 1241400, ... ) == 0x0
 01054  1736   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 112, {status=0x0, info=1}, ) }, 7, 2113568, ... 112, {status=0x0, info=1}, ) == 0x0
 01055  1736   NtSetInformationFile  (112, 1241376, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 01056  1736   NtClose  (112, ... ) == 0x0
 01057  1736   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) == 0x0
 01058  1736   NtQueryInformationFile  (112, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01059  1736   NtQueryInformationFile  (112, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01060  1736   NtQueryInformationFile  (112, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01061  1736   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01062  1736   NtQueryInformationFile  (112, 1365056, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01063  1736   NtQueryInformationFile  (112, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01064  1736   NtQueryInformationFile  (112, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01065  1736   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 1239736, ... ) }, 1239736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01066  1736   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01067  1736   NtClose  (-2147481380, ... ) == 0x0
 01066  1736   NtCreateFile  ... 116, {status=0x0, info=2}, ) == 0x0
 01068  1736   NtQueryVolumeInformationFile  (116, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01069  1736   NtQueryInformationFile  (116, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01070  1736   NtQueryVolumeInformationFile  (112, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01071  1736   NtSetInformationFile  (116, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01072  1736   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 112, ... 120, ) == 0x0
 01073  1736   NtMapViewOfSection  (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 28672, ) == 0x0
 01074  1736   NtClose  (120, ... ) == 0x0
 01075  1736   NtWriteFile  (116, 0, 0, 0,  (116, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0d\347\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 25600, 0x0, 0, ... {status=0x0, info=25600}, ) \0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\20\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 25600, 0x0, 0, ... {status=0x0, info=25600}, ) == 0x0
 01076  1736   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 01077  1736   NtSetInformationFile  (116, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01078  1736   NtClose  (112, ... ) == 0x0
 01079  1736   NtClose  (116, ... ) == 0x0
 01080  1736   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 116, ) }, ... 116, ) == 0x0
 01081  1736   NtSetValueKey  (116,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 01082  1736   NtSetInformationFile  (-2147482448, -138397904, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01083  1736   NtSetInformationFile  (-2147482448, -138397996, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01084  1736   NtSetInformationFile  (-2147482448, -138398304, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01081  1736   NtSetValueKey  ... ) == 0x0
 01085  1736   NtClose  (116, ... ) == 0x0
 01086  1736   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 116, ) }, 0, ... 116, ) == 0x0
 01087  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10551296, 1048576, ) == 0x0
 01088  1736   NtAllocateVirtualMemory  (-1, 11591680, 0, 8192, 4096, 4, ... 11591680, 8192, ) == 0x0
 01089  1736   NtProtectVirtualMemory  (-1, (0xb0e000), 4096, 260, ... (0xb0e000), 4096, 4, ) == 0x0
 01090  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 112, {1636, 928}, ) == 0x0
 01091  1736   NtQueryInformationThread  (112, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1636,Tid=928,}, 0x0, ) == 0x0
 01092  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0d\6\0\0\240\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75538, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0d\6\0\0\240\3\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75538, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0d\6\0\0\240\3\0\0" ... {28, 56, reply, 0, 1636, 1736, 75538, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0d\6\0\0\240\3\0\0" )  ) == 0x0
 01093  1736   NtResumeThread  (112, ... 1, ) == 0x0
 01094  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11599872, 1048576, ) == 0x0
 01095  1736   NtAllocateVirtualMemory  (-1, 12640256, 0, 8192, 4096, 4, ... 12640256, 8192, ) == 0x0
 01096  1736   NtProtectVirtualMemory  (-1, (0xc0e000), 4096, 260, ...
 01097   928   NtTestAlert  (... ) == 0x0
 01098   928   NtContinue  (11599152, 1, ...
 01099   928   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01100   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 120, ) == 0x0
 01101   928   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01102   928   NtAllocateVirtualMemory  (-1, 11587584, 0, 4096, 4096, 260, ...
 01096  1736   NtProtectVirtualMemory  ... (0xc0e000), 4096, 4, ) == 0x0
 01103  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 124, {1636, 428}, ) == 0x0
 01104  1736   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1636,Tid=428,}, 0x0, ) == 0x0
 01105  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75538, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75538, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0d\6\0\0\254\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0d\6\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75539, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75538, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0d\6\0\0\254\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0d\6\0\0\254\1\0\0" )  ) == 0x0
 01106  1736   NtResumeThread  (124, ... 1, ) == 0x0
 01107  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 12648448, 1048576, ) == 0x0
 01102   928   NtAllocateVirtualMemory  ... 11587584, 4096, ) == 0x0
 01108   428   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01109   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596276, ... }, 11596276, ...
 01108   428   NtCreateEvent  ... 128, ) == 0x0
 01109   928   NtQueryAttributesFile  ... ) == 0x0
 01110   428   NtWaitForSingleObject  (128, 0, 0x0, ...
 01111   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01112   928   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 132, ... 136, ) == 0x0
 01113   928   NtClose  (132, ... ) == 0x0
 01114   928   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 245760, ) == 0x0
 01115   928   NtClose  (136, ...
 01116  1736   NtAllocateVirtualMemory  (-1, 13688832, 0, 8192, 4096, 4, ... 13688832, 8192, ) == 0x0
 01117  1736   NtProtectVirtualMemory  (-1, (0xd0e000), 4096, 260, ... (0xd0e000), 4096, 4, ) == 0x0
 01118  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 132, {1636, 748}, ) == 0x0
 01119  1736   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1636,Tid=748,}, 0x0, ) == 0x0
 01120  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75539, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0d\6\0\0\354\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75540, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0d\6\0\0\354\2\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75540, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75539, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0d\6\0\0\354\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75540, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0d\6\0\0\354\2\0\0" )  ) == 0x0
 01121  1736   NtResumeThread  (132, ...
 01115   928   NtClose  ... ) == 0x0
 01122   928   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01123   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596584, ... ) }, 11596584, ... ) == 0x0
 01124   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 136, {status=0x0, info=1}, ) }, 5, 96, ... 136, {status=0x0, info=1}, ) == 0x0
 01125   928   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 136, ... 140, ) == 0x0
 01126   928   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01127   928   NtClose  (136, ...
 01121  1736   NtResumeThread  ... 1, ) == 0x0
 01128  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13697024, 1048576, ) == 0x0
 01129  1736   NtAllocateVirtualMemory  (-1, 14737408, 0, 8192, 4096, 4, ... 14737408, 8192, ) == 0x0
 01130  1736   NtProtectVirtualMemory  (-1, (0xe0e000), 4096, 260, ... (0xe0e000), 4096, 4, ) == 0x0
 01131  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 144, {1636, 1300}, ) == 0x0
 01132  1736   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1636,Tid=1300,}, 0x0, ) == 0x0
 01133  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75540, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75540, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0d\6\0\0\24\5\0\0" ...  ...
 01127   928   NtClose  ... ) == 0x0
 01134   748   NtWaitForSingleObject  (128, 0, 0x0, ...
 01135   928   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 01136   928   NtClose  (140, ... ) == 0x0
 01137   928   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01138   928   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01139   928   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01140   928   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 01133  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75541, 0}  ... {28, 56, reply, 0, 1636, 1736, 75541, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0d\6\0\0\24\5\0\0" )  ) == 0x0
 01141  1736   NtResumeThread  (144, ... 1, ) == 0x0
 01142  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14745600, 1048576, ) == 0x0
 01143  1736   NtAllocateVirtualMemory  (-1, 15785984, 0, 8192, 4096, 4, ... 15785984, 8192, ) == 0x0
 01144  1736   NtProtectVirtualMemory  (-1, (0xf0e000), 4096, 260, ... (0xf0e000), 4096, 4, ) == 0x0
 01145  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 140, {1636, 1096}, ) == 0x0
 01140   928   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 01146  1300   NtWaitForSingleObject  (128, 0, 0x0, ...
 01147   928   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01148   928   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01149   928   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01150   928   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01151   928   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01152   928   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... }, ...
 01153  1736   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1636,Tid=1096,}, 0x0, ) == 0x0
 01154  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75541, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75541, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0d\6\0\0H\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75542, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0d\6\0\0H\4\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75542, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75541, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0d\6\0\0H\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75542, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0d\6\0\0H\4\0\0" )  ) == 0x0
 01155  1736   NtResumeThread  (140, ... 1, ) == 0x0
 01156  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15794176, 1048576, ) == 0x0
 01157  1736   NtAllocateVirtualMemory  (-1, 16834560, 0, 8192, 4096, 4, ... 16834560, 8192, ) == 0x0
 01158  1736   NtProtectVirtualMemory  (-1, (0x100e000), 4096, 260, ...
 01152   928   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01159  1096   NtWaitForSingleObject  (128, 0, 0x0, ...
 01160   928   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01161   928   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01162   928   NtSetEventBoostPriority  (128, ...
 01110   428   NtWaitForSingleObject  ... ) == 0x0
 01163   428   NtSetEventBoostPriority  (128, ...
 01134   748   NtWaitForSingleObject  ... ) == 0x0
 01164   748   NtSetEventBoostPriority  (128, ...
 01146  1300   NtWaitForSingleObject  ... ) == 0x0
 01165  1300   NtSetEventBoostPriority  (128, ...
 01159  1096   NtWaitForSingleObject  ... ) == 0x0
 01166  1096   NtTestAlert  (... ) == 0x0
 01165  1300   NtSetEventBoostPriority  ... ) == 0x0
 01164   748   NtSetEventBoostPriority  ... ) == 0x0
 01163   428   NtSetEventBoostPriority  ... ) == 0x0
 01162   928   NtSetEventBoostPriority  ... ) == 0x0
 01158  1736   NtProtectVirtualMemory  ... (0x100e000), 4096, 4, ) == 0x0
 01167  1096   NtContinue  (15793456, 1, ...
 01168  1300   NtTestAlert  (...
 01169   748   NtTestAlert  (...
 01170   928   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01171  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01172  1096   NtRegisterThreadTerminatePort  (24, ...
 01168  1300   NtTestAlert  ... ) == 0x0
 01169   748   NtTestAlert  ... ) == 0x0
 01170   928   NtCreateEvent  ... 136, ) == 0x0
 01171  1736   NtCreateThread  ... 148, {1636, 252}, ) == 0x0
 01172  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 01173  1300   NtContinue  (14744880, 1, ...
 01174   748   NtContinue  (13696304, 1, ...
 01175   928   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 01176   428   NtTestAlert  (...
 01177  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01178  1300   NtRegisterThreadTerminatePort  (24, ...
 01179   748   NtRegisterThreadTerminatePort  (24, ...
 01175   928   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   428   NtTestAlert  ... ) == 0x0
 01177  1096   NtDuplicateObject  ... 152, ) == 0x0
 01178  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 01179   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 01180   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11596196, ... }, 11596196, ...
 01181   428   NtContinue  (12647728, 1, ...
 01182  1096   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01183  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01184   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01185  1736   NtQueryInformationThread  (148, Basic, 28, ...
 01186   428   NtRegisterThreadTerminatePort  (24, ...
 01182  1096   NtWaitForSingleObject  ... ) == 0x102
 01183  1300   NtDuplicateObject  ... 156, ) == 0x0
 01185  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1636,Tid=252,}, 0x0, ) == 0x0
 01186   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 01187  1096   NtAllocateVirtualMemory  (-1, 15781888, 0, 4096, 4096, 260, ...
 01188  1300   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01189  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75542, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75542, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0d\6\0\0\374\0\0\0" ...  ...
 01190   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01187  1096   NtAllocateVirtualMemory  ... 15781888, 4096, ) == 0x0
 01188  1300   NtWaitForSingleObject  ... ) == 0x102
 01189  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75543, 0}  ... {28, 56, reply, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0d\6\0\0\374\0\0\0" )  ) == 0x0
 01184   748   NtDuplicateObject  ... 160, ) == 0x0
 01191  1096   NtWaitForSingleObject  (128, 0, 0x0, ...
 01192  1300   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01193  1736   NtResumeThread  (148, ...
 01194   748   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01192  1300   NtCreateEvent  ... 164, ) == 0x0
 01190   428   NtDuplicateObject  ... 168, ) == 0x0
 01194   748   NtWaitForSingleObject  ... ) == 0x102
 01193  1736   NtResumeThread  ... 1, ) == 0x0
 01180   928   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01195   428   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01196   748   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01197  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01198   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11596196, ... }, 11596196, ...
 01195   428   NtWaitForSingleObject  ... ) == 0x102
 01196   748   NtCreateEvent  ... 172, ) == 0x0
 01197  1736   NtAllocateVirtualMemory  ... 16842752, 1048576, ) == 0x0
 01198   928   NtQueryAttributesFile  ... ) == 0x0
 01199   428   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01200  1300   NtWaitForSingleObject  (164, 0, 0x0, ...
 01201   252   NtWaitForSingleObject  (128, 0, 0x0, ...
 01202  1736   NtAllocateVirtualMemory  (-1, 17883136, 0, 8192, 4096, 4, ...
 01203   748   NtClose  (172, ...
 01199   428   NtCreateEvent  ... 176, ) == 0x0
 01202  1736   NtAllocateVirtualMemory  ... 17883136, 8192, ) == 0x0
 01203   748   NtClose  ... ) == 0x0
 01204   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... }, 5, 96, ...
 01205  1736   NtProtectVirtualMemory  (-1, (0x110e000), 4096, 260, ...
 01206   748   NtWaitForSingleObject  (164, 0, 0x0, ...
 01204   928   NtOpenFile  ... 172, {status=0x0, info=1}, ) == 0x0
 01207   428   NtClose  (176, ...
 01208   928   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ...
 01207   428   NtClose  ... ) == 0x0
 01208   928   NtCreateSection  ... 176, ) == 0x0
 01209   428   NtWaitForSingleObject  (164, 0, 0x0, ...
 01210   928   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01211   928   NtClose  (172, ... ) == 0x0
 01212   928   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x662b0000), 0x0, 360448, ) == 0x0
 01213   928   NtClose  (176, ... ) == 0x0
 01205  1736   NtProtectVirtualMemory  ... (0x110e000), 4096, 4, ) == 0x0
 01214  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 176, {1636, 1132}, ) == 0x0
 01215  1736   NtQueryInformationThread  (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1636,Tid=1132,}, 0x0, ) == 0x0
 01216  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75543, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0d\6\0\0l\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75544, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0d\6\0\0l\4\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75544, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75543, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0d\6\0\0l\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75544, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0d\6\0\0l\4\0\0" )  ) == 0x0
 01217  1736   NtResumeThread  (176, ... 1, ) == 0x0
 01218  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17891328, 1048576, ) == 0x0
 01219   928   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01220  1132   NtWaitForSingleObject  (128, 0, 0x0, ...
 01219   928   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01221   928   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01222   928   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01223   928   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01224   928   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01225   928   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01226  1736   NtAllocateVirtualMemory  (-1, 18931712, 0, 8192, 4096, 4, ... 18931712, 8192, ) == 0x0
 01227  1736   NtProtectVirtualMemory  (-1, (0x120e000), 4096, 260, ... (0x120e000), 4096, 4, ) == 0x0
 01228  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 172, {1636, 1024}, ) == 0x0
 01229  1736   NtQueryInformationThread  (172, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1636,Tid=1024,}, 0x0, ) == 0x0
 01230  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75544, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75544, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0d\6\0\0\0\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75545, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0d\6\0\0\0\4\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75545, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75544, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0d\6\0\0\0\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75545, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0d\6\0\0\0\4\0\0" )  ) == 0x0
 01231  1736   NtResumeThread  (172, ...
 01232   928   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01233   928   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01234   928   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01235   928   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01236   928   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01237   928   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01231  1736   NtResumeThread  ... 1, ) == 0x0
 01238  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18939904, 1048576, ) == 0x0
 01239  1736   NtAllocateVirtualMemory  (-1, 19980288, 0, 8192, 4096, 4, ... 19980288, 8192, ) == 0x0
 01240  1736   NtProtectVirtualMemory  (-1, (0x130e000), 4096, 260, ... (0x130e000), 4096, 4, ) == 0x0
 01241  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 180, {1636, 948}, ) == 0x0
 01242  1736   NtQueryInformationThread  (180, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1636,Tid=948,}, 0x0, ) == 0x0
 01243  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75545, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75545, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0d\6\0\0\264\3\0\0" ...  ...
 01244   928   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 01245  1024   NtWaitForSingleObject  (128, 0, 0x0, ...
 01244   928   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 01246   928   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01247   928   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01248   928   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01249   928   NtSetEventBoostPriority  (128, ...
 01191  1096   NtWaitForSingleObject  ... ) == 0x0
 01250  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15789008, ... ) }, 15789008, ... ) == 0x0
 01251  1096   NtSetEventBoostPriority  (128, ...
 01201   252   NtWaitForSingleObject  ... ) == 0x0
 01252   252   NtSetEventBoostPriority  (128, ...
 01220  1132   NtWaitForSingleObject  ... ) == 0x0
 01253  1132   NtSetEventBoostPriority  (128, ...
 01245  1024   NtWaitForSingleObject  ... ) == 0x0
 01254  1024   NtTestAlert  (... ) == 0x0
 01253  1132   NtSetEventBoostPriority  ... ) == 0x0
 01252   252   NtSetEventBoostPriority  ... ) == 0x0
 01251  1096   NtSetEventBoostPriority  ... ) == 0x0
 01249   928   NtSetEventBoostPriority  ... ) == 0x0
 01243  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75546, 0}  ... {28, 56, reply, 0, 1636, 1736, 75546, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0d\6\0\0\264\3\0\0" )  ) == 0x0
 01255  1024   NtContinue  (18939184, 1, ...
 01256  1132   NtTestAlert  (...
 01257  1096   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01258   928   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01259  1736   NtResumeThread  (180, ...
 01260  1024   NtRegisterThreadTerminatePort  (24, ...
 01256  1132   NtTestAlert  ... ) == 0x0
 01257  1096   NtCreateEvent  ... 184, ) == 0x0
 01258   928   NtCreateEvent  ... 188, ) == 0x0
 01259  1736   NtResumeThread  ... 1, ) == 0x0
 01260  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 01261  1132   NtContinue  (17890608, 1, ...
 01262  1096   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 01263   252   NtTestAlert  (...
 01264   948   NtWaitForSingleObject  (128, 0, 0x0, ...
 01265  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01266  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01267  1132   NtRegisterThreadTerminatePort  (24, ...
 01262  1096   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01263   252   NtTestAlert  ... ) == 0x0
 01265  1736   NtAllocateVirtualMemory  ... 19988480, 1048576, ) == 0x0
 01266  1024   NtDuplicateObject  ... 192, ) == 0x0
 01267  1132   NtRegisterThreadTerminatePort  ... ) == 0x0
 01268   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01269   252   NtContinue  (16842032, 1, ...
 01270  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 15789112, ... }, 15789112, ...
 01271  1024   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01272  1132   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01268   928   NtDuplicateObject  ... 196, ) == 0x0
 01273   252   NtRegisterThreadTerminatePort  (24, ...
 01274  1736   NtAllocateVirtualMemory  (-1, 21028864, 0, 8192, 4096, 4, ...
 01271  1024   NtWaitForSingleObject  ... ) == 0x102
 01275   928   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01273   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 01274  1736   NtAllocateVirtualMemory  ... 21028864, 8192, ) == 0x0
 01276  1024   NtWaitForSingleObject  (164, 0, 0x0, ...
 01275   928   NtOpenKey  ... 200, ) == 0x0
 01277   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01278  1736   NtProtectVirtualMemory  (-1, (0x140e000), 4096, 260, ...
 01279   928   NtQueryValueKey  (200,  (200, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01272  1132   NtDuplicateObject  ... 204, ) == 0x0
 01278  1736   NtProtectVirtualMemory  ... (0x140e000), 4096, 4, ) == 0x0
 01279   928   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01280  1132   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01281  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01277   252   NtDuplicateObject  ... 208, ) == 0x0
 01280  1132   NtWaitForSingleObject  ... ) == 0x102
 01281  1736   NtCreateThread  ... 212, {1636, 1600}, ) == 0x0
 01282   252   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01283  1132   NtWaitForSingleObject  (164, 0, 0x0, ...
 01284   928   NtClose  (200, ...
 01270  1096   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01282   252   NtWaitForSingleObject  ... ) == 0x102
 01284   928   NtClose  ... ) == 0x0
 01285  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 15789112, ... }, 15789112, ...
 01286   252   NtWaitForSingleObject  (164, 0, 0x0, ...
 01287   928   NtOpenThreadToken  (-2, 0xc, 1, ...
 01288  1736   NtQueryInformationThread  (212, Basic, 28, ...
 01287   928   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01288  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1636,Tid=1600,}, 0x0, ) == 0x0
 01289   928   NtOpenThreadToken  (-2, 0x20008, 1, ...
 01290  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75546, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75546, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0d\6\0\0@\6\0\0" ...  ...
 01289   928   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01290  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75547, 0}  ... {28, 56, reply, 0, 1636, 1736, 75547, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0d\6\0\0@\6\0\0" )  ) == 0x0
 01285  1096   NtQueryAttributesFile  ... ) == 0x0
 01291  1736   NtResumeThread  (212, ...
 01292  1096   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... }, 5, 96, ...
 01293   928   NtWaitForSingleObject  (128, 0, 0x0, ...
 01292  1096   NtOpenFile  ... 200, {status=0x0, info=1}, ) == 0x0
 01294  1096   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 200, ... 216, ) == 0x0
 01295  1096   NtQuerySection  (216, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01296  1096   NtClose  (200, ... ) == 0x0
 01297  1096   NtMapViewOfSection  (216, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 01298  1096   NtClose  (216, ...
 01291  1736   NtResumeThread  ... 1, ) == 0x0
 01299  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 21037056, 1048576, ) == 0x0
 01300  1736   NtAllocateVirtualMemory  (-1, 22077440, 0, 8192, 4096, 4, ... 22077440, 8192, ) == 0x0
 01301  1736   NtProtectVirtualMemory  (-1, (0x150e000), 4096, 260, ... (0x150e000), 4096, 4, ) == 0x0
 01302  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 200, {1636, 1372}, ) == 0x0
 01303  1736   NtQueryInformationThread  (200, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1636,Tid=1372,}, 0x0, ) == 0x0
 01304  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75547, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75547, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0d\6\0\0\\5\0\0" ...  ...
 01298  1096   NtClose  ... ) == 0x0
 01305  1600   NtWaitForSingleObject  (128, 0, 0x0, ...
 01306  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01307  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01308  1096   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01309  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01310  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01311  1096   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01304  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75548, 0}  ... {28, 56, reply, 0, 1636, 1736, 75548, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0d\6\0\0\\5\0\0" )  ) == 0x0
 01312  1736   NtResumeThread  (200, ... 1, ) == 0x0
 01313  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22085632, 1048576, ) == 0x0
 01314  1736   NtAllocateVirtualMemory  (-1, 23126016, 0, 8192, 4096, 4, ... 23126016, 8192, ) == 0x0
 01315  1736   NtProtectVirtualMemory  (-1, (0x160e000), 4096, 260, ... (0x160e000), 4096, 4, ) == 0x0
 01316  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 216, {1636, 2040}, ) == 0x0
 01311  1096   NtFlushInstructionCache  ... ) == 0x0
 01317  1372   NtWaitForSingleObject  (128, 0, 0x0, ...
 01318  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01319  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01320  1096   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01321  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01322  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01323  1096   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01324  1736   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1636,Tid=2040,}, 0x0, ) == 0x0
 01325  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75548, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75548, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0d\6\0\0\370\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75549, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0d\6\0\0\370\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75549, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75548, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0d\6\0\0\370\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75549, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0d\6\0\0\370\7\0\0" )  ) == 0x0
 01326  1736   NtResumeThread  (216, ... 1, ) == 0x0
 01327  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 23134208, 1048576, ) == 0x0
 01328  1736   NtAllocateVirtualMemory  (-1, 24174592, 0, 8192, 4096, 4, ... 24174592, 8192, ) == 0x0
 01329  1736   NtProtectVirtualMemory  (-1, (0x170e000), 4096, 260, ...
 01323  1096   NtFlushInstructionCache  ... ) == 0x0
 01330  2040   NtWaitForSingleObject  (128, 0, 0x0, ...
 01331  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01332  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01333  1096   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01334  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01335  1096   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01336  1096   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 01329  1736   NtProtectVirtualMemory  ... (0x170e000), 4096, 4, ) == 0x0
 01337  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 220, {1636, 216}, ) == 0x0
 01338  1736   NtQueryInformationThread  (220, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1636,Tid=216,}, 0x0, ) == 0x0
 01339  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75549, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75549, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0d\6\0\0\330\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75550, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0d\6\0\0\330\0\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75550, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75549, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0d\6\0\0\330\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75550, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0d\6\0\0\330\0\0\0" )  ) == 0x0
 01340  1736   NtResumeThread  (220, ... 1, ) == 0x0
 01341  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24182784, 1048576, ) == 0x0
 01336  1096   NtFlushInstructionCache  ... ) == 0x0
 01342   216   NtWaitForSingleObject  (128, 0, 0x0, ...
 01343  1096   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01344  1096   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 224, 2, ) }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 224, 2, ) , 0, ... 224, 2, ) == 0x0
 01345  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 228, ) }, ... 228, ) == 0x0
 01346  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01347  1096   NtQueryValueKey  (228,  (228, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01348  1096   NtQueryValueKey  (224,  (224, "DisableAdapterDomainName", Partial, 144, ... , Partial, 144, ...
 01349  1736   NtAllocateVirtualMemory  (-1, 25223168, 0, 8192, 4096, 4, ... 25223168, 8192, ) == 0x0
 01350  1736   NtProtectVirtualMemory  (-1, (0x180e000), 4096, 260, ... (0x180e000), 4096, 4, ) == 0x0
 01351  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 232, {1636, 152}, ) == 0x0
 01352  1736   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1636,Tid=152,}, 0x0, ) == 0x0
 01353  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75550, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75550, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0d\6\0\0\230\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75551, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0d\6\0\0\230\0\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75551, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75550, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0d\6\0\0\230\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75551, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0d\6\0\0\230\0\0\0" )  ) == 0x0
 01354  1736   NtResumeThread  (232, ...
 01348  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01355  1096   NtQueryValueKey  (228,  (228, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01356  1096   NtQueryValueKey  (224,  (224, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (224, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01357  1096   NtQueryValueKey  (228,  (228, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01358  1096   NtQueryValueKey  (224,  (224, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01359  1096   NtQueryValueKey  (228,  (228, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01360  1096   NtQueryValueKey  (224,  (224, "AllowUnqualifiedQuery", Partial, 144, ... , Partial, 144, ...
 01354  1736   NtResumeThread  ... 1, ) == 0x0
 01361  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25231360, 1048576, ) == 0x0
 01362  1736   NtAllocateVirtualMemory  (-1, 26271744, 0, 8192, 4096, 4, ... 26271744, 8192, ) == 0x0
 01363  1736   NtProtectVirtualMemory  (-1, (0x190e000), 4096, 260, ... (0x190e000), 4096, 4, ) == 0x0
 01364  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 236, {1636, 900}, ) == 0x0
 01365  1736   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1636,Tid=900,}, 0x0, ) == 0x0
 01366  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75551, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75551, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0d\6\0\0\204\3\0\0" ...  ...
 01360  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01367   152   NtWaitForSingleObject  (128, 0, 0x0, ...
 01368  1096   NtQueryValueKey  (228,  (228, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01369  1096   NtQueryValueKey  (228,  (228, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01370  1096   NtQueryValueKey  (228,  (228, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01371  1096   NtQueryValueKey  (228,  (228, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01372  1096   NtQueryValueKey  (228,  (228, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01373  1096   NtQueryValueKey  (228,  (228, "UseEdns", Partial, 144, ... , Partial, 144, ...
 01366  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75552, 0}  ... {28, 56, reply, 0, 1636, 1736, 75552, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0d\6\0\0\204\3\0\0" )  ) == 0x0
 01374  1736   NtResumeThread  (236, ... 1, ) == 0x0
 01375  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26279936, 1048576, ) == 0x0
 01376  1736   NtAllocateVirtualMemory  (-1, 27320320, 0, 8192, 4096, 4, ... 27320320, 8192, ) == 0x0
 01377  1736   NtProtectVirtualMemory  (-1, (0x1a0e000), 4096, 260, ... (0x1a0e000), 4096, 4, ) == 0x0
 01378  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 240, {1636, 1388}, ) == 0x0
 01373  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01379   900   NtWaitForSingleObject  (128, 0, 0x0, ...
 01380  1096   NtQueryValueKey  (228,  (228, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01381  1096   NtQueryValueKey  (228,  (228, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01382  1096   NtQueryValueKey  (228,  (228, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01383  1096   NtQueryValueKey  (224,  (224, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01384  1096   NtQueryValueKey  (228,  (228, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01385  1096   NtQueryValueKey  (228,  (228, "RegisterAdapterName", Partial, 144, ... , Partial, 144, ...
 01386  1736   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1636,Tid=1388,}, 0x0, ) == 0x0
 01387  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75552, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75552, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0d\6\0\0l\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75553, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0d\6\0\0l\5\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75553, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75552, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0d\6\0\0l\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75553, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0d\6\0\0l\5\0\0" )  ) == 0x0
 01388  1736   NtResumeThread  (240, ... 1, ) == 0x0
 01389  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27328512, 1048576, ) == 0x0
 01390  1736   NtAllocateVirtualMemory  (-1, 28368896, 0, 8192, 4096, 4, ... 28368896, 8192, ) == 0x0
 01391  1736   NtProtectVirtualMemory  (-1, (0x1b0e000), 4096, 260, ...
 01385  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392  1388   NtWaitForSingleObject  (128, 0, 0x0, ...
 01393  1096   NtQueryValueKey  (224,  (224, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01394  1096   NtQueryValueKey  (228,  (228, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01395  1096   NtQueryValueKey  (224,  (224, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01396  1096   NtQueryValueKey  (228,  (228, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01397  1096   NtQueryValueKey  (224,  (224, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01398  1096   NtQueryValueKey  (228,  (228, "RegistrationTtl", Partial, 144, ... , Partial, 144, ...
 01391  1736   NtProtectVirtualMemory  ... (0x1b0e000), 4096, 4, ) == 0x0
 01399  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 244, {1636, 2036}, ) == 0x0
 01400  1736   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1636,Tid=2036,}, 0x0, ) == 0x0
 01401  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75553, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75553, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0d\6\0\0\364\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75554, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0d\6\0\0\364\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75554, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75553, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0d\6\0\0\364\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75554, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0d\6\0\0\364\7\0\0" )  ) == 0x0
 01402  1736   NtResumeThread  (244, ... 1, ) == 0x0
 01403  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28377088, 1048576, ) == 0x0
 01398  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01404  2036   NtWaitForSingleObject  (128, 0, 0x0, ...
 01405  1096   NtQueryValueKey  (224,  (224, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01406  1096   NtQueryValueKey  (228,  (228, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01407  1096   NtQueryValueKey  (224,  (224, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01408  1096   NtQueryValueKey  (228,  (228, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01409  1096   NtQueryValueKey  (224,  (224, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01410  1096   NtQueryValueKey  (228,  (228, "UpdateSecurityLevel", Partial, 144, ... , Partial, 144, ...
 01411  1736   NtAllocateVirtualMemory  (-1, 29417472, 0, 8192, 4096, 4, ... 29417472, 8192, ) == 0x0
 01412  1736   NtProtectVirtualMemory  (-1, (0x1c0e000), 4096, 260, ... (0x1c0e000), 4096, 4, ) == 0x0
 01413  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 248, {1636, 1708}, ) == 0x0
 01414  1736   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1636,Tid=1708,}, 0x0, ) == 0x0
 01415  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75554, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75554, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0d\6\0\0\254\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75555, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0d\6\0\0\254\6\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75555, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75554, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0d\6\0\0\254\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75555, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0d\6\0\0\254\6\0\0" )  ) == 0x0
 01416  1736   NtResumeThread  (248, ...
 01410  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01417  1096   NtQueryValueKey  (224,  (224, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01418  1096   NtQueryValueKey  (228,  (228, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01419  1096   NtQueryValueKey  (228,  (228, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01420  1096   NtQueryValueKey  (228,  (228, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01421  1096   NtQueryValueKey  (228,  (228, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01422  1096   NtQueryValueKey  (228,  (228, "MaxCacheTtl", Partial, 144, ... , Partial, 144, ...
 01416  1736   NtResumeThread  ... 1, ) == 0x0
 01423  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29425664, 1048576, ) == 0x0
 01424  1736   NtAllocateVirtualMemory  (-1, 30466048, 0, 8192, 4096, 4, ... 30466048, 8192, ) == 0x0
 01425  1736   NtProtectVirtualMemory  (-1, (0x1d0e000), 4096, 260, ... (0x1d0e000), 4096, 4, ) == 0x0
 01426  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 252, {1636, 1776}, ) == 0x0
 01427  1736   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1636,Tid=1776,}, 0x0, ) == 0x0
 01428  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75555, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75555, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0d\6\0\0\360\6\0\0" ...  ...
 01422  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01429  1708   NtWaitForSingleObject  (128, 0, 0x0, ...
 01430  1096   NtQueryValueKey  (228,  (228, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01431  1096   NtQueryValueKey  (228,  (228, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01432  1096   NtQueryValueKey  (228,  (228, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01433  1096   NtQueryValueKey  (228,  (228, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01434  1096   NtQueryValueKey  (228,  (228, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01435  1096   NtQueryValueKey  (228,  (228, "MulticastSendLevel", Partial, 144, ... , Partial, 144, ...
 01428  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75556, 0}  ... {28, 56, reply, 0, 1636, 1736, 75556, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0d\6\0\0\360\6\0\0" )  ) == 0x0
 01436  1736   NtResumeThread  (252, ... 1, ) == 0x0
 01437  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 30474240, 1048576, ) == 0x0
 01438  1736   NtAllocateVirtualMemory  (-1, 31514624, 0, 8192, 4096, 4, ... 31514624, 8192, ) == 0x0
 01439  1736   NtProtectVirtualMemory  (-1, (0x1e0e000), 4096, 260, ... (0x1e0e000), 4096, 4, ) == 0x0
 01440  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 256, {1636, 1324}, ) == 0x0
 01435  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01441  1776   NtWaitForSingleObject  (128, 0, 0x0, ...
 01442  1096   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\Setup"}, ... 260, ) }, ... 260, ) == 0x0
 01443  1096   NtQueryValueKey  (260,  (260, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (260, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01444  1096   NtClose  (260, ... ) == 0x0
 01445  1096   NtClose  (224, ... ) == 0x0
 01446  1096   NtClose  (228, ... ) == 0x0
 01447  1096   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 01448  1736   NtQueryInformationThread  (256, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1636,Tid=1324,}, 0x0, ) == 0x0
 01449  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75556, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75556, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0d\6\0\0,\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75557, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0d\6\0\0,\5\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75557, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75556, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0d\6\0\0,\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75557, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0d\6\0\0,\5\0\0" )  ) == 0x0
 01450  1736   NtResumeThread  (256, ... 1, ) == 0x0
 01451  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31522816, 1048576, ) == 0x0
 01452  1736   NtAllocateVirtualMemory  (-1, 32563200, 0, 8192, 4096, 4, ... 32563200, 8192, ) == 0x0
 01453  1736   NtProtectVirtualMemory  (-1, (0x1f0e000), 4096, 260, ...
 01447  1096   NtOpenKey  ... 228, ) == 0x0
 01454  1324   NtWaitForSingleObject  (128, 0, 0x0, ...
 01455  1096   NtQueryValueKey  (228,  (228, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01456  1096   NtQueryValueKey  (228,  (228, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01457  1096   NtQueryValueKey  (228,  (228, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01458  1096   NtClose  (228, ... ) == 0x0
 01459  1096   NtSetEventBoostPriority  (128, ...
 01264   948   NtWaitForSingleObject  ... ) == 0x0
 01460   948   NtSetEventBoostPriority  (128, ...
 01293   928   NtWaitForSingleObject  ... ) == 0x0
 01461   928   NtSetEventBoostPriority  (128, ...
 01305  1600   NtWaitForSingleObject  ... ) == 0x0
 01462  1600   NtSetEventBoostPriority  (128, ...
 01317  1372   NtWaitForSingleObject  ... ) == 0x0
 01463  1372   NtSetEventBoostPriority  (128, ...
 01330  2040   NtWaitForSingleObject  ... ) == 0x0
 01464  2040   NtSetEventBoostPriority  (128, ...
 01342   216   NtWaitForSingleObject  ... ) == 0x0
 01465   216   NtSetEventBoostPriority  (128, ...
 01367   152   NtWaitForSingleObject  ... ) == 0x0
 01466   152   NtSetEventBoostPriority  (128, ...
 01379   900   NtWaitForSingleObject  ... ) == 0x0
 01467   900   NtSetEventBoostPriority  (128, ...
 01392  1388   NtWaitForSingleObject  ... ) == 0x0
 01468  1388   NtSetEventBoostPriority  (128, ...
 01404  2036   NtWaitForSingleObject  ... ) == 0x0
 01469  2036   NtSetEventBoostPriority  (128, ...
 01429  1708   NtWaitForSingleObject  ... ) == 0x0
 01470  1708   NtSetEventBoostPriority  (128, ...
 01441  1776   NtWaitForSingleObject  ... ) == 0x0
 01471  1776   NtSetEventBoostPriority  (128, ...
 01454  1324   NtWaitForSingleObject  ... ) == 0x0
 01472  1324   NtTestAlert  (... ) == 0x0
 01471  1776   NtSetEventBoostPriority  ... ) == 0x0
 01470  1708   NtSetEventBoostPriority  ... ) == 0x0
 01469  2036   NtSetEventBoostPriority  ... ) == 0x0
 01468  1388   NtSetEventBoostPriority  ... ) == 0x0
 01467   900   NtSetEventBoostPriority  ... ) == 0x0
 01466   152   NtSetEventBoostPriority  ... ) == 0x0
 01465   216   NtSetEventBoostPriority  ... ) == 0x0
 01464  2040   NtSetEventBoostPriority  ... ) == 0x0
 01463  1372   NtSetEventBoostPriority  ... ) == 0x0
 01462  1600   NtSetEventBoostPriority  ... ) == 0x0
 01461   928   NtSetEventBoostPriority  ... ) == 0x0
 01460   948   NtSetEventBoostPriority  ... ) == 0x0
 01459  1096   NtSetEventBoostPriority  ... ) == 0x0
 01453  1736   NtProtectVirtualMemory  ... (0x1f0e000), 4096, 4, ) == 0x0
 01473  1324   NtContinue  (31522096, 1, ...
 01474  1776   NtTestAlert  (...
 01475  1708   NtTestAlert  (...
 01476  2036   NtTestAlert  (...
 01477  1388   NtTestAlert  (...
 01478   900   NtTestAlert  (...
 01479   152   NtTestAlert  (...
 01480   216   NtTestAlert  (...
 01481  2040   NtTestAlert  (...
 01482  1372   NtTestAlert  (...
 01483   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11595888, ... }, 11595888, ...
 01484  1600   NtTestAlert  (...
 01485  1096   NtWaitForSingleObject  (128, 0, 0x0, ...
 01486  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01487  1324   NtRegisterThreadTerminatePort  (24, ...
 01474  1776   NtTestAlert  ... ) == 0x0
 01475  1708   NtTestAlert  ... ) == 0x0
 01476  2036   NtTestAlert  ... ) == 0x0
 01477  1388   NtTestAlert  ... ) == 0x0
 01478   900   NtTestAlert  ... ) == 0x0
 01479   152   NtTestAlert  ... ) == 0x0
 01480   216   NtTestAlert  ... ) == 0x0
 01481  2040   NtTestAlert  ... ) == 0x0
 01482  1372   NtTestAlert  ... ) == 0x0
 01488   948   NtTestAlert  (...
 01484  1600   NtTestAlert  ... ) == 0x0
 01483   928   NtQueryAttributesFile  ... ) == 0x0
 01486  1736   NtCreateThread  ... 228, {1636, 1652}, ) == 0x0
 01487  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 01489  1776   NtContinue  (30473520, 1, ...
 01490  1708   NtContinue  (29424944, 1, ...
 01491  2036   NtContinue  (28376368, 1, ...
 01492  1388   NtContinue  (27327792, 1, ...
 01493   900   NtContinue  (26279216, 1, ...
 01494   152   NtContinue  (25230640, 1, ...
 01495   216   NtContinue  (24182064, 1, ...
 01496  2040   NtContinue  (23133488, 1, ...
 01497  1372   NtContinue  (22084912, 1, ...
 01488   948   NtTestAlert  ... ) == 0x0
 01498  1600   NtContinue  (21036336, 1, ...
 01499   928   NtSetEventBoostPriority  (128, ...
 01500  1736   NtQueryInformationThread  (228, Basic, 28, ...
 01501  1324   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01502  1776   NtRegisterThreadTerminatePort  (24, ...
 01503  1708   NtRegisterThreadTerminatePort  (24, ...
 01504  2036   NtRegisterThreadTerminatePort  (24, ...
 01505  1388   NtRegisterThreadTerminatePort  (24, ...
 01506   900   NtRegisterThreadTerminatePort  (24, ...
 01507   152   NtRegisterThreadTerminatePort  (24, ...
 01508   216   NtRegisterThreadTerminatePort  (24, ...
 01509  2040   NtRegisterThreadTerminatePort  (24, ...
 01510  1372   NtRegisterThreadTerminatePort  (24, ...
 01511   948   NtContinue  (19987760, 1, ...
 01512  1600   NtRegisterThreadTerminatePort  (24, ...
 01499   928   NtSetEventBoostPriority  ... ) == 0x0
 01500  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1636,Tid=1652,}, 0x0, ) == 0x0
 01501  1324   NtDuplicateObject  ... 224, ) == 0x0
 01502  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 01503  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 01504  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01505  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 01506   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 01507   152   NtRegisterThreadTerminatePort  ... ) == 0x0
 01508   216   NtRegisterThreadTerminatePort  ... ) == 0x0
 01509  2040   NtRegisterThreadTerminatePort  ... ) == 0x0
 01510  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 01513   948   NtRegisterThreadTerminatePort  (24, ...
 01512  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 01514   928   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01515  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75557, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75557, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0d\6\0\0t\6\0\0" ...  ...
 01516  1324   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01517  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01518  1708   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01519  2036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01520  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01521   900   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01522   152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01523   216   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01524  2040   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01525  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01513   948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01526  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01514   928   NtOpenKey  ... 260, ) == 0x0
 01485  1096   NtWaitForSingleObject  ... ) == 0x0
 01515  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75558, 0}  ... {28, 56, reply, 0, 1636, 1736, 75558, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0d\6\0\0t\6\0\0" )  ) == 0x0
 01516  1324   NtWaitForSingleObject  ... ) == 0x102
 01517  1776   NtDuplicateObject  ... 264, ) == 0x0
 01518  1708   NtDuplicateObject  ... 268, ) == 0x0
 01519  2036   NtDuplicateObject  ... 272, ) == 0x0
 01520  1388   NtDuplicateObject  ... 276, ) == 0x0
 01521   900   NtDuplicateObject  ... 280, ) == 0x0
 01522   152   NtDuplicateObject  ... 284, ) == 0x0
 01523   216   NtDuplicateObject  ... 288, ) == 0x0
 01524  2040   NtDuplicateObject  ... 292, ) == 0x0
 01527   948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01525  1372   NtDuplicateObject  ... 296, ) == 0x0
 01528   928   NtQueryValueKey  (260,  (260, "Transports", Partial, 144, ... , Partial, 144, ...
 01529  1096   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01530  1736   NtResumeThread  (228, ...
 01531  1324   NtWaitForSingleObject  (164, 0, 0x0, ...
 01532  1776   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01533  1708   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01534  2036   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01535  1388   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01536   900   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01537   152   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01538   216   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01539  2040   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01526  1600   NtDuplicateObject  ... 300, ) == 0x0
 01540  1372   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01527   948   NtDuplicateObject  ... 304, ) == 0x0
 01529  1096   NtCreateEvent  ... 308, ) == 0x0
 01530  1736   NtResumeThread  ... 1, ) == 0x0
 01532  1776   NtWaitForSingleObject  ... ) == 0x102
 01533  1708   NtWaitForSingleObject  ... ) == 0x102
 01534  2036   NtWaitForSingleObject  ... ) == 0x102
 01535  1388   NtWaitForSingleObject  ... ) == 0x102
 01536   900   NtWaitForSingleObject  ... ) == 0x102
 01537   152   NtWaitForSingleObject  ... ) == 0x102
 01538   216   NtWaitForSingleObject  ... ) == 0x102
 01539  2040   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01541  1600   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01540  1372   NtCreateEvent  ... 312, ) == 0x0
 01542   948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01543  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01544  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01545  1776   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01546  1708   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01547  2036   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01548  1388   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01549   900   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01550   152   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01551   216   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01552  2040   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01541  1600   NtCreateEvent  ... 316, ) == 0x0
 01553  1372   NtWaitForSingleObject  (312, 0, 0x0, ...
 01542   948   NtCreateEvent  ... 320, ) == 0x0
 01543  1096   NtDuplicateObject  ... 324, ) == 0x0
 01544  1736   NtAllocateVirtualMemory  ... 32571392, 1048576, ) == 0x0
 01545  1776   NtCreateEvent  ... 328, ) == 0x0
 01546  1708   NtCreateEvent  ... 332, ) == 0x0
 01547  2036   NtCreateEvent  ... 336, ) == 0x0
 01548  1388   NtCreateEvent  ... 340, ) == 0x0
 01549   900   NtCreateEvent  ... 344, ) == 0x0
 01550   152   NtCreateEvent  ... 348, ) == 0x0
 01551   216   NtCreateEvent  ... 352, ) == 0x0
 01552  2040   NtCreateEvent  ... 356, ) == 0x0
 01554  1600   NtClose  (316, ...
 01555   948   NtClose  (320, ...
 01528   928   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01556  1652   NtTestAlert  (...
 01557  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 01558  1736   NtAllocateVirtualMemory  (-1, 33611776, 0, 8192, 4096, 4, ...
 01559  1776   NtClose  (328, ...
 01560  1708   NtClose  (332, ...
 01561  2036   NtClose  (336, ...
 01562  1388   NtClose  (340, ...
 01563   900   NtClose  (344, ...
 01564   152   NtClose  (348, ...
 01565  2040   NtClose  (356, ...
 01554  1600   NtClose  ... ) == 0x0
 01555   948   NtClose  ... ) == 0x0
 01566   928   NtQueryValueKey  (260,  (260, "Transports", Partial, 144, ... , Partial, 144, ...
 01556  1652   NtTestAlert  ... ) == 0x0
 01558  1736   NtAllocateVirtualMemory  ... 33611776, 8192, ) == 0x0
 01559  1776   NtClose  ... ) == 0x0
 01560  1708   NtClose  ... ) == 0x0
 01561  2036   NtClose  ... ) == 0x0
 01562  1388   NtClose  ... ) == 0x0
 01563   900   NtClose  ... ) == 0x0
 01564   152   NtClose  ... ) == 0x0
 01567   216   NtClose  (352, ...
 01568  1600   NtWaitForSingleObject  (312, 0, 0x0, ...
 01569   948   NtWaitForSingleObject  (312, 0, 0x0, ...
 01566   928   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01570  1652   NtContinue  (32570672, 1, ...
 01571  1736   NtProtectVirtualMemory  (-1, (0x200e000), 4096, 260, ...
 01572  1776   NtWaitForSingleObject  (312, 0, 0x0, ...
 01573  1708   NtWaitForSingleObject  (312, 0, 0x0, ...
 01574  2036   NtWaitForSingleObject  (312, 0, 0x0, ...
 01575  1388   NtWaitForSingleObject  (312, 0, 0x0, ...
 01576   900   NtWaitForSingleObject  (312, 0, 0x0, ...
 01577   152   NtWaitForSingleObject  (312, 0, 0x0, ...
 01567   216   NtClose  ... ) == 0x0
 01565  2040   NtClose  ... ) == 0x0
 01578   928   NtClose  (260, ...
 01579  1652   NtRegisterThreadTerminatePort  (24, ...
 01571  1736   NtProtectVirtualMemory  ... (0x200e000), 4096, 4, ) == 0x0
 01580   216   NtWaitForSingleObject  (312, 0, 0x0, ...
 01581  2040   NtSetEventBoostPriority  (312, ...
 01578   928   NtClose  ... ) == 0x0
 01579  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 01582  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01553  1372   NtWaitForSingleObject  ... ) == 0x0
 01581  2040   NtSetEventBoostPriority  ... ) == 0x0
 01583   928   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01584  1372   NtSetEventBoostPriority  (312, ...
 01582  1736   NtCreateThread  ... 260, {1636, 588}, ) == 0x0
 01585  2040   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01586  1652   NtWaitForSingleObject  (312, 0, 0x0, ...
 01557  1096   NtWaitForSingleObject  ... ) == 0x0
 01584  1372   NtSetEventBoostPriority  ... ) == 0x0
 01583   928   NtOpenKey  ... 356, ) == 0x0
 01585  2040   NtWaitForSingleObject  ... ) == 0x102
 01587  1096   NtSetEventBoostPriority  (312, ...
 01588  1736   NtQueryInformationThread  (260, Basic, 28, ...
 01589   928   NtQueryValueKey  (356,  (356, "Mapping", Partial, 144, ... , Partial, 144, ...
 01590  1372   NtWaitForSingleObject  (312, 0, 0x0, ...
 01568  1600   NtWaitForSingleObject  ... ) == 0x0
 01587  1096   NtSetEventBoostPriority  ... ) == 0x0
 01588  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1636,Tid=588,}, 0x0, ) == 0x0
 01589   928   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01591  1600   NtSetEventBoostPriority  (312, ...
 01592  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 01593  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75558, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75558, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0d\6\0\0L\2\0\0" ...  ...
 01572  1776   NtWaitForSingleObject  ... ) == 0x0
 01594   928   NtWaitForSingleObject  (312, 0, 0x0, ...
 01591  1600   NtSetEventBoostPriority  ... ) == 0x0
 01595  2040   NtWaitForSingleObject  (164, 0, 0x0, ...
 01593  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75559, 0}  ... {28, 56, reply, 0, 1636, 1736, 75559, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0d\6\0\0L\2\0\0" )  ) == 0x0
 01596  1776   NtSetEventBoostPriority  (312, ...
 01597  1600   NtWaitForSingleObject  (312, 0, 0x0, ...
 01598  1736   NtResumeThread  (260, ...
 01573  1708   NtWaitForSingleObject  ... ) == 0x0
 01596  1776   NtSetEventBoostPriority  ... ) == 0x0
 01599  1708   NtSetEventBoostPriority  (312, ...
 01598  1736   NtResumeThread  ... 1, ) == 0x0
 01574  2036   NtWaitForSingleObject  ... ) == 0x0
 01599  1708   NtSetEventBoostPriority  ... ) == 0x0
 01600  2036   NtSetEventBoostPriority  (312, ...
 01601  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01602  1776   NtWaitForSingleObject  (164, 0, 0x0, ...
 01603   588   NtTestAlert  (...
 01575  1388   NtWaitForSingleObject  ... ) == 0x0
 01600  2036   NtSetEventBoostPriority  ... ) == 0x0
 01601  1736   NtAllocateVirtualMemory  ... 33619968, 1048576, ) == 0x0
 01604  1388   NtSetEventBoostPriority  (312, ...
 01603   588   NtTestAlert  ... ) == 0x0
 01605  1708   NtWaitForSingleObject  (164, 0, 0x0, ...
 01576   900   NtWaitForSingleObject  ... ) == 0x0
 01604  1388   NtSetEventBoostPriority  ... ) == 0x0
 01606  1736   NtAllocateVirtualMemory  (-1, 34660352, 0, 8192, 4096, 4, ...
 01607   588   NtContinue  (33619248, 1, ...
 01608   900   NtSetEventBoostPriority  (312, ...
 01609  2036   NtWaitForSingleObject  (164, 0, 0x0, ...
 01606  1736   NtAllocateVirtualMemory  ... 34660352, 8192, ) == 0x0
 01577   152   NtWaitForSingleObject  ... ) == 0x0
 01608   900   NtSetEventBoostPriority  ... ) == 0x0
 01610   588   NtRegisterThreadTerminatePort  (24, ...
 01611   152   NtSetEventBoostPriority  (312, ...
 01612  1736   NtProtectVirtualMemory  (-1, (0x210e000), 4096, 260, ...
 01613  1388   NtWaitForSingleObject  (164, 0, 0x0, ...
 01580   216   NtWaitForSingleObject  ... ) == 0x0
 01611   152   NtSetEventBoostPriority  ... ) == 0x0
 01610   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01614   900   NtWaitForSingleObject  (164, 0, 0x0, ...
 01615   216   NtSetEventBoostPriority  (312, ...
 01612  1736   NtProtectVirtualMemory  ... (0x210e000), 4096, 4, ) == 0x0
 01616   152   NtWaitForSingleObject  (164, 0, 0x0, ...
 01569   948   NtWaitForSingleObject  ... ) == 0x0
 01615   216   NtSetEventBoostPriority  ... ) == 0x0
 01617  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01618   948   NtSetEventBoostPriority  (312, ...
 01619   588   NtWaitForSingleObject  (312, 0, 0x0, ...
 01586  1652   NtWaitForSingleObject  ... ) == 0x0
 01617  1736   NtCreateThread  ... 352, {1636, 1296}, ) == 0x0
 01620  1652   NtSetEventBoostPriority  (312, ...
 01621  1736   NtQueryInformationThread  (352, Basic, 28, ...
 01590  1372   NtWaitForSingleObject  ... ) == 0x0
 01620  1652   NtSetEventBoostPriority  ... ) == 0x0
 01622  1372   NtSetEventBoostPriority  (312, ...
 01621  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1636,Tid=1296,}, 0x0, ) == 0x0
 01594   928   NtWaitForSingleObject  ... ) == 0x0
 01622  1372   NtSetEventBoostPriority  ... ) == 0x0
 01623  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01624   928   NtSetEventBoostPriority  (312, ...
 01625  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75559, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75559, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0d\6\0\0\20\5\0\0" ...  ...
 01626  1372   NtWaitForSingleObject  (312, 0, 0x0, ...
 01618   948   NtSetEventBoostPriority  ... ) == 0x0
 01627   216   NtWaitForSingleObject  (164, 0, 0x0, ...
 01597  1600   NtWaitForSingleObject  ... ) == 0x0
 01624   928   NtSetEventBoostPriority  ... ) == 0x0
 01623  1652   NtDuplicateObject  ... 348, ) == 0x0
 01625  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75560, 0}  ... {28, 56, reply, 0, 1636, 1736, 75560, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\1\0\0d\6\0\0\20\5\0\0" )  ) == 0x0
 01628   948   NtWaitForSingleObject  (312, 0, 0x0, ...
 01629  1600   NtSetEventBoostPriority  (312, ...
 01630  1652   NtWaitForSingleObject  (312, 0, 0x0, ...
 01631  1736   NtResumeThread  (352, ...
 01592  1096   NtWaitForSingleObject  ... ) == 0x0
 01629  1600   NtSetEventBoostPriority  ... ) == 0x0
 01632  1096   NtSetEventBoostPriority  (312, ...
 01631  1736   NtResumeThread  ... 1, ) == 0x0
 01633   928   NtQueryValueKey  (356,  (356, "Mapping", Partial, 144, ... , Partial, 144, ...
 01619   588   NtWaitForSingleObject  ... ) == 0x0
 01634  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01633   928   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01635   588   NtSetEventBoostPriority  (312, ...
 01634  1736   NtAllocateVirtualMemory  ... 34668544, 1048576, ) == 0x0
 01636   928   NtWaitForSingleObject  (312, 0, 0x0, ...
 01626  1372   NtWaitForSingleObject  ... ) == 0x0
 01635   588   NtSetEventBoostPriority  ... ) == 0x0
 01632  1096   NtSetEventBoostPriority  ... ) == 0x0
 01637  1600   NtWaitForSingleObject  (312, 0, 0x0, ...
 01638  1296   NtTestAlert  (...
 01639  1372   NtSetEventBoostPriority  (312, ...
 01640   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01641  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 01628   948   NtWaitForSingleObject  ... ) == 0x0
 01638  1296   NtTestAlert  ... ) == 0x0
 01639  1372   NtSetEventBoostPriority  ... ) == 0x0
 01642  1736   NtAllocateVirtualMemory  (-1, 35708928, 0, 8192, 4096, 4, ...
 01643   948   NtSetEventBoostPriority  (312, ...
 01644  1296   NtContinue  (34667824, 1, ...
 01645  1372   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01642  1736   NtAllocateVirtualMemory  ... 35708928, 8192, ) == 0x0
 01630  1652   NtWaitForSingleObject  ... ) == 0x0
 01643   948   NtSetEventBoostPriority  ... ) == 0x0
 01646  1296   NtRegisterThreadTerminatePort  (24, ...
 01647  1652   NtSetEventBoostPriority  (312, ...
 01648  1736   NtProtectVirtualMemory  (-1, (0x220e000), 4096, 260, ...
 01640   588   NtDuplicateObject  ... 344, ) == 0x0
 01645  1372   NtWaitForSingleObject  ... ) == 0x102
 01636   928   NtWaitForSingleObject  ... ) == 0x0
 01647  1652   NtSetEventBoostPriority  ... ) == 0x0
 01646  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 01648  1736   NtProtectVirtualMemory  ... (0x220e000), 4096, 4, ) == 0x0
 01649   588   NtWaitForSingleObject  (312, 0, 0x0, ...
 01650   928   NtSetEventBoostPriority  (312, ...
 01651  1372   NtWaitForSingleObject  (164, 0, 0x0, ...
 01652   948   NtWaitForSingleObject  (312, 0, 0x0, ...
 01653  1652   NtWaitForSingleObject  (312, 0, 0x0, ...
 01654  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01637  1600   NtWaitForSingleObject  ... ) == 0x0
 01650   928   NtSetEventBoostPriority  ... ) == 0x0
 01655  1600   NtSetEventBoostPriority  (312, ...
 01654  1736   NtCreateThread  ... 340, {1636, 1620}, ) == 0x0
 01656  1296   NtWaitForSingleObject  (312, 0, 0x0, ...
 01641  1096   NtWaitForSingleObject  ... ) == 0x0
 01655  1600   NtSetEventBoostPriority  ... ) == 0x0
 01657   928   NtQueryValueKey  (356,  (356, "Mapping", Partial, 152, ... , Partial, 152, ...
 01658  1096   NtSetEventBoostPriority  (312, ...
 01659  1600   NtWaitForSingleObject  (312, 0, 0x0, ...
 01649   588   NtWaitForSingleObject  ... ) == 0x0
 01658  1096   NtSetEventBoostPriority  ... ) == 0x0
 01657   928   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01660  1736   NtQueryInformationThread  (340, Basic, 28, ...
 01661   588   NtSetEventBoostPriority  (312, ...
 01662   928   NtClose  (356, ...
 01652   948   NtWaitForSingleObject  ... ) == 0x0
 01661   588   NtSetEventBoostPriority  ... ) == 0x0
 01660  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1636,Tid=1620,}, 0x0, ) == 0x0
 01663   948   NtSetEventBoostPriority  (312, ...
 01662   928   NtClose  ... ) == 0x0
 01664  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 01653  1652   NtWaitForSingleObject  ... ) == 0x0
 01663   948   NtSetEventBoostPriority  ... ) == 0x0
 01665  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75560, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75560, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0d\6\0\0T\6\0\0" ...  ...
 01666   928   NtWaitForSingleObject  (312, 0, 0x0, ...
 01667  1652   NtSetEventBoostPriority  (312, ...
 01668   948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01665  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75561, 0}  ... {28, 56, reply, 0, 1636, 1736, 75561, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0d\6\0\0T\6\0\0" )  ) == 0x0
 01656  1296   NtWaitForSingleObject  ... ) == 0x0
 01667  1652   NtSetEventBoostPriority  ... ) == 0x0
 01669   588   NtWaitForSingleObject  (312, 0, 0x0, ...
 01670  1296   NtSetEventBoostPriority  (312, ...
 01671  1736   NtResumeThread  (340, ...
 01672  1652   NtWaitForSingleObject  (312, 0, 0x0, ...
 01659  1600   NtWaitForSingleObject  ... ) == 0x0
 01670  1296   NtSetEventBoostPriority  ... ) == 0x0
 01668   948   NtCreateEvent  ... 356, ) == 0x0
 01671  1736   NtResumeThread  ... 1, ) == 0x0
 01673  1600   NtSetEventBoostPriority  (312, ...
 01674  1296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01675   948   NtWaitForSingleObject  (356, 0, 0x0, ...
 01664  1096   NtWaitForSingleObject  ... ) == 0x0
 01676  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01673  1600   NtSetEventBoostPriority  ... ) == 0x0
 01677  1620   NtTestAlert  (...
 01678  1096   NtSetEventBoostPriority  (312, ...
 01676  1736   NtAllocateVirtualMemory  ... 35717120, 1048576, ) == 0x0
 01679  1600   NtSetEventBoostPriority  (356, ...
 01677  1620   NtTestAlert  ... ) == 0x0
 01666   928   NtWaitForSingleObject  ... ) == 0x0
 01678  1096   NtSetEventBoostPriority  ... ) == 0x0
 01680  1736   NtAllocateVirtualMemory  (-1, 36757504, 0, 8192, 4096, 4, ...
 01675   948   NtWaitForSingleObject  ... ) == 0x0
 01679  1600   NtSetEventBoostPriority  ... ) == 0x0
 01681   928   NtSetEventBoostPriority  (312, ...
 01682  1620   NtContinue  (35716400, 1, ...
 01683  1096   NtWaitForSingleObject  (356, 0, 0x0, ...
 01684   948   NtWaitForSingleObject  (312, 0, 0x0, ...
 01680  1736   NtAllocateVirtualMemory  ... 36757504, 8192, ) == 0x0
 01674  1296   NtDuplicateObject  ... 336, ) == 0x0
 01669   588   NtWaitForSingleObject  ... ) == 0x0
 01681   928   NtSetEventBoostPriority  ... ) == 0x0
 01685  1620   NtRegisterThreadTerminatePort  (24, ...
 01686  1600   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01687  1736   NtProtectVirtualMemory  (-1, (0x230e000), 4096, 260, ...
 01688   588   NtSetEventBoostPriority  (312, ...
 01689  1296   NtWaitForSingleObject  (312, 0, 0x0, ...
 01685  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 01686  1600   NtWaitForSingleObject  ... ) == 0x102
 01690   928   NtWaitForSingleObject  (312, 0, 0x0, ...
 01672  1652   NtWaitForSingleObject  ... ) == 0x0
 01688   588   NtSetEventBoostPriority  ... ) == 0x0
 01687  1736   NtProtectVirtualMemory  ... (0x230e000), 4096, 4, ) == 0x0
 01691  1600   NtWaitForSingleObject  (312, 0, 0x0, ...
 01692  1652   NtSetEventBoostPriority  (312, ...
 01693   588   NtWaitForSingleObject  (312, 0, 0x0, ...
 01694  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01684   948   NtWaitForSingleObject  ... ) == 0x0
 01692  1652   NtSetEventBoostPriority  ... ) == 0x0
 01695  1620   NtWaitForSingleObject  (312, 0, 0x0, ...
 01696   948   NtSetEventBoostPriority  (312, ...
 01694  1736   NtCreateThread  ... 332, {1636, 1308}, ) == 0x0
 01697  1652   NtWaitForSingleObject  (356, 0, 0x0, ...
 01689  1296   NtWaitForSingleObject  ... ) == 0x0
 01696   948   NtSetEventBoostPriority  ... ) == 0x0
 01698  1736   NtQueryInformationThread  (332, Basic, 28, ...
 01699  1296   NtSetEventBoostPriority  (312, ...
 01690   928   NtWaitForSingleObject  ... ) == 0x0
 01700   928   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 01701   928   NtSetEventBoostPriority  (312, ...
 01699  1296   NtSetEventBoostPriority  ... ) == 0x0
 01698  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1636,Tid=1308,}, 0x0, ) == 0x0
 01702   948   NtSetEventBoostPriority  (356, ...
 01691  1600   NtWaitForSingleObject  ... ) == 0x0
 01701   928   NtSetEventBoostPriority  ... ) == 0x0
 01703  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75561, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75561, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0d\6\0\0\34\5\0\0" ...  ...
 01683  1096   NtWaitForSingleObject  ... ) == 0x0
 01702   948   NtSetEventBoostPriority  ... ) == 0x0
 01704  1600   NtSetEventBoostPriority  (312, ...
 01705   928   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01706  1296   NtWaitForSingleObject  (312, 0, 0x0, ...
 01707  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 01708   948   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01695  1620   NtWaitForSingleObject  ... ) == 0x0
 01704  1600   NtSetEventBoostPriority  ... ) == 0x0
 01705   928   NtOpenKey  ... 328, ) == 0x0
 01709  1620   NtSetEventBoostPriority  (312, ...
 01708   948   NtWaitForSingleObject  ... ) == 0x102
 01703  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75562, 0}  ... {28, 56, reply, 0, 1636, 1736, 75562, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0d\6\0\0\34\5\0\0" )  ) == 0x0
 01693   588   NtWaitForSingleObject  ... ) == 0x0
 01709  1620   NtSetEventBoostPriority  ... ) == 0x0
 01710   928   NtQueryValueKey  (328,  (328, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01711   948   NtWaitForSingleObject  (164, 0, 0x0, ...
 01712   588   NtSetEventBoostPriority  (312, ...
 01713  1736   NtResumeThread  (332, ...
 01714  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01710   928   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01715  1600   NtWaitForSingleObject  (164, 0, 0x0, ...
 01707  1096   NtWaitForSingleObject  ... ) == 0x0
 01713  1736   NtResumeThread  ... 1, ) == 0x0
 01712   588   NtSetEventBoostPriority  ... ) == 0x0
 01716   928   NtQueryValueKey  (328,  (328, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01717  1096   NtSetEventBoostPriority  (312, ...
 01718  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01719   588   NtWaitForSingleObject  (312, 0, 0x0, ...
 01714  1620   NtDuplicateObject  ... 320, ) == 0x0
 01720  1308   NtAllocateVirtualMemory  (-1, 3624960, 0, 4096, 4096, 4, ...
 01706  1296   NtWaitForSingleObject  ... ) == 0x0
 01718  1736   NtAllocateVirtualMemory  ... 36765696, 1048576, ) == 0x0
 01721  1620   NtWaitForSingleObject  (312, 0, 0x0, ...
 01720  1308   NtAllocateVirtualMemory  ... 3624960, 4096, ) == 0x0
 01722  1296   NtSetEventBoostPriority  (312, ...
 01717  1096   NtSetEventBoostPriority  ... ) == 0x0
 01716   928   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01723  1308   NtTestAlert  (...
 01719   588   NtWaitForSingleObject  ... ) == 0x0
 01722  1296   NtSetEventBoostPriority  ... ) == 0x0
 01724  1736   NtAllocateVirtualMemory  (-1, 37806080, 0, 8192, 4096, 4, ...
 01725   928   NtQueryValueKey  (328,  (328, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 01726   588   NtSetEventBoostPriority  (312, ...
 01723  1308   NtTestAlert  ... ) == 0x0
 01727  1296   NtWaitForSingleObject  (356, 0, 0x0, ...
 01724  1736   NtAllocateVirtualMemory  ... 37806080, 8192, ) == 0x0
 01721  1620   NtWaitForSingleObject  ... ) == 0x0
 01726   588   NtSetEventBoostPriority  ... ) == 0x0
 01725   928   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01728  1308   NtContinue  (36764976, 1, ...
 01729  1096   NtSetEventBoostPriority  (356, ...
 01730  1620   NtWaitForSingleObject  (356, 0, 0x0, ...
 01731  1736   NtProtectVirtualMemory  (-1, (0x240e000), 4096, 260, ...
 01732   928   NtQueryValueKey  (328,  (328, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01733   588   NtWaitForSingleObject  (356, 0, 0x0, ...
 01697  1652   NtWaitForSingleObject  ... ) == 0x0
 01729  1096   NtSetEventBoostPriority  ... ) == 0x0
 01731  1736   NtProtectVirtualMemory  ... (0x240e000), 4096, 4, ) == 0x0
 01732   928   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01734  1652   NtSetEventBoostPriority  (356, ...
 01735  1096   NtWaitForSingleObject  (356, 0, 0x0, ...
 01736  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01727  1296   NtWaitForSingleObject  ... ) == 0x0
 01734  1652   NtSetEventBoostPriority  ... ) == 0x0
 01737   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11596844, ... }, 11596844, ...
 01738  1296   NtSetEventBoostPriority  (356, ...
 01736  1736   NtCreateThread  ... 316, {1636, 1676}, ) == 0x0
 01739  1308   NtRegisterThreadTerminatePort  (24, ...
 01740  1652   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01730  1620   NtWaitForSingleObject  ... ) == 0x0
 01738  1296   NtSetEventBoostPriority  ... ) == 0x0
 01737   928   NtQueryAttributesFile  ... ) == 0x0
 01739  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 01741  1620   NtSetEventBoostPriority  (356, ...
 01740  1652   NtWaitForSingleObject  ... ) == 0x102
 01742  1296   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01743   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01733   588   NtWaitForSingleObject  ... ) == 0x0
 01741  1620   NtSetEventBoostPriority  ... ) == 0x0
 01744  1308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01745  1652   NtWaitForSingleObject  (164, 0, 0x0, ...
 01746   588   NtSetEventBoostPriority  (356, ...
 01743   928   NtOpenFile  ... 360, {status=0x0, info=1}, ) == 0x0
 01747  1736   NtQueryInformationThread  (316, Basic, 28, ...
 01742  1296   NtWaitForSingleObject  ... ) == 0x102
 01744  1308   NtDuplicateObject  ... 364, ) == 0x0
 01735  1096   NtWaitForSingleObject  ... ) == 0x0
 01746   588   NtSetEventBoostPriority  ... ) == 0x0
 01748   928   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 360, ...
 01747  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1636,Tid=1676,}, 0x0, ) == 0x0
 01749  1296   NtWaitForSingleObject  (164, 0, 0x0, ...
 01750  1096   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01751  1308   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 01752   588   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01748   928   NtCreateSection  ... 368, ) == 0x0
 01753  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75562, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75562, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0d\6\0\0\214\6\0\0" ...  ...
 01750  1096   NtOpenFile  ... 372, {status=0x0, info=0}, ) == 0x0
 01751  1308   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 01754  1620   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01755   928   NtClose  (360, ...
 01753  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75563, 0}  ... {28, 56, reply, 0, 1636, 1736, 75563, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0d\6\0\0\214\6\0\0" )  ) == 0x0
 01752   588   NtWaitForSingleObject  ... ) == 0x102
 01756  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252*\277\247Z\3032b\10\15\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01754  1620   NtWaitForSingleObject  ... ) == 0x102
 01757  1308   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01758  1736   NtResumeThread  (316, ...
 01759   588   NtWaitForSingleObject  (164, 0, 0x0, ...
 01760  1096   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01761  1620   NtWaitForSingleObject  (164, 0, 0x0, ...
 01757  1308   NtWaitForSingleObject  ... ) == 0x102
 01755   928   NtClose  ... ) == 0x0
 01760  1096   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01762  1308   NtWaitForSingleObject  (164, 0, 0x0, ...
 01763   928   NtMapViewOfSection  (368, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01764  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01763   928   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 01764  1096   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01765   928   NtClose  (368, ...
 01766  1096   NtQuerySystemInformation  (Performance, 312, ...
 01765   928   NtClose  ... ) == 0x0
 01758  1736   NtResumeThread  ... 1, ) == 0x0
 01767  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 37814272, 1048576, ) == 0x0
 01768  1736   NtAllocateVirtualMemory  (-1, 38854656, 0, 8192, 4096, 4, ... 38854656, 8192, ) == 0x0
 01769  1736   NtProtectVirtualMemory  (-1, (0x250e000), 4096, 260, ... (0x250e000), 4096, 4, ) == 0x0
 01770  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 368, {1636, 724}, ) == 0x0
 01771  1736   NtQueryInformationThread  (368, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1636,Tid=724,}, 0x0, ) == 0x0
 01772  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75563, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75563, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0d\6\0\0\324\2\0\0" ...  ...
 01766  1096   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01773  1676   NtWaitForSingleObject  (128, 0, 0x0, ...
 01774   928   NtUnmapViewOfSection  (-1, 0x360000, ...
 01775  1096   NtQuerySystemInformation  (Exception, 16, ...
 01774   928   NtUnmapViewOfSection  ... ) == 0x0
 01775  1096   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01776   928   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11597152, ... }, 11597152, ...
 01777  1096   NtQuerySystemInformation  (Lookaside, 32, ...
 01776   928   NtQueryAttributesFile  ... ) == 0x0
 01777  1096   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01778   928   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01779  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01772  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75564, 0}  ... {28, 56, reply, 0, 1636, 1736, 75564, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0d\6\0\0\324\2\0\0" )  ) == 0x0
 01778   928   NtOpenFile  ... 360, {status=0x0, info=1}, ) == 0x0
 01780  1736   NtResumeThread  (368, ...
 01781   928   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 360, ...
 01780  1736   NtResumeThread  ... 1, ) == 0x0
 01781   928   NtCreateSection  ... 376, ) == 0x0
 01782  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01783   928   NtQuerySection  (376, Image, 48, ...
 01782  1736   NtAllocateVirtualMemory  ... 38862848, 1048576, ) == 0x0
 01783   928   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01779  1096   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01784   724   NtWaitForSingleObject  (128, 0, 0x0, ...
 01785   928   NtClose  (360, ...
 01786  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01787  1736   NtAllocateVirtualMemory  (-1, 39903232, 0, 8192, 4096, 4, ...
 01786  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01787  1736   NtAllocateVirtualMemory  ... 39903232, 8192, ) == 0x0
 01785   928   NtClose  ... ) == 0x0
 01788  1736   NtProtectVirtualMemory  (-1, (0x260e000), 4096, 260, ...
 01789   928   NtMapViewOfSection  (376, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01788  1736   NtProtectVirtualMemory  ... (0x260e000), 4096, 4, ) == 0x0
 01789   928   NtMapViewOfSection  ... (0x71a90000), 0x0, 32768, ) == 0x0
 01790  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01791   928   NtClose  (376, ...
 01790  1736   NtCreateThread  ... 360, {1636, 1276}, ) == 0x0
 01791   928   NtClose  ... ) == 0x0
 01792  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01793   928   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ...
 01792  1096   NtCreateKey  ... -2147481380, 2, ) == 0x0
 01794  1736   NtQueryInformationThread  (360, Basic, 28, ...
 01795  1096   NtSetValueKey  (-2147481380,  (-2147481380, "Seed", 0, 3, "\274\31P\324\355"\350\276\324\5\341:\314\314\207@\305D\22I\221%l\370\202\210\232\274\1\222\360\276tO\254;SA\304^\252*3/?\323\242\310T\337\236\327Kgx\353W\32\23\35hzGl\216(aj\34~\204\233\254\374\25m\347\376I", 80, ... , 0, 3,  (-2147481380, "Seed", 0, 3, "\274\31P\324\355"\350\276\324\5\341:\314\314\207@\305D\22I\221%l\370\202\210\232\274\1\222\360\276tO\254;SA\304^\252*3/?\323\242\310T\337\236\327Kgx\353W\32\23\35hzGl\216(aj\34~\204\233\254\374\25m\347\376I", 80, ... \350\276\324\5\341:\314\314\207@\305D\22I\221%l\370\202\210\232\274\1\222\360\276tO\254;SA\304^\252*3/?\323\242\310T\337\236\327Kgx\353W\32\23\35hzGl\216(aj\34~\204\233\254\374\25m\347\376I", 80, ...
 01794  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1636,Tid=1276,}, 0x0, ) == 0x0
 01795  1096   NtSetValueKey  ... ) == 0x0
 01796  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75564, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75564, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0d\6\0\0\374\4\0\0" ...  ...
 01797  1096   NtClose  (-2147481380, ...
 01796  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75565, 0}  ... {28, 56, reply, 0, 1636, 1736, 75565, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0d\6\0\0\374\4\0\0" )  ) == 0x0
 01797  1096   NtClose  ... ) == 0x0
 01798  1736   NtResumeThread  (360, ...
 01793   928   NtProtectVirtualMemory  ... (0x71a91000), 4096, 32, ) == 0x0
 01756  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "9\2678 \361o\233SWA\331\6\344\266\251\376\12\277(\343\256\370:\32&\370\277\12J\201\241\374\235\306\265\3119\265>4W\206\316\361\311i\224\371\241\12\20\7\374\316$\245\350\246s\301\274\257\305SD\301\337\234;=AA\223 8*\32\225\21Z\32d\217\6\355\364]\7\365\6,\324I\342\10\360\327Es\306\252V\304\330\12\177X0\357r\327w\5\273\206\343p\357\2153\263\200\262\22\216\32\37\344\6\377(\215\376\14\253\26'\344jT\24\240\241\219\24{\263G\345\2122\260\371\256\27\363\230&Q\264\274s\271y\361y\306}\266\177/\236J'8\5\263\220\1\215\36\247\213L!\3058\223\34~\240o\220%\35\210\20\356t\21\0\301\314\317\274"\310iD\320\246PZ\347\26\272T\207oX\177W\376>\244#,\325\25\270\365\24/\304\244\33'q\245J\17\311j:\367\366Me\347\371\12>\203g\271", ) \310iD\320\246PZ\347\26\272T\207oX\177W\376>\244#,\325\25\270\365\24/\304\244\33'q\245J\17\311j:\367\366Me\347\371\12>\203g\271", ) == 0x0
 01799   928   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ...
 01800  1096   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01799   928   NtProtectVirtualMemory  ... (0x71a91000), 4096, 4, ) == 0x0
 01800  1096   NtCreateEvent  ... 376, ) == 0x0
 01801   928   NtFlushInstructionCache  (-1, 1906905088, 128, ...
 01802  1096   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789572, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789572, 188, ...
 01798  1736   NtResumeThread  ... 1, ) == 0x0
 01803  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 39911424, 1048576, ) == 0x0
 01804  1736   NtAllocateVirtualMemory  (-1, 40951808, 0, 8192, 4096, 4, ... 40951808, 8192, ) == 0x0
 01805  1736   NtProtectVirtualMemory  (-1, (0x270e000), 4096, 260, ...
 01802  1096   NtConnectPort  ... 380, 0x0, 0x0, 0x0, 188, ) == 0x0
 01801   928   NtFlushInstructionCache  ... ) == 0x0
 01806  1276   NtWaitForSingleObject  (128, 0, 0x0, ...
 01805  1736   NtProtectVirtualMemory  ... (0x270e000), 4096, 4, ) == 0x0
 01807   928   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... }, ...
 01808  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01807   928   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01808  1736   NtCreateThread  ... 384, {1636, 1368}, ) == 0x0
 01809   928   NtSetEventBoostPriority  (128, ...
 01810  1736   NtQueryInformationThread  (384, Basic, 28, ...
 01811  1096   NtRequestWaitReplyPort  (380, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721}  (380, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\10"\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\337\221\340.8\206(\261\210#\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0`#\25\0\354\342\313\24x\1\24\0\200#\25\0h\1\24\0\0\0\0\0\0\0\0\0\200#\25\0P\0\0\0\210#\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... \25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\337\221\340.8\206(\261\210#\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0`#\25\0\354\342\313\24x\1\24\0\200#\25\0h\1\24\0\0\0\0\0\0\0\0\0\200#\25\0P\0\0\0\210#\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...
 01810  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1636,Tid=1368,}, 0x0, ) == 0x0
 01812  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75565, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75565, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0d\6\0\0X\5\0\0" ...  ...
 01811  1096   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1636, 1096, 75567, 0}  ... {200, 224, reply, 0, 1636, 1096, 75567, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\337\221\340.8\206(\261\210#\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0`#\25\0\354\342\313\24x\1\24\0\200#\25\0h\1\24\0\0\0\0\0\0\0\0\0\200#\25\0P\0\0\0\210#\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01773  1676   NtWaitForSingleObject  ... ) == 0x0
 01809   928   NtSetEventBoostPriority  ... ) == 0x0
 01813  1096   NtRequestWaitReplyPort  (380, {64, 88, new_msg, 0, 0, 0, 0, 0}  (380, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 01814  1676   NtSetEventBoostPriority  (128, ...
 01815   928   NtClose  (328, ...
 01784   724   NtWaitForSingleObject  ... ) == 0x0
 01814  1676   NtSetEventBoostPriority  ... ) == 0x0
 01816   724   NtSetEventBoostPriority  (128, ...
 01815   928   NtClose  ... ) == 0x0
 01813  1096   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1636, 1096, 75568, 0}  ... {52, 76, reply, 0, 1636, 1096, 75568, 0} "\2\332\243\201\1\0\0\0\200Y\274\201Ni\257\341\264\311\275\201:\332R\200X\373`\371t\333\243\201\230\37\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 01812  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75569, 0}  ... {28, 56, reply, 0, 1636, 1736, 75569, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0d\6\0\0X\5\0\0" )  ) == 0x0
 01806  1276   NtWaitForSingleObject  ... ) == 0x0
 01816   724   NtSetEventBoostPriority  ... ) == 0x0
 01817   928   NtWaitForSingleObject  (128, 0, 0x0, ...
 01818  1676   NtTestAlert  (...
 01819  1276   NtSetEventBoostPriority  (128, ...
 01820  1736   NtResumeThread  (384, ...
 01821  1096   NtClose  (376, ...
 01817   928   NtWaitForSingleObject  ... ) == 0x0
 01819  1276   NtSetEventBoostPriority  ... ) == 0x0
 01818  1676   NtTestAlert  ... ) == 0x0
 01820  1736   NtResumeThread  ... 1, ) == 0x0
 01822   928   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11599488, 67, ... }, 0x0, 0, 3, 3, 0, 11599488, 67, ...
 01821  1096   NtClose  ... ) == 0x0
 01823   724   NtTestAlert  (...
 01824  1368   NtTestAlert  (...
 01825  1676   NtContinue  (37813552, 1, ...
 01822   928   NtCreateFile  ... 376, {status=0x0, info=0}, ) == 0x0
 01826  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01827  1096   NtClose  (380, ...
 01823   724   NtTestAlert  ... ) == 0x0
 01824  1368   NtTestAlert  ... ) == 0x0
 01828  1676   NtRegisterThreadTerminatePort  (24, ...
 01829  1276   NtTestAlert  (...
 01826  1736   NtAllocateVirtualMemory  ... 40960000, 1048576, ) == 0x0
 01827  1096   NtClose  ... ) == 0x0
 01830   724   NtContinue  (38862128, 1, ...
 01831  1368   NtContinue  (40959280, 1, ...
 01828  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 01829  1276   NtTestAlert  ... ) == 0x0
 01832   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x1207b,  (376, 136, 0x0, 0x0, 0x1207b, "\7\0\0\0\250q\250q%\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 01833  1096   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01834   724   NtRegisterThreadTerminatePort  (24, ...
 01835  1368   NtRegisterThreadTerminatePort  (24, ...
 01836  1676   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01837  1276   NtContinue  (39910704, 1, ...
 01832   928   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0@\273\201\201", ) , ) == 0x0
 01833  1096   NtCreateKey  ... 380, 2, ) == 0x0
 01834   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 01835  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 01838  1736   NtAllocateVirtualMemory  (-1, 42000384, 0, 8192, 4096, 4, ...
 01839  1276   NtRegisterThreadTerminatePort  (24, ...
 01840   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x1207b,  (376, 136, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0@\273\201\201", 16, 16, ... , 16, 16, ...
 01836  1676   NtDuplicateObject  ... 328, ) == 0x0
 01841   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01842  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01838  1736   NtAllocateVirtualMemory  ... 42000384, 8192, ) == 0x0
 01839  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 01840   928   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0@\273\201\201", ) , ) == 0x0
 01843  1676   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01844  1368   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01842  1096   NtOpenKey  ... 388, ) == 0x0
 01845  1736   NtProtectVirtualMemory  (-1, (0x280e000), 4096, 260, ...
 01846  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01847   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x12047,  (376, 136, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\224\375\260\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 01843  1676   NtWaitForSingleObject  ... ) == 0x102
 01844  1368   NtDuplicateObject  ... 392, ) == 0x0
 01848  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01845  1736   NtProtectVirtualMemory  ... (0x280e000), 4096, 4, ) == 0x0
 01841   724   NtDuplicateObject  ... 396, ) == 0x0
 01847   928   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 01849  1676   NtWaitForSingleObject  (164, 0, 0x0, ...
 01850  1368   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01848  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01851  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01852   724   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01846  1276   NtDuplicateObject  ... 400, ) == 0x0
 01850  1368   NtWaitForSingleObject  ... ) == 0x102
 01853  1096   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... , Partial, 144, ...
 01851  1736   NtCreateThread  ... 404, {1636, 704}, ) == 0x0
 01852   724   NtWaitForSingleObject  ... ) == 0x102
 01854  1276   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01855  1368   NtWaitForSingleObject  (164, 0, 0x0, ...
 01853  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01856   928   NtWaitForSingleObject  (96, 0, {0, 0}, ...
 01857   724   NtWaitForSingleObject  (164, 0, 0x0, ...
 01854  1276   NtWaitForSingleObject  ... ) == 0x102
 01858  1736   NtQueryInformationThread  (404, Basic, 28, ...
 01856   928   NtWaitForSingleObject  ... ) == 0x102
 01859  1276   NtWaitForSingleObject  (164, 0, 0x0, ...
 01858  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1636,Tid=704,}, 0x0, ) == 0x0
 01860   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x12003,  (376, 136, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 01861  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75569, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75569, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0d\6\0\0\300\2\0\0" ...  ...
 01860   928   NtDeviceIoControlFile  ... {status=0x0, info=408},  ... {status=0x0, info=408}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01861  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75571, 0}  ... {28, 56, reply, 0, 1636, 1736, 75571, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0d\6\0\0\300\2\0\0" )  ) == 0x0
 01862  1096   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... , Partial, 144, ...
 01863  1736   NtResumeThread  (404, ...
 01862  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01864   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x12047,  (376, 136, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01865  1096   NtClose  (380, ...
 01864   928   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01865  1096   NtClose  ... ) == 0x0
 01866   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x12037,  (376, 136, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 01867  1096   NtClose  (388, ...
 01866   928   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01867  1096   NtClose  ... ) == 0x0
 01868   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x1200b,  (376, 136, 0x0, 0x0, 0x1200b, "\0\376\260\0\5\0\0\0\0\320\24\0", 12, 0, ... , 12, 0, ...
 01863  1736   NtResumeThread  ... 1, ) == 0x0
 01868   928   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01869  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01870  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135R\10\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01871   704   NtTestAlert  (...
 01869  1736   NtAllocateVirtualMemory  ... 42008576, 1048576, ) == 0x0
 01872  1096   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01871   704   NtTestAlert  ... ) == 0x0
 01873  1736   NtAllocateVirtualMemory  (-1, 43048960, 0, 8192, 4096, 4, ...
 01872  1096   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01874   704   NtContinue  (42007856, 1, ...
 01873  1736   NtAllocateVirtualMemory  ... 43048960, 8192, ) == 0x0
 01875  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01876   704   NtRegisterThreadTerminatePort  (24, ...
 01877  1736   NtProtectVirtualMemory  (-1, (0x290e000), 4096, 260, ...
 01875  1096   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01876   704   NtRegisterThreadTerminatePort  ... ) == 0x0
 01878   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x12047,  (376, 136, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\260\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01879  1096   NtQuerySystemInformation  (Performance, 312, ...
 01877  1736   NtProtectVirtualMemory  ... (0x290e000), 4096, 4, ) == 0x0
 01878   928   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01880   704   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01881  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01882   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 01880   704   NtDuplicateObject  ... 388, ) == 0x0
 01881  1736   NtCreateThread  ... 380, {1636, 1104}, ) == 0x0
 01882   928   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01883   704   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01884  1736   NtQueryInformationThread  (380, Basic, 28, ...
 01885   928   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01883   704   NtWaitForSingleObject  ... ) == 0x102
 01884  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1636,Tid=1104,}, 0x0, ) == 0x0
 01885   928   NtCreateEvent  ... 412, ) == 0x0
 01886   704   NtWaitForSingleObject  (164, 0, 0x0, ...
 01887  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75571, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75571, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0d\6\0\0P\4\0\0" ...  ...
 01879  1096   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01888   928   NtWaitForSingleObject  (412, 0, 0x0, ...
 01889  1096   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01890  1096   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01891  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01892  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01893  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481440, 2, ) }, 0, 0x0, 0, ... -2147481440, 2, ) == 0x0
 01894  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "\206\267\10\27\205\256\271\353\3124bT*\241\16\221\347,\23\231=\331\3w\25\356\257\207Q'\304\202\355\351\371\0\227a\13\232\346\109\11\355\354\162\344\301\16\324\177f\330\251\1\262\235\202\201\216Z\370\207\305*\240\12\205\33\345"y\365S/CM\17", 80, ... , 0, 3,  (-2147481440, "Seed", 0, 3, "\206\267\10\27\205\256\271\353\3124bT*\241\16\221\347,\23\231=\331\3w\25\356\257\207Q'\304\202\355\351\371\0\227a\13\232\346\109\11\355\354\162\344\301\16\324\177f\330\251\1\262\235\202\201\216Z\370\207\305*\240\12\205\33\345"y\365S/CM\17", 80, ... y\365S/CM\17", 80, ...
 01887  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75572, 0}  ... {28, 56, reply, 0, 1636, 1736, 75572, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0d\6\0\0P\4\0\0" )  ) == 0x0
 01895  1736   NtResumeThread  (380, ... 1, ) == 0x0
 01896  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 43057152, 1048576, ) == 0x0
 01897  1736   NtAllocateVirtualMemory  (-1, 44097536, 0, 8192, 4096, 4, ... 44097536, 8192, ) == 0x0
 01898  1736   NtProtectVirtualMemory  (-1, (0x2a0e000), 4096, 260, ... (0x2a0e000), 4096, 4, ) == 0x0
 01899  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 416, {1636, 784}, ) == 0x0
 01894  1096   NtSetValueKey  ... ) == 0x0
 01900  1104   NtTestAlert  (...
 01901  1096   NtClose  (-2147481440, ...
 01900  1104   NtTestAlert  ... ) == 0x0
 01901  1096   NtClose  ... ) == 0x0
 01902  1104   NtContinue  (43056432, 1, ...
 01870  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\314\230:=Ts\373\5,\266x\226\373pC\372\243\305/\252\4AVb=\334\313<\206\2\357\344d\264\364\10\252\250\16\305\307[\330w\5\315 \1,\260\13\0]!\233[\16\3544\245 \20\363\33\241\364\313:At\335f\254\311\261\254\216\2606\277\303g\27\5\26\277\327\21WS\323\363\267\365\246\371\303\206\2\211\311\347\275\371on\222y>\5\216\352f\212\271\304\342\371\11aUi\322\244\214X\177\276\224\254;\213\23\16\266\201"k\341D\235/l_\210\375\2615\276\31\247\322w\250\3033.\35^\351\2528\26\337\147\353]i\15\316\203\344\356f\252\374\343\333#Q,.]\2766\253\337\235\33\204i]\246\376\3129\260'\272y\12\353\3466\374Un\3>-\32\223_\32tL\244\301\204\1\311Q\316,\221\347:\20F\203\35F\333g\2227\247\245\252\210\302{E\246\203\360+\224\277\202m'S\346\14", ) k\341D\235/l_\210\375\2615\276\31\247\322w\250\3033.\35^\351\2528\26\337\147\353]i\15\316\203\344\356f\252\374\343\333#Q,.]\2766\253\337\235\33\204i]\246\376\3129\260'\272y\12\353\3466\374Un\3>-\32\223_\32tL\244\301\204\1\311Q\316,\221\347:\20F\203\35F\333g\2227\247\245\252\210\302{E\246\203\360+\224\277\202m'S\346\14", ) == 0x0
 01903  1104   NtRegisterThreadTerminatePort  (24, ...
 01904  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135\231\2527\362\3537EiS\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01903  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 01905  1096   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01906  1736   NtQueryInformationThread  (416, Basic, 28, ...
 01907  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01906  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1636,Tid=784,}, 0x0, ) == 0x0
 01907  1104   NtDuplicateObject  ... 420, ) == 0x0
 01908  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75572, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75572, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0d\6\0\0\20\3\0\0" ...  ...
 01909  1104   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 01908  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75573, 0}  ... {28, 56, reply, 0, 1636, 1736, 75573, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0d\6\0\0\20\3\0\0" )  ) == 0x0
 01909  1104   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 01910  1736   NtResumeThread  (416, ...
 01911  1104   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01905  1096   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01912  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01913  1096   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01914  1096   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01915  1096   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01916  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01917  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01910  1736   NtResumeThread  ... 1, ) == 0x0
 01911  1104   NtWaitForSingleObject  ... ) == 0x102
 01918  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01919  1104   NtWaitForSingleObject  (164, 0, 0x0, ...
 01918  1736   NtAllocateVirtualMemory  ... 44105728, 1048576, ) == 0x0
 01920  1736   NtAllocateVirtualMemory  (-1, 45146112, 0, 8192, 4096, 4, ... 45146112, 8192, ) == 0x0
 01921  1736   NtProtectVirtualMemory  (-1, (0x2b0e000), 4096, 260, ... (0x2b0e000), 4096, 4, ) == 0x0
 01922  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 424, {1636, 1792}, ) == 0x0
 01923  1736   NtQueryInformationThread  (424, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1636,Tid=1792,}, 0x0, ) == 0x0
 01924  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75573, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75573, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0d\6\0\0\0\7\0\0" ...  ...
 01917  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01925   784   NtTestAlert  (...
 01926  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01925   784   NtTestAlert  ... ) == 0x0
 01926  1096   NtCreateKey  ... -2147481440, 2, ) == 0x0
 01927   784   NtContinue  (44105008, 1, ...
 01928  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "\321t\276\203\366\232oj\277"\220\241k \374\251nQ\2\306\242\37\273\311J\14\242\200$\261\334\24n$h]\356\32,.\221\300\310zX\265\7\247\14\17K\11\356\213\13L.VG\375\247\250\324\244<\207Y\234\372\223\232GC\26\354;\334\24\241R", 80, ... , 0, 3,  (-2147481440, "Seed", 0, 3, "\321t\276\203\366\232oj\277"\220\241k \374\251nQ\2\306\242\37\273\311J\14\242\200$\261\334\24n$h]\356\32,.\221\300\310zX\265\7\247\14\17K\11\356\213\13L.VG\375\247\250\324\244<\207Y\234\372\223\232GC\26\354;\334\24\241R", 80, ... \220\241k \374\251nQ\2\306\242\37\273\311J\14\242\200$\261\334\24n$h]\356\32,.\221\300\310zX\265\7\247\14\17K\11\356\213\13L.VG\375\247\250\324\244<\207Y\234\372\223\232GC\26\354;\334\24\241R", 80, ...
 01929   784   NtRegisterThreadTerminatePort  (24, ...
 01928  1096   NtSetValueKey  ... ) == 0x0
 01929   784   NtRegisterThreadTerminatePort  ... ) == 0x0
 01930  1096   NtClose  (-2147481440, ...
 01924  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75574, 0}  ... {28, 56, reply, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0d\6\0\0\0\7\0\0" )  ) == 0x0
 01931   784   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01932  1736   NtResumeThread  (424, ...
 01931   784   NtDuplicateObject  ... 428, ) == 0x0
 01932  1736   NtResumeThread  ... 1, ) == 0x0
 01933   784   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01934  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01933   784   NtWaitForSingleObject  ... ) == 0x102
 01934  1736   NtAllocateVirtualMemory  ... 45154304, 1048576, ) == 0x0
 01935   784   NtWaitForSingleObject  (164, 0, 0x0, ...
 01930  1096   NtClose  ... ) == 0x0
 01936  1792   NtTestAlert  (...
 01937  1736   NtAllocateVirtualMemory  (-1, 46194688, 0, 8192, 4096, 4, ...
 01904  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\212\23\203\275-\15\230\246\364W7\27\377\273>\324X\203\262\24*\267s\2733y\32c(Y\363\17cr\376\210\2236_#d\2120+\22\211\2231\330\206?\375\217I\7\240\27T{\377=\276\354\256W\2720\223\260\375\212%\215r\301\251\344KW\336!yV\335I\360\362\21l\247A\317\37Q\323\342_\256\14\11\327{\326\364p\214\15^W\237Qd\372\320]\227\211\301\327,\301\352\22Y6\10\353S}\317\326\14\214\376\2145\307Y\246\226\330w_Y\2135!\227\254\2740\323c\36j\334\347\243\3434P\13\14\314;\323\247\270M\230n\201%0\313\327\376E\21\11km\3434\35\233\3\340\270g\345J\236\210\261\361\351\200\206R\326\344\271\243P\2257\342\226-\370\337i:\213\226\313\214\277\33'\307\13\233xhz\222\302O\21~\\305\343Jo\321}|\325$3S", ) , ) == 0x0
 01936  1792   NtTestAlert  ... ) == 0x0
 01937  1736   NtAllocateVirtualMemory  ... 46194688, 8192, ) == 0x0
 01938  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135\231\2527\362\3537E\242\3617\362\3537EiS\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01939  1792   NtContinue  (45153584, 1, ...
 01940  1736   NtProtectVirtualMemory  (-1, (0x2c0e000), 4096, 260, ...
 01941  1096   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01942  1792   NtRegisterThreadTerminatePort  (24, ...
 01940  1736   NtProtectVirtualMemory  ... (0x2c0e000), 4096, 4, ) == 0x0
 01941  1096   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01942  1792   NtRegisterThreadTerminatePort  ... ) == 0x0
 01943  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01944  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01943  1736   NtCreateThread  ... 432, {1636, 192}, ) == 0x0
 01945  1792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01944  1096   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01945  1792   NtDuplicateObject  ... 436, ) == 0x0
 01946  1096   NtQuerySystemInformation  (Performance, 312, ...
 01947  1792   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01946  1096   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01947  1792   NtWaitForSingleObject  ... ) == 0x102
 01948  1096   NtQuerySystemInformation  (Exception, 16, ...
 01949  1792   NtWaitForSingleObject  (164, 0, 0x0, ...
 01948  1096   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01950  1736   NtQueryInformationThread  (432, Basic, 28, ...
 01951  1096   NtQuerySystemInformation  (Lookaside, 32, ...
 01950  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1636,Tid=192,}, 0x0, ) == 0x0
 01952  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75574, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0d\6\0\0\300\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0d\6\0\0\300\0\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75575, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0d\6\0\0\300\0\0\0" ... {28, 56, reply, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0d\6\0\0\300\0\0\0" )  ) == 0x0
 01953  1736   NtResumeThread  (432, ... 1, ) == 0x0
 01954  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 46202880, 1048576, ) == 0x0
 01955  1736   NtAllocateVirtualMemory  (-1, 47243264, 0, 8192, 4096, 4, ... 47243264, 8192, ) == 0x0
 01956  1736   NtProtectVirtualMemory  (-1, (0x2d0e000), 4096, 260, ...
 01951  1096   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01957   192   NtTestAlert  (...
 01958  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01957   192   NtTestAlert  ... ) == 0x0
 01958  1096   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01959   192   NtContinue  (46202160, 1, ...
 01960  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01961   192   NtRegisterThreadTerminatePort  (24, ...
 01960  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01961   192   NtRegisterThreadTerminatePort  ... ) == 0x0
 01962  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01956  1736   NtProtectVirtualMemory  ... (0x2d0e000), 4096, 4, ) == 0x0
 01963   192   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01964  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01963   192   NtDuplicateObject  ... 440, ) == 0x0
 01964  1736   NtCreateThread  ... 444, {1636, 520}, ) == 0x0
 01965   192   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01966  1736   NtQueryInformationThread  (444, Basic, 28, ...
 01965   192   NtWaitForSingleObject  ... ) == 0x102
 01966  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1636,Tid=520,}, 0x0, ) == 0x0
 01967   192   NtWaitForSingleObject  (164, 0, 0x0, ...
 01968  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75575, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75575, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0d\6\0\0\10\2\0\0" ...  ...
 01962  1096   NtCreateKey  ... -2147481440, 2, ) == 0x0
 01969  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "p\270\24=S\230|,\224c\221\373\374\313\374\267~\24\211\326\343\177QTo\272<|V\272v\307\320\243\213xR\261\346/U\355ix\343&+\244l\275\210|@\332[D\217c\234\6M\327C,;F`%t\304\276\33X\266\205\331\207\265\10\266", 80, ... ) , 0, 3,  (-2147481440, "Seed", 0, 3, "p\270\24=S\230|,\224c\221\373\374\313\374\267~\24\211\326\343\177QTo\272<|V\272v\307\320\243\213xR\261\346/U\355ix\343&+\244l\275\210|@\332[D\217c\234\6M\327C,;F`%t\304\276\33X\266\205\331\207\265\10\266", 80, ... ) , 80, ... ) == 0x0
 01970  1096   NtClose  (-2147481440, ... ) == 0x0
 01938  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "'\313-P3\356#\202\272X\324\3401\343\377>\233Y\251\2116\270\364\253\5\370Ry\350\237\210\314\33\314\335J\316\301w\264\221\245\3720r\14z\23!p\372\370\201\212\357oGn\223d\337|\377#GneB\321\207\234g B\2074\300\3324{\365\304\21695\15\234o~\341\36\251\36\374\23\22\2123\200$B\257\214_H)\341SOL&\216Bu\300\254;\4y\356\221\213\6:\232tk2\236w\216}1e\25\203\324\326\256\20\14\342U\264\337{\200-\222\330W\355\377Pg\332\244\33\20\10]\207!\217V\203`\323g\30a\365\245-_\216s\222um\276\333\3700k^\213\343\370\20\26vz2\225\322Lp\241\201\24\310\203~\252OY\220\374\26\373\1\307Rq\6\6\231\10\17\2639\261\25\273\230\3736+\315\263\205\26^\2017\2\312o5E<\240Q\372+\25L\254H\344\220-\237\346", ) , ) == 0x0
 01971  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135\231\2527\362\3537E\242\3617\362\3537E\242\3617\362\3537EiS\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01972  1096   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01973  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01974  1096   NtQuerySystemInformation  (Performance, 312, ...
 01968  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75576, 0}  ... {28, 56, reply, 0, 1636, 1736, 75576, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0d\6\0\0\10\2\0\0" )  ) == 0x0
 01975  1736   NtResumeThread  (444, ... 1, ) == 0x0
 01976  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 47251456, 1048576, ) == 0x0
 01977  1736   NtAllocateVirtualMemory  (-1, 48291840, 0, 8192, 4096, 4, ... 48291840, 8192, ) == 0x0
 01978  1736   NtProtectVirtualMemory  (-1, (0x2e0e000), 4096, 260, ... (0x2e0e000), 4096, 4, ) == 0x0
 01979  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 448, {1636, 876}, ) == 0x0
 01974  1096   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01980   520   NtTestAlert  (...
 01981  1096   NtQuerySystemInformation  (Exception, 16, ...
 01980   520   NtTestAlert  ... ) == 0x0
 01981  1096   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01982   520   NtContinue  (47250736, 1, ...
 01983  1096   NtQuerySystemInformation  (Lookaside, 32, ...
 01984   520   NtRegisterThreadTerminatePort  (24, ...
 01983  1096   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01984   520   NtRegisterThreadTerminatePort  ... ) == 0x0
 01985  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01986  1736   NtQueryInformationThread  (448, Basic, 28, ...
 01987   520   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01986  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1636,Tid=876,}, 0x0, ) == 0x0
 01987   520   NtDuplicateObject  ... 452, ) == 0x0
 01988  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75576, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75576, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0d\6\0\0l\3\0\0" ...  ...
 01989   520   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01988  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75577, 0}  ... {28, 56, reply, 0, 1636, 1736, 75577, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0d\6\0\0l\3\0\0" )  ) == 0x0
 01989   520   NtWaitForSingleObject  ... ) == 0x102
 01990  1736   NtResumeThread  (448, ...
 01991   520   NtWaitForSingleObject  (164, 0, 0x0, ...
 01985  1096   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01990  1736   NtResumeThread  ... 1, ) == 0x0
 01992  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01993  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01992  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01993  1736   NtAllocateVirtualMemory  ... 48300032, 1048576, ) == 0x0
 01994  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01995  1736   NtAllocateVirtualMemory  (-1, 49340416, 0, 8192, 4096, 4, ...
 01994  1096   NtCreateKey  ... -2147481440, 2, ) == 0x0
 01995  1736   NtAllocateVirtualMemory  ... 49340416, 8192, ) == 0x0
 01996  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "q\254\365SM#\241\351\25\220)j\337E\30\321\353\333v\303\240L\252=:)\32rY\322\241)R\340\273MI\235\260|\201\25\331\341\31`WH/\352o\376\264l\242\242\323\6\260\34\211\316\234O^A4jg#\230\214\235\323\5\220\2\24+N", 80, ... , 0, 3,  (-2147481440, "Seed", 0, 3, "q\254\365SM#\241\351\25\220)j\337E\30\321\353\333v\303\240L\252=:)\32rY\322\241)R\340\273MI\235\260|\201\25\331\341\31`WH/\352o\376\264l\242\242\323\6\260\34\211\316\234O^A4jg#\230\214\235\323\5\220\2\24+N", 80, ... , 80, ...
 01997  1736   NtProtectVirtualMemory  (-1, (0x2f0e000), 4096, 260, ...
 01998   876   NtTestAlert  (...
 01996  1096   NtSetValueKey  ... ) == 0x0
 01998   876   NtTestAlert  ... ) == 0x0
 01999  1096   NtClose  (-2147481440, ...
 02000   876   NtContinue  (48299312, 1, ...
 01999  1096   NtClose  ... ) == 0x0
 02001   876   NtRegisterThreadTerminatePort  (24, ...
 01971  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "5e\207|\352\335\201\36\227I^\15,\207\327c%\327\372y\217"Y>\340\334\11EZ6\6>\203x\333\302a\245\317AtQ`\333uoT\307[+\341/\265A\211\34\265\356\37\\322\24o\357\362xF\353\370$\21\254\313\31\210m:v\321\37Cb\212\233\201\34\34\210\25l\240\313\237vt\223Ci\357+kp\17\271\336c\222\200\225\376w\223\237\244\5\251\357B\317\251\262\357/%N,\312\223\24'\263\333* \351,;i\253\21\250\342)\336\340\212XV8\5\314\346>>F\322\327\3647\344\312M\225\240\252\31qt+\340j\216\327Z\240\366-\364;Q\274t>:\301\366<\303\6\311\\301n\7G\177\376\236j9Lx5\21E\300U\374^\202\362\232\266Z\313\23\216\12r\300\12\226\27\344\223\12\250$\242}\275)\377C\5\256$w\313;1\336\220\36\37`*\315\202\300\305\6Nh", ) Y>\340\334\11EZ6\6>\203x\333\302a\245\317AtQ`\333uoT\307[+\341/\265A\211\34\265\356\37\\322\24o\357\362xF\353\370$\21\254\313\31\210m:v\321\37Cb\212\233\201\34\34\210\25l\240\313\237vt\223Ci\357+kp\17\271\336c\222\200\225\376w\223\237\244\5\251\357B\317\251\262\357/%N,\312\223\24'\263\333* \351,;i\253\21\250\342)\336\340\212XV8\5\314\346>>F\322\327\3647\344\312M\225\240\252\31qt+\340j\216\327Z\240\366-\364;Q\274t>:\301\366<\303\6\311\\301n\7G\177\376\236j9Lx5\21E\300U\374^\202\362\232\266Z\313\23\216\12r\300\12\226\27\344\223\12\250$\242}\275)\377C\5\256$w\313;1\336\220\36\37`*\315\202\300\305\6Nh", ) == 0x0
 02001   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 02002  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135\231\2527\362\3537E\242\3617\362\3537E\242\3617\362\3537E\242\3617\362\3537EiS\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01997  1736   NtProtectVirtualMemory  ... (0x2f0e000), 4096, 4, ) == 0x0
 02003  1096   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02004  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02005   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02004  1736   NtCreateThread  ... 456, {1636, 1628}, ) == 0x0
 02005   876   NtDuplicateObject  ... 460, ) == 0x0
 02006  1736   NtQueryInformationThread  (456, Basic, 28, ...
 02007   876   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02006  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1636,Tid=1628,}, 0x0, ) == 0x0
 02007   876   NtWaitForSingleObject  ... ) == 0x102
 02008  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75577, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75577, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0d\6\0\0\\6\0\0" ...  ...
 02009   876   NtWaitForSingleObject  (164, 0, 0x0, ...
 02003  1096   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02008  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75578, 0}  ... {28, 56, reply, 0, 1636, 1736, 75578, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0d\6\0\0\\6\0\0" )  ) == 0x0
 02010  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02011  1736   NtResumeThread  (456, ...
 02010  1096   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02011  1736   NtResumeThread  ... 1, ) == 0x0
 02012  1096   NtQuerySystemInformation  (Performance, 312, ...
 02013  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02012  1096   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02013  1736   NtAllocateVirtualMemory  ... 49348608, 1048576, ) == 0x0
 02014  1096   NtQuerySystemInformation  (Exception, 16, ...
 02015  1628   NtTestAlert  (...
 02016  1736   NtAllocateVirtualMemory  (-1, 50388992, 0, 8192, 4096, 4, ...
 02015  1628   NtTestAlert  ... ) == 0x0
 02016  1736   NtAllocateVirtualMemory  ... 50388992, 8192, ) == 0x0
 02017  1628   NtContinue  (49347888, 1, ...
 02018  1736   NtProtectVirtualMemory  (-1, (0x300e000), 4096, 260, ...
 02019  1628   NtRegisterThreadTerminatePort  (24, ...
 02018  1736   NtProtectVirtualMemory  ... (0x300e000), 4096, 4, ) == 0x0
 02019  1628   NtRegisterThreadTerminatePort  ... ) == 0x0
 02020  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02014  1096   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02020  1736   NtCreateThread  ... 464, {1636, 940}, ) == 0x0
 02021  1096   NtQuerySystemInformation  (Lookaside, 32, ...
 02022  1628   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02021  1096   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02022  1628   NtDuplicateObject  ... 468, ) == 0x0
 02023  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02024  1628   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02023  1096   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02024  1628   NtWaitForSingleObject  ... ) == 0x102
 02025  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02026  1628   NtWaitForSingleObject  (164, 0, 0x0, ...
 02027  1736   NtQueryInformationThread  (464, Basic, 28, ...
 02025  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02027  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1636,Tid=940,}, 0x0, ) == 0x0
 02028  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02029  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75578, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75578, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0d\6\0\0\254\3\0\0" ...  ...
 02028  1096   NtCreateKey  ... -2147481440, 2, ) == 0x0
 02029  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75579, 0}  ... {28, 56, reply, 0, 1636, 1736, 75579, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0d\6\0\0\254\3\0\0" )  ) == 0x0
 02030  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "\6\253\17\200W\322%\3279vi\200\325j\303\322\33\243\236\3036\327\33\205\16\276{\225\271\321\272v\274\341\214~\336\367\342\310\35\251I\222\254\337\273\330\257T9C2\234\330\314\373MXY7\340F\2\251'/\31l+R\372H\33020\333)\253\361", 80, ... , 0, 3,  (-2147481440, "Seed", 0, 3, "\6\253\17\200W\322%\3279vi\200\325j\303\322\33\243\236\3036\327\33\205\16\276{\225\271\321\272v\274\341\214~\336\367\342\310\35\251I\222\254\337\273\330\257T9C2\234\330\314\373MXY7\340F\2\251'/\31l+R\372H\33020\333)\253\361", 80, ... , 80, ...
 02031  1736   NtResumeThread  (464, ...
 02030  1096   NtSetValueKey  ... ) == 0x0
 02032  1096   NtClose  (-2147481440, ... ) == 0x0
 02002  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\11\224f\320\37\215:\316\303\223\6\250\275f\23\350Z\335B\200\325\202\316PL2x\377\251\251)7.\307\3509P\301\5\304\324\306\316\335\316\316\275\30\334\364\346\251\312\350\223u\216\27\216ZY\353h\212\270HtS\345(7p\31'\240\330\4\334\277\34103 \352\250\220=#f\16>\252\316\207\335\374Ehkv\271\14a\256\236`\32"\370\363\3029<\275E*\320\30\25\17\2\235J\31\14\265\352\300wPx\237[#\14~\252\307\223\356\35\177qO\221]\314\220m\3022\353\2131P]}\25\204O\251\225\340\24oks\233\377\17\314\251\335=X\344\26E\277y7\307\227dh|~\226\4o\357Jo\7<\305\224\14\203\31+\302~{\247K\335\356q\271\3306=u\242\373n\301\270\223\37yUZ\371\325\355A\3320g\310\213\36\356{\4\247\256\11\363\346\261E\21\267\355\374\2603\13\246v#\323", ) \370\363\3029<\275E*\320\30\25\17\2\235J\31\14\265\352\300wPx\237[#\14~\252\307\223\356\35\177qO\221]\314\220m\3022\353\2131P]}\25\204O\251\225\340\24oks\233\377\17\314\251\335=X\344\26E\277y7\307\227dh|~\226\4o\357Jo\7<\305\224\14\203\31+\302~{\247K\335\356q\271\3306=u\242\373n\301\270\223\37yUZ\371\325\355A\3320g\310\213\36\356{\4\247\256\11\363\346\261E\21\267\355\374\2603\13\246v#\323", ) == 0x0
 02033  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135\231\2527\362\3537E\242\3617\362\3537E\242\3617\362\3537E\242\3617\362\3537E\242\3617\362\3537EiS\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02034  1096   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02035  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02031  1736   NtResumeThread  ... 1, ) == 0x0
 02036  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 50397184, 1048576, ) == 0x0
 02037  1736   NtAllocateVirtualMemory  (-1, 51437568, 0, 8192, 4096, 4, ... 51437568, 8192, ) == 0x0
 02038  1736   NtProtectVirtualMemory  (-1, (0x310e000), 4096, 260, ... (0x310e000), 4096, 4, ) == 0x0
 02039  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 472, {1636, 1924}, ) == 0x0
 02040  1736   NtQueryInformationThread  (472, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1636,Tid=1924,}, 0x0, ) == 0x0
 02041  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75579, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75579, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0d\6\0\0\204\7\0\0" ...  ...
 02035  1096   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02042   940   NtTestAlert  (...
 02043  1096   NtQuerySystemInformation  (Performance, 312, ...
 02042   940   NtTestAlert  ... ) == 0x0
 02043  1096   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02044   940   NtContinue  (50396464, 1, ...
 02045  1096   NtQuerySystemInformation  (Exception, 16, ...
 02046   940   NtRegisterThreadTerminatePort  (24, ...
 02045  1096   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02046   940   NtRegisterThreadTerminatePort  ... ) == 0x0
 02047  1096   NtQuerySystemInformation  (Lookaside, 32, ...
 02041  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75580, 0}  ... {28, 56, reply, 0, 1636, 1736, 75580, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0d\6\0\0\204\7\0\0" )  ) == 0x0
 02048   940   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02049  1736   NtResumeThread  (472, ...
 02048   940   NtDuplicateObject  ... 476, ) == 0x0
 02049  1736   NtResumeThread  ... 1, ) == 0x0
 02050   940   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02051  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02050   940   NtWaitForSingleObject  ... ) == 0x102
 02051  1736   NtAllocateVirtualMemory  ... 51445760, 1048576, ) == 0x0
 02052   940   NtWaitForSingleObject  (164, 0, 0x0, ...
 02047  1096   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02053  1924   NtTestAlert  (...
 02054  1736   NtAllocateVirtualMemory  (-1, 52486144, 0, 8192, 4096, 4, ...
 02055  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02053  1924   NtTestAlert  ... ) == 0x0
 02054  1736   NtAllocateVirtualMemory  ... 52486144, 8192, ) == 0x0
 02055  1096   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02056  1924   NtContinue  (51445040, 1, ...
 02057  1736   NtProtectVirtualMemory  (-1, (0x320e000), 4096, 260, ...
 02058  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02059  1924   NtRegisterThreadTerminatePort  (24, ...
 02057  1736   NtProtectVirtualMemory  ... (0x320e000), 4096, 4, ) == 0x0
 02059  1924   NtRegisterThreadTerminatePort  ... ) == 0x0
 02060  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02058  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02060  1736   NtCreateThread  ... 480, {1636, 752}, ) == 0x0
 02061  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02062  1924   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02061  1096   NtCreateKey  ... -2147481440, 2, ) == 0x0
 02062  1924   NtDuplicateObject  ... 484, ) == 0x0
 02063  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "\274d\12\346a\370\252\350nk\36J\0\342Cb\376[\304=\6/\324\355z\204w\264\336\321\225\364\356\352\337\11a#\225O\21\6\276z\203YE\304\202zZ9\27r^\361\363A\206\374\212_\342\241\314m\364\34\277@x\207u\260\224\377\370$D\241", 80, ... , 0, 3,  (-2147481440, "Seed", 0, 3, "\274d\12\346a\370\252\350nk\36J\0\342Cb\376[\304=\6/\324\355z\204w\264\336\321\225\364\356\352\337\11a#\225O\21\6\276z\203YE\304\202zZ9\27r^\361\363A\206\374\212_\342\241\314m\364\34\277@x\207u\260\224\377\370$D\241", 80, ... , 80, ...
 02064  1924   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02063  1096   NtSetValueKey  ... ) == 0x0
 02064  1924   NtWaitForSingleObject  ... ) == 0x102
 02065  1096   NtClose  (-2147481440, ...
 02066  1924   NtWaitForSingleObject  (164, 0, 0x0, ...
 02067  1736   NtQueryInformationThread  (480, Basic, 28, ...
 02065  1096   NtClose  ... ) == 0x0
 02067  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1636,Tid=752,}, 0x0, ) == 0x0
 02033  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\227\276\5\303\237|\301\242P\345\225.X@\214\17\260y\344\356\236\310C\22\263k$\233\7\337\201qz\213\344\335\322@d'D\253_I\260v\323\352\312[.\6Qk\243\276\275\266%\315\273\241\350&3\237\316\305\270\12v\226\245\370T\214t\312&\353.^\360\5@b\3nL\314rv\1|\4eE!\271ga\30\216\177[\1\377@N%\314\251\26\36=9bn\271\37u\370\3^\265\217\300\316\2458\275\371\223\177@\232\375\214\234\347\31\2107,\316\230\367H\262\352\304%4S\374\34\323\216\254\373\210\212\375\334\370\241\236\204\274>A\306\277\371\234aj\346c%<\272\265\314\234\244\365AQ\354G\260\232)\277\35Q\5ox\372\22R\321\243\206\315\344\315|\0\220\237\260nL6t8\201\224\23\227\305\241\206O\310I\3746\340$)\370\200j\213ve\345u\15\206\203\333~&\355\241`qy\273\260;", ) , ) == 0x0
 02068  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75580, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75580, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0d\6\0\0\360\2\0\0" ...  ...
 02069  1096   NtDeviceIoControlFile  (372, 0, 0x0, 0x0, 0x390008,  (372, 0, 0x0, 0x0, 0x390008, "\256\2038\340\24H\252\341\35\221\251Z\2135\231\2527\362\3537E\242\3617\362\3537E\242\3617\362\3537E\242\3617\362\3537E\242\3617\362\3537E\242\3617\362\3537EiS\1\1r\216\223V\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02068  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75581, 0}  ... {28, 56, reply, 0, 1636, 1736, 75581, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0d\6\0\0\360\2\0\0" )  ) == 0x0
 02070  1096   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02071  1736   NtResumeThread  (480, ...
 02070  1096   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02072  1096   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 02073  1096   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 02074  1096   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 02075  1096   NtQuerySystemInformation  (Lookaside, 32, ...
 02071  1736   NtResumeThread  ... 1, ) == 0x0
 02076  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 52494336, 1048576, ) == 0x0
 02077  1736   NtAllocateVirtualMemory  (-1, 53534720, 0, 8192, 4096, 4, ... 53534720, 8192, ) == 0x0
 02078  1736   NtProtectVirtualMemory  (-1, (0x330e000), 4096, 260, ... (0x330e000), 4096, 4, ) == 0x0
 02079  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 488, {1636, 624}, ) == 0x0
 02080  1736   NtQueryInformationThread  (488, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1636,Tid=624,}, 0x0, ) == 0x0
 02081  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75581, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75581, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0d\6\0\0p\2\0\0" ...  ...
 02075  1096   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02082   752   NtTestAlert  (...
 02083  1096   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02082   752   NtTestAlert  ... ) == 0x0
 02083  1096   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02084   752   NtContinue  (52493616, 1, ...
 02085  1096   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02086   752   NtRegisterThreadTerminatePort  (24, ...
 02085  1096   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02086   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 02087  1096   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02081  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75582, 0}  ... {28, 56, reply, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0d\6\0\0p\2\0\0" )  ) == 0x0
 02088   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02089  1736   NtResumeThread  (488, ...
 02088   752   NtDuplicateObject  ... 492, ) == 0x0
 02089  1736   NtResumeThread  ... 1, ) == 0x0
 02090   752   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02091  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02090   752   NtWaitForSingleObject  ... ) == 0x102
 02091  1736   NtAllocateVirtualMemory  ... 53542912, 1048576, ) == 0x0
 02092   752   NtWaitForSingleObject  (164, 0, 0x0, ...
 02087  1096   NtCreateKey  ... -2147481440, 2, ) == 0x0
 02093   624   NtTestAlert  (...
 02094  1736   NtAllocateVirtualMemory  (-1, 54583296, 0, 8192, 4096, 4, ...
 02095  1096   NtSetValueKey  (-2147481440,  (-2147481440, "Seed", 0, 3, "bq\36\351\36267\240\336\261\11\343\14\203w\27kh\17g\351\206'0\201\26b8\5u\\215\3405\4>\336,\346\213q\36&*Q\241s6\352\352\242\256\207X\205\255\263\326\377cC},g\23\233\315b\320]\247\36\21\212\241~\312\234\231\203", 80, ... , 0, 3,  (-2147481440, "Seed", 0, 3, "bq\36\351\36267\240\336\261\11\343\14\203w\27kh\17g\351\206'0\201\26b8\5u\\215\3405\4>\336,\346\213q\36&*Q\241s6\352\352\242\256\207X\205\255\263\326\377cC},g\23\233\315b\320]\247\36\21\212\241~\312\234\231\203", 80, ... , 80, ...
 02093   624   NtTestAlert  ... ) == 0x0
 02094  1736   NtAllocateVirtualMemory  ... 54583296, 8192, ) == 0x0
 02095  1096   NtSetValueKey  ... ) == 0x0
 02096   624   NtContinue  (53542192, 1, ...
 02097  1736   NtProtectVirtualMemory  (-1, (0x340e000), 4096, 260, ...
 02098  1096   NtClose  (-2147481440, ...
 02099   624   NtRegisterThreadTerminatePort  (24, ...
 02097  1736   NtProtectVirtualMemory  ... (0x340e000), 4096, 4, ) == 0x0
 02098  1096   NtClose  ... ) == 0x0
 02099   624   NtRegisterThreadTerminatePort  ... ) == 0x0
 02100  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02069  1096   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\3 S\6\212x\236\215m\367\3@\336Ig\356\336D\310\22>c\3555X\16\256\364\231\3760+\312\314\334\345}\242\325,\234\14\310\331OO\271\366\27\23\367\253t`w\300?8\2654\220\36\2\205\214\311O\250\375\35\2358\234\337%n\345\231D\260\220;\360\344\224\35\4\346\207\341\242b\354\34\21\246\14G\326x\25\14\2\12\206\262\350\236\2208\7\36S8\255\321t\327R=\252\10 O\346f \230\236[|+\356\1\375\360\7\352\5QQd\7\16_\371\240\357w\312\207\215\3563j\327\275\30\350\338\202\226,\222\272\306\2\214\275/\302\366\342_\210=\13\267!n5\216\31\37*\1\206\321t'\353\232=\276\254\361?\333\317\245\302\272Q\226-\210\14\235\14$\325Cn\263\302\365\346\271j\11\202\314+,\16q\216\273\24\7\236\326\324U\324\260\256\357\370\26\7\2451\345\230F\234\366, ) , ) == 0x0
 02100  1736   NtCreateThread  ... 496, {1636, 312}, ) == 0x0
 02101   624   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 02102  1096   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02101   624   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 02102  1096   NtCreateEvent  ... 500, ) == 0x0
 02103   624   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02104  1096   NtSetEventBoostPriority  (412, ...
 02103   624   NtDuplicateObject  ... 504, ) == 0x0
 01888   928   NtWaitForSingleObject  ... ) == 0x0
 02104  1096   NtSetEventBoostPriority  ... ) == 0x0
 02105   928   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ...
 02106   624   NtWaitForSingleObject  (312, 0, 0x0, ...
 02105   928   NtAllocateVirtualMemory  ... 1396736, 4096, ) == 0x0
 02107  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 02108   928   NtSetEventBoostPriority  (312, ...
 02109  1736   NtQueryInformationThread  (496, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1636,Tid=312,}, 0x0, ) == 0x0
 02110  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75582, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0d\6\0\08\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0d\6\0\08\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75583, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75582, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0d\6\0\08\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0d\6\0\08\1\0\0" )  ) == 0x0
 02111  1736   NtResumeThread  (496, ... 1, ) == 0x0
 02112  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 54591488, 1048576, ) == 0x0
 02113  1736   NtAllocateVirtualMemory  (-1, 55631872, 0, 8192, 4096, 4, ... 55631872, 8192, ) == 0x0
 02114  1736   NtProtectVirtualMemory  (-1, (0x350e000), 4096, 260, ...
 02106   624   NtWaitForSingleObject  ... ) == 0x0
 02108   928   NtSetEventBoostPriority  ... ) == 0x0
 02115   312   NtTestAlert  (...
 02116   624   NtSetEventBoostPriority  (312, ...
 02117   928   NtWaitForSingleObject  (312, 0, 0x0, ...
 02115   312   NtTestAlert  ... ) == 0x0
 02107  1096   NtWaitForSingleObject  ... ) == 0x0
 02116   624   NtSetEventBoostPriority  ... ) == 0x0
 02118  1096   NtSetEventBoostPriority  (312, ...
 02119   312   NtContinue  (54590768, 1, ...
 02114  1736   NtProtectVirtualMemory  ... (0x350e000), 4096, 4, ) == 0x0
 02117   928   NtWaitForSingleObject  ... ) == 0x0
 02118  1096   NtSetEventBoostPriority  ... ) == 0x0
 02120   312   NtRegisterThreadTerminatePort  (24, ...
 02121   928   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02122  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02123   624   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02121   928   NtCreateEvent  ... 508, ) == 0x0
 02120   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 02122  1736   NtCreateThread  ... 512, {1636, 1124}, ) == 0x0
 02123   624   NtWaitForSingleObject  ... ) == 0x102
 02124  1096   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789420, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789420, 188, ...
 02125   928   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ...
 02126  1736   NtQueryInformationThread  (512, Basic, 28, ...
 02127   624   NtWaitForSingleObject  (164, 0, 0x0, ...
 02126  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1636,Tid=1124,}, 0x0, ) == 0x0
 02124  1096   NtConnectPort  ... 516, 0x0, 0x0, 0x0, 188, ) == 0x0
 02125   928   NtConnectPort  ... 520, 0x0, 0x0, 0x0, 188, ) == 0x0
 02128  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75583, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75583, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0d\6\0\0d\4\0\0" ...  ...
 02129  1096   NtRequestWaitReplyPort  (516, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721}  (516, {200, 224, new_msg, 0, 1330592, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\361\371\23\246\320YZz\370U\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0H@\25\0\273\272\204zx\1\24\0\360U\25\0h\1\24\0\0\0\0\0\0\0\0\0\360U\25\0P\0\0\0\370U\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\360\0\372\31\221|\200\363\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02130   928   NtRequestWaitReplyPort  (520, {200, 224, new_msg, 0, 2883626, 1364448, 12, 2}  (520, {200, 224, new_msg, 0, 2883626, 1364448, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\0;\24\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\364\305\363\361p\373U=\200Z\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0XZ\25\0\32\15Cx\1\24\0xZ\25\0h\1\24\0\0\0\0\0\0\0\0\0xZ\25\0P\0\0\0\200Z\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 02131   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 524, ) == 0x0
 02132   312   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 02133   312   NtWaitForSingleObject  (164, 0, 0x0, ...
 02129  1096   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1636, 1096, 75586, 0}  ... {200, 224, reply, 0, 1636, 1096, 75586, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\361\371\23\246\320YZz\370U\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0H@\25\0\273\272\204zx\1\24\0\360U\25\0h\1\24\0\0\0\0\0\0\0\0\0\360U\25\0P\0\0\0\370U\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\360\0\372\31\221|\200\363\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02130   928   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1636, 928, 75587, 0}  ... {200, 224, reply, 0, 1636, 928, 75587, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0;\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\364\305\363\361p\373U=\200Z\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0XZ\25\0\32\15Cx\1\24\0xZ\25\0h\1\24\0\0\0\0\0\0\0\0\0xZ\25\0P\0\0\0\200Z\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 02128  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75588, 0}  ... {28, 56, reply, 0, 1636, 1736, 75588, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0d\6\0\0d\4\0\0" )  ) == 0x0
 02134  1096   NtRequestWaitReplyPort  (516, {44, 68, new_msg, 0, 1636, 1096, 75568, 0}  (516, {44, 68, new_msg, 0, 1636, 1096, 75568, 0} "\1\332\0\0A\2\4\0\200Y\274\201Ni\257\341\264\311\275\201:\332R\200\377\377\377\377t\333\243\201\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 02135  1736   NtResumeThread  (512, ... 1, ) == 0x0
 02136  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 55640064, 1048576, ) == 0x0
 02134  1096   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1636, 1096, 75589, 0}  ... {40, 64, reply, 0, 1636, 1096, 75589, 0} "\2\332\243\201\4\0\0\0\200Y\274\201Ni\257\341\264\311\275\201:\332R\200X\373`\371t\333\243\201\320\1\0\0X-\12\0" )  ) == 0x0
 02137   928   NtRequestWaitReplyPort  (520, {44, 68, new_msg, 56, 0, 0, 0, 0}  (520, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0\210]\25\0\322\0\0\0" ...  ...
 02138  1124   NtTestAlert  (...
 02139  1096   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 02138  1124   NtTestAlert  ... ) == 0x0
 02139  1096   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 02140  1124   NtContinue  (55639344, 1, ...
 02141  1096   NtRequestWaitReplyPort  (516, {64, 88, new_msg, 56, 1378744, 15789932, 15790032, 0}  (516, {64, 88, new_msg, 56, 1378744, 15789932, 15790032, 0} "\10\357\360\0@\0\25\0\346\277\347w\320\357\360\0l\357\360\0\20\0\0\0\250.\362v,\12\25\0\1\0\0\0\200^\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\310\367\24\0" ...  ...
 02142  1124   NtRegisterThreadTerminatePort  (24, ...
 02143  1736   NtAllocateVirtualMemory  (-1, 56680448, 0, 8192, 4096, 4, ...
 02137   928   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1636, 928, 75590, 0}  ... {40, 64, reply, 0, 1636, 928, 75590, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 02142  1124   NtRegisterThreadTerminatePort  ... ) == 0x0
 02143  1736   NtAllocateVirtualMemory  ... 56680448, 8192, ) == 0x0
 02144   928   NtRequestWaitReplyPort  (520, {64, 88, new_msg, 56, 1310720, 11596276, 1400192, 0}  (520, {64, 88, new_msg, 56, 1310720, 11596276, 1400192, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0X`\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02141  1096   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1636, 1096, 75591, 0}  ... {64, 88, reply, 56, 1636, 1096, 75591, 0} "\10\357\360\0@\0\25\0\346\277\347w\320\357\360\0l\357\360\0\20\0\0\0\250.\362v,\12\25\0\1\0\0\0\200^\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\310\367\24\0" )  ) == 0x0
 02145  1736   NtProtectVirtualMemory  (-1, (0x360e000), 4096, 260, ...
 02146  1096   NtClose  (500, ...
 02145  1736   NtProtectVirtualMemory  ... (0x360e000), 4096, 4, ) == 0x0
 02144   928   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1636, 928, 75592, 0}  ... {64, 88, reply, 56, 1636, 928, 75592, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0X`\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02146  1096   NtClose  ... ) == 0x0
 02147  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02148  1124   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02149  1096   NtClose  (516, ...
 02147  1736   NtCreateThread  ... 500, {1636, 1624}, ) == 0x0
 02148  1124   NtDuplicateObject  ... 528, ) == 0x0
 02149  1096   NtClose  ... ) == 0x0
 02150   928   NtRequestWaitReplyPort  (520, {44, 68, new_msg, 56, 1636, 928, 75590, 0}  (520, {44, 68, new_msg, 56, 1636, 928, 75590, 0} "\1\356\0\0B\2\3\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\210]\25\0\322\0\0\0" ...  ...
 02151  1124   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02152  1736   NtQueryInformationThread  (500, Basic, 28, ...
 02151  1124   NtWaitForSingleObject  ... ) == 0x102
 02152  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1636,Tid=1624,}, 0x0, ) == 0x0
 02150   928   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1636, 928, 75594, 0}  ... {40, 64, reply, 0, 1636, 928, 75594, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\351\1\0\0\350\232\14\0" )  ) == 0x0
 02153  1124   NtWaitForSingleObject  (164, 0, 0x0, ...
 02154  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75588, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75588, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0d\6\0\0X\6\0\0" ...  ...
 02155   928   NtRequestWaitReplyPort  (520, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (520, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\350K\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02156  1096   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02154  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75595, 0}  ... {28, 56, reply, 0, 1636, 1736, 75595, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0d\6\0\0X\6\0\0" )  ) == 0x0
 02156  1096   NtCreateKey  ... 516, 2, ) == 0x0
 02157  1736   NtResumeThread  (500, ...
 02155   928   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1636, 928, 75596, 0}  ... {64, 88, reply, 56, 1636, 928, 75596, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\350K\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02158  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02157  1736   NtResumeThread  ... 1, ) == 0x0
 02158  1096   NtOpenKey  ... 532, ) == 0x0
 02159  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02160  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02159  1736   NtAllocateVirtualMemory  ... 56688640, 1048576, ) == 0x0
 02160  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02161  1736   NtAllocateVirtualMemory  (-1, 57729024, 0, 8192, 4096, 4, ...
 02162   928   NtRequestWaitReplyPort  (520, {44, 68, new_msg, 56, 1636, 928, 75594, 0}  (520, {44, 68, new_msg, 56, 1636, 928, 75594, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\210]\25\0\322\0\0\0" ...  ...
 02163  1624   NtTestAlert  (...
 02161  1736   NtAllocateVirtualMemory  ... 57729024, 8192, ) == 0x0
 02163  1624   NtTestAlert  ... ) == 0x0
 02164  1736   NtProtectVirtualMemory  (-1, (0x370e000), 4096, 260, ...
 02162   928   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1636, 928, 75597, 0}  ... {40, 64, reply, 0, 1636, 928, 75597, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0|\1\0\0h\236\14\0" )  ) == 0x0
 02165  1624   NtContinue  (56687920, 1, ...
 02166  1096   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 02167   928   NtRequestWaitReplyPort  (520, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (520, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\340N\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02168  1624   NtRegisterThreadTerminatePort  (24, ...
 02166  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02168  1624   NtRegisterThreadTerminatePort  ... ) == 0x0
 02169  1096   NtQueryValueKey  (516,  (516, "Domain", Partial, 144, ... , Partial, 144, ...
 02167   928   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1636, 928, 75598, 0}  ... {64, 88, reply, 56, 1636, 928, 75598, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\340N\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02164  1736   NtProtectVirtualMemory  ... (0x370e000), 4096, 4, ) == 0x0
 02169  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02170  1624   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02171  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02172  1096   NtQueryValueKey  (516,  (516, "Domain", Partial, 144, ... , Partial, 144, ...
 02170  1624   NtDuplicateObject  ... 536, ) == 0x0
 02171  1736   NtCreateThread  ... 540, {1636, 1440}, ) == 0x0
 02172  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02173  1624   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02174  1736   NtQueryInformationThread  (540, Basic, 28, ...
 02175   928   NtClose  (508, ...
 02173  1624   NtWaitForSingleObject  ... ) == 0x102
 02174  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1636,Tid=1440,}, 0x0, ) == 0x0
 02175   928   NtClose  ... ) == 0x0
 02176  1624   NtWaitForSingleObject  (164, 0, 0x0, ...
 02177  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75595, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75595, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0d\6\0\0\240\5\0\0" ...  ...
 02178   928   NtClose  (520, ...
 02179  1096   NtClose  (516, ...
 02178   928   NtClose  ... ) == 0x0
 02179  1096   NtClose  ... ) == 0x0
 02180   928   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02181  1096   NtClose  (532, ...
 02180   928   NtCreateEvent  ... 516, ) == 0x0
 02181  1096   NtClose  ... ) == 0x0
 02177  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75600, 0}  ... {28, 56, reply, 0, 1636, 1736, 75600, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0d\6\0\0\240\5\0\0" )  ) == 0x0
 02182  1096   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 02183  1736   NtResumeThread  (540, ...
 02182  1096   NtOpenKey  ... 532, ) == 0x0
 02183  1736   NtResumeThread  ... 1, ) == 0x0
 02184   928   NtOpenThreadToken  (-2, 0xc, 1, ...
 02185  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02184   928   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02185  1736   NtAllocateVirtualMemory  ... 57737216, 1048576, ) == 0x0
 02186   928   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02187  1096   NtQueryValueKey  (532,  (532, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 02188  1440   NtTestAlert  (...
 02186   928   NtCreateEvent  ... 520, ) == 0x0
 02187  1096   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02188  1440   NtTestAlert  ... ) == 0x0
 02189   928   NtOpenThreadToken  (-2, 0xc, 1, ...
 02190  1096   NtClose  (532, ...
 02191  1440   NtContinue  (57736496, 1, ...
 02189   928   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02190  1096   NtClose  ... ) == 0x0
 02192  1440   NtRegisterThreadTerminatePort  (24, ...
 02193  1736   NtAllocateVirtualMemory  (-1, 58777600, 0, 8192, 4096, 4, ...
 02194  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15789008, ... }, 15789008, ...
 02192  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 02193  1736   NtAllocateVirtualMemory  ... 58777600, 8192, ) == 0x0
 02194  1096   NtQueryAttributesFile  ... ) == 0x0
 02195   928   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02196  1736   NtProtectVirtualMemory  (-1, (0x380e000), 4096, 260, ...
 02197  1440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02195   928   NtSetInformationThread  ... ) == 0x0
 02196  1736   NtProtectVirtualMemory  ... (0x380e000), 4096, 4, ) == 0x0
 02197  1440   NtDuplicateObject  ... 532, ) == 0x0
 02198   928   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11595968,  (0xc0100080, {24, 0, 0x40, 0, 11595968, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02199  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02200  1440   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02198   928   NtCreateFile  ... 508, {status=0x0, info=1}, ) == 0x0
 02199  1736   NtCreateThread  ... 544, {1636, 1516}, ) == 0x0
 02200  1440   NtWaitForSingleObject  ... ) == 0x102
 02201   928   NtSetInformationFile  (508, 11596024, 8, Pipe, ...
 02202  1096   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02203  1440   NtWaitForSingleObject  (164, 0, 0x0, ...
 02201   928   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02202  1096   NtOpenFile  ... 548, {status=0x0, info=1}, ) == 0x0
 02204  1736   NtQueryInformationThread  (544, Basic, 28, ...
 02205  1096   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 548, ...
 02204  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1636,Tid=1516,}, 0x0, ) == 0x0
 02205  1096   NtCreateSection  ... 552, ) == 0x0
 02206  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75600, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75600, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0d\6\0\0\354\5\0\0" ...  ...
 02207  1096   NtClose  (548, ...
 02206  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75601, 0}  ... {28, 56, reply, 0, 1636, 1736, 75601, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0d\6\0\0\354\5\0\0" )  ) == 0x0
 02207  1096   NtClose  ... ) == 0x0
 02208  1736   NtResumeThread  (544, ...
 02209   928   NtSetInformationFile  (508, 11596012, 8, Completion, ...
 02210  1096   NtMapViewOfSection  (552, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02209   928   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02210  1096   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 02211   928   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02212  1096   NtClose  (552, ...
 02211   928   NtSetInformationThread  ... ) == 0x0
 02212  1096   NtClose  ... ) == 0x0
 02213   928   NtWriteFile  (508, 189, 0, 0,  (508, 189, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 02214  1096   NtUnmapViewOfSection  (-1, 0x360000, ...
 02213   928   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 02214  1096   NtUnmapViewOfSection  ... ) == 0x0
 02208  1736   NtResumeThread  ... 1, ) == 0x0
 02215   928   NtReadFile  (508, 189, 0, 0, 1024, {0, 0}, 0, ...
 02216  1516   NtWaitForSingleObject  (128, 0, 0x0, ...
 02217  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02215   928   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20P+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02217  1736   NtAllocateVirtualMemory  ... 58785792, 1048576, ) == 0x0
 02218   928   NtFsControlFile  (508, 189, 0x0, 0x0, 0x11c017,  (508, 189, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\260\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 02219  1736   NtAllocateVirtualMemory  (-1, 59826176, 0, 8192, 4096, 4, ...
 02218   928   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20P+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02219  1736   NtAllocateVirtualMemory  ... 59826176, 8192, ) == 0x0
 02220   928   NtFsControlFile  (508, 189, 0x0, 0x0, 0x11c017,  (508, 189, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\10\233 IE*dK\202\302\222yAZ\332\256\1\0\0\0\1\0\0\0&\0(\00Q\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 02221  1736   NtProtectVirtualMemory  (-1, (0x390e000), 4096, 260, ...
 02220   928   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\10\233 IE*dK\202\302\222yAZ\332\256\0\0\0\0", ) , ) == 0x103
 02222  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15789316, ... }, 15789316, ...
 02221  1736   NtProtectVirtualMemory  ... (0x390e000), 4096, 4, ) == 0x0
 02222  1096   NtQueryAttributesFile  ... ) == 0x0
 02223  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02224  1096   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02223  1736   NtCreateThread  ... 552, {1636, 1664}, ) == 0x0
 02224  1096   NtOpenFile  ... 548, {status=0x0, info=1}, ) == 0x0
 02225  1736   NtQueryInformationThread  (552, Basic, 28, ...
 02226  1096   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 548, ...
 02225  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1636,Tid=1664,}, 0x0, ) == 0x0
 02226  1096   NtCreateSection  ... 556, ) == 0x0
 02227  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75601, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75601, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0d\6\0\0\200\6\0\0" ...  ...
 02228   928   NtFsControlFile  (508, 189, 0x0, 0x0, 0x11c017,  (508, 189, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\10\233 IE*dK\202\302\222yAZ\332\256", 44, 1024, ... , 44, 1024, ...
 02229  1096   NtQuerySection  (556, Image, 48, ...
 02228   928   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\360R\25\0\1\0\0\0\374R\25\0 \0\0\0\1\0\0\0\30\0\32\0\10S\25\0$S\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0XS\25\0\1\0\0\0\5\0\15\0hS\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02229  1096   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02230   928   NtClose  (520, ...
 02231  1096   NtClose  (548, ...
 02230   928   NtClose  ... ) == 0x0
 02231  1096   NtClose  ... ) == 0x0
 02232   928   NtClose  (508, ...
 02233  1096   NtMapViewOfSection  (556, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 32768, ) == 0x0
 02234  1096   NtClose  (556, ... ) == 0x0
 02235  1096   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02236  1096   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02227  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75602, 0}  ... {28, 56, reply, 0, 1636, 1736, 75602, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0d\6\0\0\200\6\0\0" )  ) == 0x0
 02232   928   NtClose  ... ) == 0x0
 02237  1736   NtResumeThread  (552, ...
 02238   928   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1330592, 0x0, 11597892, 188, ... , {12, 2, 1, 1}, 0x0, 1330592, 0x0, 11597892, 188, ...
 02237  1736   NtResumeThread  ... 1, ) == 0x0
 02239  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 59834368, 1048576, ) == 0x0
 02238   928   NtSecureConnectPort  ... 556, 0x0, 0x0, 0x0, 188, ) == 0x0
 02240  1096   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02241  1664   NtWaitForSingleObject  (128, 0, 0x0, ...
 02242   928   NtOpenThreadToken  (-2, 0xc, 1, ...
 02240  1096   NtFlushInstructionCache  ... ) == 0x0
 02242   928   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02243  1096   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02244  1736   NtAllocateVirtualMemory  (-1, 60874752, 0, 8192, 4096, 4, ...
 02243  1096   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02244  1736   NtAllocateVirtualMemory  ... 60874752, 8192, ) == 0x0
 02245  1096   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02246  1736   NtProtectVirtualMemory  (-1, (0x3a0e000), 4096, 260, ...
 02245  1096   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02246  1736   NtProtectVirtualMemory  ... (0x3a0e000), 4096, 4, ) == 0x0
 02247   928   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02248  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02247   928   NtSetInformationThread  ... ) == 0x0
 02248  1736   NtCreateThread  ... 508, {1636, 1656}, ) == 0x0
 02249   928   NtRequestWaitReplyPort  (556, {200, 224, new_msg, 0, 1364448, 12, 2, 1310977}  (556, {200, 224, new_msg, 0, 1364448, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\177\321\11e\262\211y\222=m\337'Z\346\227\277\12\0\0\0K\333\203\253\362\274\311\250\0\0\0\0`-\25\0)S\257\30\261\234(6(\0\0\0-C\0\346\0\0\24\0\240\366\260\0\21h=c\0\0\0\0\200Z\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02250  1096   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02251  1096   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 548, ) }, ... 548, ) == 0x0
 02252  1096   NtMapViewOfSection  (548, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 02249   928   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1636, 928, 75604, 0}  ... {200, 224, reply, 0, 1636, 928, 75604, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\177\321\11e\262\211y\222=m\337'Z\346\227\277\12\0\0\0K\333\203\253\362\274\311\250\0\0\0\0`-\25\0)S\257\30\261\234(6(\0\0\0-C\0\346\0\0\24\0\240\366\260\0\21h=c\0\0\0\0\200Z\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02253  1736   NtQueryInformationThread  (508, Basic, 28, ...
 02254   928   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02253  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1636,Tid=1656,}, 0x0, ) == 0x0
 02255  1096   NtClose  (548, ...
 02256  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75602, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75602, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0d\6\0\0x\6\0\0" ...  ...
 02255  1096   NtClose  ... ) == 0x0
 02256  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75605, 0}  ... {28, 56, reply, 0, 1636, 1736, 75605, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0d\6\0\0x\6\0\0" )  ) == 0x0
 02257  1096   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ...
 02258  1736   NtResumeThread  (508, ...
 02257  1096   NtProtectVirtualMemory  ... (0x76f61000), 4096, 32, ) == 0x0
 02254   928   NtSetInformationThread  ... ) == 0x0
 02259  1096   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 02260   928   NtRequestWaitReplyPort  (556, {56, 80, new_msg, 0, 44, 3, 20, 0}  (556, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0E*dK\202\302\222yAZ\332\256\1\0\0\0\0\0\0\0&\0(\0x\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02259  1096   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 02258  1736   NtResumeThread  ... 1, ) == 0x0
 02261  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 60882944, 1048576, ) == 0x0
 02262  1736   NtAllocateVirtualMemory  (-1, 61923328, 0, 8192, 4096, 4, ... 61923328, 8192, ) == 0x0
 02263  1736   NtProtectVirtualMemory  (-1, (0x3b0e000), 4096, 260, ... (0x3b0e000), 4096, 4, ) == 0x0
 02264  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 548, {1636, 1036}, ) == 0x0
 02265  1736   NtQueryInformationThread  (548, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1636,Tid=1036,}, 0x0, ) == 0x0
 02266  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75605, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75605, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0d\6\0\0\14\4\0\0" ...  ...
 02267  1096   NtFlushInstructionCache  (-1, 1995837440, 228, ...
 02268  1656   NtWaitForSingleObject  (128, 0, 0x0, ...
 02267  1096   NtFlushInstructionCache  ... ) == 0x0
 02269  1096   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02270  1096   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02271  1096   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02272  1096   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02273  1096   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02266  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75607, 0}  ... {28, 56, reply, 0, 1636, 1736, 75607, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0d\6\0\0\14\4\0\0" )  ) == 0x0
 02260   928   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1636, 928, 75606, 0}  ... {44, 68, reply, 0, 1636, 928, 75606, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02274  1736   NtResumeThread  (548, ...
 02275   928   NtRaiseException  (11598352, 11597612, 1, ...
 02274  1736   NtResumeThread  ... 1, ) == 0x0
 02276   928   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 02277  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02278  1096   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 02279  1036   NtWaitForSingleObject  (128, 0, 0x0, ...
 02277  1736   NtAllocateVirtualMemory  ... 61931520, 1048576, ) == 0x0
 02278  1096   NtFlushInstructionCache  ... ) == 0x0
 02276   928   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 02280  1096   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... }, ...
 02281   928   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 02280  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02281   928   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02282  1096   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02283   928   NtContinue  (11596580, 0, ...
 02282  1096   NtCreateEvent  ... 520, ) == 0x0
 02284  1736   NtAllocateVirtualMemory  (-1, 62971904, 0, 8192, 4096, 4, ... 62971904, 8192, ) == 0x0
 02285  1736   NtProtectVirtualMemory  (-1, (0x3c0e000), 4096, 260, ... (0x3c0e000), 4096, 4, ) == 0x0
 02286  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 560, {1636, 484}, ) == 0x0
 02287  1736   NtQueryInformationThread  (560, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1636,Tid=484,}, 0x0, ) == 0x0
 02288  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75607, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75607, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0d\6\0\0\344\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75608, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0d\6\0\0\344\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75608, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75607, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0d\6\0\0\344\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75608, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0d\6\0\0\344\1\0\0" )  ) == 0x0
 02289  1736   NtResumeThread  (560, ...
 02290  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... }, ...
 02291   928   NtDeviceIoControlFile  (376, 136, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 02290  1096   NtOpenKey  ... 564, ) == 0x0
 02291   928   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 02292  1096   NtQueryValueKey  (564,  (564, "LdapClientIntegrity", Partial, 144, ... , Partial, 144, ...
 02293   928   NtWaitForSingleObject  (136, 1, {-5000000, -1}, ...
 02292  1096   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02294  1096   NtClose  (564, ... ) == 0x0
 02295  1096   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02296  1096   NtQueryPerformanceCounter  (... {1109264772, 16}, {3579545, 0}, ) == 0x0
 02297  1096   NtSetEventBoostPriority  (128, ...
 02216  1516   NtWaitForSingleObject  ... ) == 0x0
 02298  1516   NtSetEventBoostPriority  (128, ...
 02241  1664   NtWaitForSingleObject  ... ) == 0x0
 02299  1664   NtSetEventBoostPriority  (128, ...
 02268  1656   NtWaitForSingleObject  ... ) == 0x0
 02300  1656   NtSetEventBoostPriority  (128, ...
 02279  1036   NtWaitForSingleObject  ... ) == 0x0
 02301  1036   NtTestAlert  (... ) == 0x0
 02300  1656   NtSetEventBoostPriority  ... ) == 0x0
 02299  1664   NtSetEventBoostPriority  ... ) == 0x0
 02298  1516   NtSetEventBoostPriority  ... ) == 0x0
 02297  1096   NtSetEventBoostPriority  ... ) == 0x0
 02289  1736   NtResumeThread  ... 1, ) == 0x0
 02302  1036   NtContinue  (61930800, 1, ...
 02303   484   NtTestAlert  (...
 02304  1656   NtTestAlert  (...
 02305  1664   NtTestAlert  (...
 02306  1516   NtTestAlert  (...
 02307  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02308  1036   NtRegisterThreadTerminatePort  (24, ...
 02303   484   NtTestAlert  ... ) == 0x0
 02304  1656   NtTestAlert  ... ) == 0x0
 02305  1664   NtTestAlert  ... ) == 0x0
 02306  1516   NtTestAlert  ... ) == 0x0
 02307  1736   NtAllocateVirtualMemory  ... 62980096, 1048576, ) == 0x0
 02308  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 02309   484   NtContinue  (62979376, 1, ...
 02310  1656   NtContinue  (60882224, 1, ...
 02311  1664   NtContinue  (59833648, 1, ...
 02312  1516   NtContinue  (58785072, 1, ...
 02313  1736   NtAllocateVirtualMemory  (-1, 64020480, 0, 8192, 4096, 4, ...
 02314  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02315   484   NtRegisterThreadTerminatePort  (24, ...
 02316  1656   NtRegisterThreadTerminatePort  (24, ...
 02317  1664   NtRegisterThreadTerminatePort  (24, ...
 02318  1516   NtRegisterThreadTerminatePort  (24, ...
 02313  1736   NtAllocateVirtualMemory  ... 64020480, 8192, ) == 0x0
 02314  1036   NtDuplicateObject  ... 564, ) == 0x0
 02315   484   NtRegisterThreadTerminatePort  ... ) == 0x0
 02316  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 02317  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 02318  1516   NtRegisterThreadTerminatePort  ... ) == 0x0
 02319  1736   NtProtectVirtualMemory  (-1, (0x3d0e000), 4096, 260, ...
 02320  1036   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02321  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15789008, ... }, 15789008, ...
 02322  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02323  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02324  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02325   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02319  1736   NtProtectVirtualMemory  ... (0x3d0e000), 4096, 4, ) == 0x0
 02321  1096   NtQueryAttributesFile  ... ) == 0x0
 02320  1036   NtWaitForSingleObject  ... ) == 0x102
 02322  1656   NtDuplicateObject  ... 568, ) == 0x0
 02323  1664   NtDuplicateObject  ... 572, ) == 0x0
 02325   484   NtDuplicateObject  ... 576, ) == 0x0
 02326  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02327  1096   NtQuerySystemInformation  (Basic, 44, ...
 02328  1036   NtWaitForSingleObject  (164, 0, 0x0, ...
 02329  1656   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02330  1664   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02331   484   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02326  1736   NtCreateThread  ... 580, {1636, 1292}, ) == 0x0
 02327  1096   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02329  1656   NtWaitForSingleObject  ... ) == 0x102
 02330  1664   NtWaitForSingleObject  ... ) == 0x102
 02331   484   NtWaitForSingleObject  ... ) == 0x102
 02332  1736   NtQueryInformationThread  (580, Basic, 28, ...
 02333  1096   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ...
 02334  1656   NtWaitForSingleObject  (164, 0, 0x0, ...
 02335  1664   NtWaitForSingleObject  (164, 0, 0x0, ...
 02336   484   NtWaitForSingleObject  (164, 0, 0x0, ...
 02332  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1636,Tid=1292,}, 0x0, ) == 0x0
 02333  1096   NtAllocateVirtualMemory  ... 3538944, 65536, ) == 0x0
 02324  1516   NtDuplicateObject  ... 584, ) == 0x0
 02337  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75608, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75608, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0d\6\0\0\14\5\0\0" ...  ...
 02338  1516   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02339  1096   NtAllocateVirtualMemory  (-1, 3538944, 0, 4096, 4096, 4, ...
 02338  1516   NtWaitForSingleObject  ... ) == 0x102
 02339  1096   NtAllocateVirtualMemory  ... 3538944, 4096, ) == 0x0
 02340  1516   NtWaitForSingleObject  (164, 0, 0x0, ...
 02341  1096   NtAllocateVirtualMemory  (-1, 3543040, 0, 8192, 4096, 4, ... 3543040, 8192, ) == 0x0
 02342  1096   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ... 1404928, 4096, ) == 0x0
 02343  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15789008, ... ) }, 15789008, ... ) == 0x0
 02344  1096   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 588, {status=0x0, info=1}, ) }, 5, 96, ... 588, {status=0x0, info=1}, ) == 0x0
 02345  1096   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 588, ... 592, ) == 0x0
 02337  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75609, 0}  ... {28, 56, reply, 0, 1636, 1736, 75609, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0d\6\0\0\14\5\0\0" )  ) == 0x0
 02346  1736   NtResumeThread  (580, ... 1, ) == 0x0
 02347  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 64028672, 1048576, ) == 0x0
 02348  1736   NtAllocateVirtualMemory  (-1, 65069056, 0, 8192, 4096, 4, ... 65069056, 8192, ) == 0x0
 02349  1736   NtProtectVirtualMemory  (-1, (0x3e0e000), 4096, 260, ... (0x3e0e000), 4096, 4, ) == 0x0
 02350  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 596, {1636, 1956}, ) == 0x0
 02351  1096   NtClose  (588, ...
 02352  1292   NtWaitForSingleObject  (128, 0, 0x0, ...
 02351  1096   NtClose  ... ) == 0x0
 02353  1096   NtMapViewOfSection  (592, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 110592, ) == 0x0
 02354  1096   NtClose  (592, ... ) == 0x0
 02355  1096   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 02356  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15789316, ... ) }, 15789316, ... ) == 0x0
 02357  1096   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 592, {status=0x0, info=1}, ) }, 5, 96, ... 592, {status=0x0, info=1}, ) == 0x0
 02358  1736   NtQueryInformationThread  (596, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1636,Tid=1956,}, 0x0, ) == 0x0
 02359  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75609, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75609, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0\244\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75610, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0\244\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75610, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75609, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0\244\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75610, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0d\6\0\0\244\7\0\0" )  ) == 0x0
 02360  1736   NtResumeThread  (596, ... 1, ) == 0x0
 02361  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 65077248, 1048576, ) == 0x0
 02362  1736   NtAllocateVirtualMemory  (-1, 66117632, 0, 8192, 4096, 4, ... 66117632, 8192, ) == 0x0
 02363  1736   NtProtectVirtualMemory  (-1, (0x3f0e000), 4096, 260, ...
 02364  1096   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 592, ...
 02365  1956   NtWaitForSingleObject  (128, 0, 0x0, ...
 02364  1096   NtCreateSection  ... 588, ) == 0x0
 02366  1096   NtQuerySection  (588, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02367  1096   NtClose  (592, ... ) == 0x0
 02368  1096   NtMapViewOfSection  (588, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x751d0000), 0x0, 122880, ) == 0x0
 02369  1096   NtClose  (588, ... ) == 0x0
 02370  1096   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02363  1736   NtProtectVirtualMemory  ... (0x3f0e000), 4096, 4, ) == 0x0
 02371  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 588, {1636, 1980}, ) == 0x0
 02372  1736   NtQueryInformationThread  (588, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1636,Tid=1980,}, 0x0, ) == 0x0
 02373  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75610, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75610, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0d\6\0\0\274\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75611, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0d\6\0\0\274\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75611, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75610, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0d\6\0\0\274\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75611, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0d\6\0\0\274\7\0\0" )  ) == 0x0
 02374  1736   NtResumeThread  (588, ... 1, ) == 0x0
 02375  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 66125824, 1048576, ) == 0x0
 02376  1096   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ...
 02377  1980   NtWaitForSingleObject  (128, 0, 0x0, ...
 02376  1096   NtProtectVirtualMemory  ... (0x751d1000), 4096, 4, ) == 0x0
 02378  1096   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02379  1096   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02380  1096   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02381  1096   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02382  1096   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02383  1736   NtAllocateVirtualMemory  (-1, 67166208, 0, 8192, 4096, 4, ... 67166208, 8192, ) == 0x0
 02384  1736   NtProtectVirtualMemory  (-1, (0x400e000), 4096, 260, ... (0x400e000), 4096, 4, ) == 0x0
 02385  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 592, {1636, 1480}, ) == 0x0
 02386  1736   NtQueryInformationThread  (592, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1636,Tid=1480,}, 0x0, ) == 0x0
 02387  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75611, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75611, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0d\6\0\0\310\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75612, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0d\6\0\0\310\5\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75612, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75611, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0d\6\0\0\310\5\0\0" ... {28, 56, reply, 0, 1636, 1736, 75612, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0d\6\0\0\310\5\0\0" )  ) == 0x0
 02388  1736   NtResumeThread  (592, ...
 02389  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 15788492, ... }, 15788492, ...
 02388  1736   NtResumeThread  ... 1, ) == 0x0
 02390  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 67174400, 1048576, ) == 0x0
 02391  1736   NtAllocateVirtualMemory  (-1, 68214784, 0, 8192, 4096, 4, ... 68214784, 8192, ) == 0x0
 02392  1736   NtProtectVirtualMemory  (-1, (0x410e000), 4096, 260, ...
 02393  1480   NtWaitForSingleObject  (128, 0, 0x0, ...
 02392  1736   NtProtectVirtualMemory  ... (0x410e000), 4096, 4, ) == 0x0
 02394  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 600, {1636, 1556}, ) == 0x0
 02395  1736   NtQueryInformationThread  (600, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1636,Tid=1556,}, 0x0, ) == 0x0
 02396  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75612, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75612, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0d\6\0\0\24\6\0\0" ...  ...
 02389  1096   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02397  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 15788492, ... ) }, 15788492, ... ) == 0x0
 02398  1096   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 604, {status=0x0, info=1}, ) }, 5, 96, ... 604, {status=0x0, info=1}, ) == 0x0
 02399  1096   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 604, ... 608, ) == 0x0
 02400  1096   NtQuerySection  (608, Image, 48, ...
 02396  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75613, 0}  ... {28, 56, reply, 0, 1636, 1736, 75613, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0d\6\0\0\24\6\0\0" )  ) == 0x0
 02401  1736   NtResumeThread  (600, ... 1, ) == 0x0
 02402  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 68222976, 1048576, ) == 0x0
 02403  1736   NtAllocateVirtualMemory  (-1, 69263360, 0, 8192, 4096, 4, ... 69263360, 8192, ) == 0x0
 02404  1736   NtProtectVirtualMemory  (-1, (0x420e000), 4096, 260, ... (0x420e000), 4096, 4, ) == 0x0
 02405  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 612, {1636, 460}, ) == 0x0
 02400  1096   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02406  1556   NtWaitForSingleObject  (128, 0, 0x0, ...
 02407  1096   NtClose  (604, ... ) == 0x0
 02408  1096   NtMapViewOfSection  (608, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 02409  1096   NtClose  (608, ... ) == 0x0
 02410  1096   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02411  1096   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02412  1096   NtFlushInstructionCache  (-1, 2006061056, 1368, ...
 02413  1736   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1636,Tid=460,}, 0x0, ) == 0x0
 02414  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75613, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75613, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0d\6\0\0\314\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75614, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0d\6\0\0\314\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75614, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75613, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0d\6\0\0\314\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75614, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0d\6\0\0\314\1\0\0" )  ) == 0x0
 02415  1736   NtResumeThread  (612, ... 1, ) == 0x0
 02416  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 69271552, 1048576, ) == 0x0
 02417  1736   NtAllocateVirtualMemory  (-1, 70311936, 0, 8192, 4096, 4, ... 70311936, 8192, ) == 0x0
 02418  1736   NtProtectVirtualMemory  (-1, (0x430e000), 4096, 260, ...
 02412  1096   NtFlushInstructionCache  ... ) == 0x0
 02419   460   NtWaitForSingleObject  (128, 0, 0x0, ...
 02420  1096   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02421  1096   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02422  1096   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02423  1096   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02424  1096   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02425  1096   NtFlushInstructionCache  (-1, 2006061056, 1368, ...
 02418  1736   NtProtectVirtualMemory  ... (0x430e000), 4096, 4, ) == 0x0
 02426  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 608, {1636, 1856}, ) == 0x0
 02427  1736   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1636,Tid=1856,}, 0x0, ) == 0x0
 02428  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75614, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75614, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0d\6\0\0@\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75615, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0d\6\0\0@\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75615, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75614, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0d\6\0\0@\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75615, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0d\6\0\0@\7\0\0" )  ) == 0x0
 02429  1736   NtResumeThread  (608, ... 1, ) == 0x0
 02430  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 70320128, 1048576, ) == 0x0
 02425  1096   NtFlushInstructionCache  ... ) == 0x0
 02431  1856   NtWaitForSingleObject  (128, 0, 0x0, ...
 02432  1096   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02433  1096   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02434  1096   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02435  1096   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02436  1096   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02437  1096   NtFlushInstructionCache  (-1, 2006061056, 1368, ...
 02438  1736   NtAllocateVirtualMemory  (-1, 71360512, 0, 8192, 4096, 4, ... 71360512, 8192, ) == 0x0
 02439  1736   NtProtectVirtualMemory  (-1, (0x440e000), 4096, 260, ... (0x440e000), 4096, 4, ) == 0x0
 02440  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 604, {1636, 1572}, ) == 0x0
 02441  1736   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1636,Tid=1572,}, 0x0, ) == 0x0
 02442  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75615, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75615, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0d\6\0\0$\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75616, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0d\6\0\0$\6\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75616, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75615, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0d\6\0\0$\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75616, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0d\6\0\0$\6\0\0" )  ) == 0x0
 02443  1736   NtResumeThread  (604, ...
 02437  1096   NtFlushInstructionCache  ... ) == 0x0
 02444  1096   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02445  1096   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02446  1096   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02447  1096   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02448  1096   NtAllocateVirtualMemory  (-1, 3629056, 0, 4096, 4096, 4, ... 3629056, 4096, ) == 0x0
 02449  1096   NtQueryDefaultUILanguage  (2090319928, ...
 02443  1736   NtResumeThread  ... 1, ) == 0x0
 02450  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 71368704, 1048576, ) == 0x0
 02451  1736   NtAllocateVirtualMemory  (-1, 72409088, 0, 8192, 4096, 4, ... 72409088, 8192, ) == 0x0
 02452  1736   NtProtectVirtualMemory  (-1, (0x450e000), 4096, 260, ... (0x450e000), 4096, 4, ) == 0x0
 02453  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 616, {1636, 1604}, ) == 0x0
 02454  1736   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1636,Tid=1604,}, 0x0, ) == 0x0
 02455  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75616, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75616, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0d\6\0\0D\6\0\0" ...  ...
 02456  1096   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ...
 02457  1572   NtWaitForSingleObject  (128, 0, 0x0, ...
 02456  1096   NtOpenThreadTokenEx  ... ) == STATUS_NO_TOKEN
 02458  1096   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481440, ) == 0x0
 02459  1096   NtQueryInformationToken  (-2147481440, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02460  1096   NtClose  (-2147481440, ... ) == 0x0
 02461  1096   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481440, ) }, ... -2147481440, ) == 0x0
 02462  1096   NtOpenKey  (0x80000000, {24, -2147481440, 0x240, 0, 0,  (0x80000000, {24, -2147481440, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02455  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75617, 0}  ... {28, 56, reply, 0, 1636, 1736, 75617, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0d\6\0\0D\6\0\0" )  ) == 0x0
 02463  1736   NtResumeThread  (616, ... 1, ) == 0x0
 02464  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 72417280, 1048576, ) == 0x0
 02465  1736   NtAllocateVirtualMemory  (-1, 73457664, 0, 8192, 4096, 4, ... 73457664, 8192, ) == 0x0
 02466  1736   NtProtectVirtualMemory  (-1, (0x460e000), 4096, 260, ... (0x460e000), 4096, 4, ) == 0x0
 02467  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1636, 1596}, ) == 0x0
 02468  1096   NtOpenKey  (0x80000000, {24, -2147481440, 0x640, 0, 0,  (0x80000000, {24, -2147481440, 0x640, 0, 0, "Control Panel\Desktop"}, ... }, ...
 02469  1604   NtWaitForSingleObject  (128, 0, 0x0, ...
 02468  1096   NtOpenKey  ... -2147481392, ) == 0x0
 02470  1096   NtQueryValueKey  (-2147481392,  (-2147481392, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02471  1096   NtClose  (-2147481392, ... ) == 0x0
 02472  1096   NtClose  (-2147481440, ... ) == 0x0
 02449  1096   NtQueryDefaultUILanguage  ... ) == 0x0
 02473  1096   NtAllocateVirtualMemory  (-1, 15777792, 0, 4096, 4096, 260, ... 15777792, 4096, ) == 0x0
 02474  1096   NtQueryInstallUILanguage  (2090319930, ...
 02475  1736   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1636,Tid=1596,}, 0x0, ) == 0x0
 02476  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75617, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75617, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0d\6\0\0<\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75618, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0d\6\0\0<\6\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75618, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75617, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0d\6\0\0<\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75618, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0d\6\0\0<\6\0\0" )  ) == 0x0
 02477  1736   NtResumeThread  (620, ... 1, ) == 0x0
 02478  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 73465856, 1048576, ) == 0x0
 02479  1736   NtAllocateVirtualMemory  (-1, 74506240, 0, 8192, 4096, 4, ... 74506240, 8192, ) == 0x0
 02480  1736   NtProtectVirtualMemory  (-1, (0x470e000), 4096, 260, ...
 02474  1096   NtQueryInstallUILanguage  ... ) == 0x0
 02481  1596   NtWaitForSingleObject  (128, 0, 0x0, ...
 02482  1096   NtQueryDefaultLocale  (1, 15789212, ... ) == 0x0
 02483  1096   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02484  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\Setup"}, ... 624, ) }, ... 624, ) == 0x0
 02485  1096   NtQueryValueKey  (624,  (624, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (624, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02486  1096   NtClose  (624, ... ) == 0x0
 02487  1096   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02480  1736   NtProtectVirtualMemory  ... (0x470e000), 4096, 4, ) == 0x0
 02488  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1636, 1240}, ) == 0x0
 02489  1736   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1636,Tid=1240,}, 0x0, ) == 0x0
 02490  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75618, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75618, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0d\6\0\0\330\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75619, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0d\6\0\0\330\4\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75619, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75618, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0d\6\0\0\330\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75619, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0d\6\0\0\330\4\0\0" )  ) == 0x0
 02491  1736   NtResumeThread  (624, ... 1, ) == 0x0
 02492  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74514432, 1048576, ) == 0x0
 02487  1096   NtCreateEvent  ... 628, ) == 0x0
 02493  1240   NtWaitForSingleObject  (128, 0, 0x0, ...
 02494  1096   NtCallbackReturn  (0, 0, 0, ...
 02495  1096   NtUserGetProcessWindowStation  (... ) == 0x1c
 02496  1096   NtUserGetObjectInformation  (28, 1, 15788808, 12, 15788820, ... ) == 0x1
 02497  1096   NtOpenKey  (0xf003f, {24, 36, 0x40, 0, 0,  (0xf003f, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02498  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\WPA\PnP"}, ... 632, ) }, ... 632, ) == 0x0
 02499  1096   NtQueryValueKey  (632,  (632, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (632, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 02500  1736   NtAllocateVirtualMemory  (-1, 75554816, 0, 8192, 4096, 4, ... 75554816, 8192, ) == 0x0
 02501  1736   NtProtectVirtualMemory  (-1, (0x480e000), 4096, 260, ... (0x480e000), 4096, 4, ) == 0x0
 02502  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 636, {1636, 1796}, ) == 0x0
 02503  1736   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1636,Tid=1796,}, 0x0, ) == 0x0
 02504  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75619, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75619, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\4\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75620, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\4\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75620, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75619, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\4\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75620, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0d\6\0\0\4\7\0\0" )  ) == 0x0
 02505  1736   NtResumeThread  (636, ...
 02506  1096   NtClose  (632, ... ) == 0x0
 02507  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\Setup"}, ... 632, ) }, ... 632, ) == 0x0
 02508  1096   NtQueryValueKey  (632,  (632, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02509  1096   NtQueryValueKey  (632,  (632, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02510  1096   NtClose  (632, ... ) == 0x0
 02511  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\Setup"}, ... 632, ) }, ... 632, ) == 0x0
 02505  1736   NtResumeThread  ... 1, ) == 0x0
 02512  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 75563008, 1048576, ) == 0x0
 02513  1736   NtAllocateVirtualMemory  (-1, 76603392, 0, 8192, 4096, 4, ... 76603392, 8192, ) == 0x0
 02514  1736   NtProtectVirtualMemory  (-1, (0x490e000), 4096, 260, ... (0x490e000), 4096, 4, ) == 0x0
 02515  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1636, 1156}, ) == 0x0
 02516  1096   NtQueryValueKey  (632,  (632, "SystemPartition", Partial, 144, ... , Partial, 144, ...
 02517  1796   NtWaitForSingleObject  (128, 0, 0x0, ...
 02516  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02518  1096   NtQueryValueKey  (632,  (632, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02519  1096   NtClose  (632, ... ) == 0x0
 02520  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 632, ) }, ... 632, ) == 0x0
 02521  1096   NtQueryValueKey  (632,  (632, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02522  1096   NtQueryValueKey  (632,  (632, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02523  1736   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1636,Tid=1156,}, 0x0, ) == 0x0
 02524  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75620, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75620, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0d\6\0\0\204\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75621, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0d\6\0\0\204\4\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75621, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75620, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0d\6\0\0\204\4\0\0" ... {28, 56, reply, 0, 1636, 1736, 75621, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0d\6\0\0\204\4\0\0" )  ) == 0x0
 02525  1736   NtResumeThread  (640, ... 1, ) == 0x0
 02526  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 76611584, 1048576, ) == 0x0
 02527  1736   NtAllocateVirtualMemory  (-1, 77651968, 0, 8192, 4096, 4, ... 77651968, 8192, ) == 0x0
 02528  1736   NtProtectVirtualMemory  (-1, (0x4a0e000), 4096, 260, ...
 02529  1096   NtClose  (632, ...
 02530  1156   NtWaitForSingleObject  (128, 0, 0x0, ...
 02529  1096   NtClose  ... ) == 0x0
 02531  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 632, ) }, ... 632, ) == 0x0
 02532  1096   NtQueryValueKey  (632,  (632, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02533  1096   NtQueryValueKey  (632,  (632, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02534  1096   NtClose  (632, ... ) == 0x0
 02535  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 632, ) }, ... 632, ) == 0x0
 02528  1736   NtProtectVirtualMemory  ... (0x4a0e000), 4096, 4, ) == 0x0
 02536  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1636, 712}, ) == 0x0
 02537  1736   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1636,Tid=712,}, 0x0, ) == 0x0
 02538  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75621, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75621, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0d\6\0\0\310\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75622, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0d\6\0\0\310\2\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75622, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75621, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0d\6\0\0\310\2\0\0" ... {28, 56, reply, 0, 1636, 1736, 75622, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0d\6\0\0\310\2\0\0" )  ) == 0x0
 02539  1736   NtResumeThread  (644, ... 1, ) == 0x0
 02540  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 77660160, 1048576, ) == 0x0
 02541  1096   NtQueryValueKey  (632,  (632, "ServicePackCachePath", Partial, 144, ... , Partial, 144, ...
 02542   712   NtWaitForSingleObject  (128, 0, 0x0, ...
 02541  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02543  1096   NtQueryValueKey  (632,  (632, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (632, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02544  1096   NtClose  (632, ... ) == 0x0
 02545  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 632, ) }, ... 632, ) == 0x0
 02546  1096   NtQueryValueKey  (632,  (632, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (632, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02547  1096   NtQueryValueKey  (632,  (632, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (632, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02548  1736   NtAllocateVirtualMemory  (-1, 78700544, 0, 8192, 4096, 4, ... 78700544, 8192, ) == 0x0
 02549  1736   NtProtectVirtualMemory  (-1, (0x4b0e000), 4096, 260, ... (0x4b0e000), 4096, 4, ) == 0x0
 02550  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 648, {1636, 1764}, ) == 0x0
 02551  1736   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1636,Tid=1764,}, 0x0, ) == 0x0
 02552  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75622, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75622, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0d\6\0\0\344\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75623, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0d\6\0\0\344\6\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75623, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75622, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0d\6\0\0\344\6\0\0" ... {28, 56, reply, 0, 1636, 1736, 75623, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0d\6\0\0\344\6\0\0" )  ) == 0x0
 02553  1736   NtResumeThread  (648, ...
 02554  1096   NtClose  (632, ... ) == 0x0
 02555  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 632, ) }, ... 632, ) == 0x0
 02556  1096   NtQueryValueKey  (632,  (632, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02557  1096   NtQueryValueKey  (632,  (632, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (632, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 02558  1096   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0
 02559  1096   NtClose  (632, ... ) == 0x0
 02553  1736   NtResumeThread  ... 1, ) == 0x0
 02560  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78708736, 1048576, ) == 0x0
 02561  1736   NtAllocateVirtualMemory  (-1, 79749120, 0, 8192, 4096, 4, ... 79749120, 8192, ) == 0x0
 02562  1736   NtProtectVirtualMemory  (-1, (0x4c0e000), 4096, 260, ... (0x4c0e000), 4096, 4, ) == 0x0
 02563  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1636, 1256}, ) == 0x0
 02564  1736   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1636,Tid=1256,}, 0x0, ) == 0x0
 02565  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75623, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75623, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0d\6\0\0\350\4\0\0" ...  ...
 02566  1096   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02567  1764   NtWaitForSingleObject  (128, 0, 0x0, ...
 02566  1096   NtCreateEvent  ... 652, ) == 0x0
 02568  1096   NtCreateMutant  (0x1f0001, 0x0, 0, ... 656, ) == 0x0
 02569  1096   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 660, ) == 0x0
 02570  1096   NtCreateMutant  (0x1f0001, 0x0, 0, ... 664, ) == 0x0
 02571  1096   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 668, ) == 0x0
 02572  1096   NtCreateMutant  (0x1f0001, 0x0, 0, ... 672, ) == 0x0
 02565  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75624, 0}  ... {28, 56, reply, 0, 1636, 1736, 75624, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0d\6\0\0\350\4\0\0" )  ) == 0x0
 02573  1736   NtResumeThread  (632, ... 1, ) == 0x0
 02574  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 79757312, 1048576, ) == 0x0
 02575  1736   NtAllocateVirtualMemory  (-1, 80797696, 0, 8192, 4096, 4, ... 80797696, 8192, ) == 0x0
 02576  1736   NtProtectVirtualMemory  (-1, (0x4d0e000), 4096, 260, ... (0x4d0e000), 4096, 4, ) == 0x0
 02577  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 676, {1636, 464}, ) == 0x0
 02578  1096   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... }, ...
 02579  1256   NtWaitForSingleObject  (128, 0, 0x0, ...
 02578  1096   NtOpenKey  ... 680, ) == 0x0
 02580  1096   NtQueryValueKey  (680,  (680, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (680, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02581  1096   NtQueryValueKey  (680,  (680, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (680, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02582  1096   NtQueryValueKey  (680,  (680, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02583  1096   NtOpenKey  (0x1, {24, 680, 0x40, 0, 0,  (0x1, {24, 680, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02584  1096   NtClose  (680, ... ) == 0x0
 02585  1736   NtQueryInformationThread  (676, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1636,Tid=464,}, 0x0, ) == 0x0
 02586  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75624, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75624, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\320\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75625, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\320\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75625, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75624, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\320\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75625, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0d\6\0\0\320\1\0\0" )  ) == 0x0
 02587  1736   NtResumeThread  (676, ... 1, ) == 0x0
 02588  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 80805888, 1048576, ) == 0x0
 02589  1736   NtAllocateVirtualMemory  (-1, 81846272, 0, 8192, 4096, 4, ... 81846272, 8192, ) == 0x0
 02590  1736   NtProtectVirtualMemory  (-1, (0x4e0e000), 4096, 260, ...
 02591  1096   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 15788724, ... }, 15788724, ...
 02592   464   NtWaitForSingleObject  (128, 0, 0x0, ...
 02591  1096   NtQueryAttributesFile  ... ) == 0x0
 02593  1096   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 680, ) }, ... 680, ) == 0x0
 02594  1096   NtQueryValueKey  (680,  (680, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (680, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (680, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02595  1096   NtClose  (680, ... ) == 0x0
 02596  1096   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 680, ) }, ... 680, ) == 0x0
 02597  1096   NtQueryValueKey  (680,  (680, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (680, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (680, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 02590  1736   NtProtectVirtualMemory  ... (0x4e0e000), 4096, 4, ) == 0x0
 02598  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 684, {1636, 444}, ) == 0x0
 02599  1736   NtQueryInformationThread  (684, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1636,Tid=444,}, 0x0, ) == 0x0
 02600  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75625, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75625, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\274\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75626, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\274\1\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75626, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75625, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\274\1\0\0" ... {28, 56, reply, 0, 1636, 1736, 75626, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0d\6\0\0\274\1\0\0" )  ) == 0x0
 02601  1736   NtResumeThread  (684, ... 1, ) == 0x0
 02602  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 81854464, 1048576, ) == 0x0
 02603  1096   NtClose  (680, ...
 02604   444   NtWaitForSingleObject  (128, 0, 0x0, ...
 02603  1096   NtClose  ... ) == 0x0
 02605  1096   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02606  1096   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 680, ) }, ... 680, ) == 0x0
 02607  1096   NtQueryValueKey  (680,  (680, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (680, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (680, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 02608  1096   NtClose  (680, ... ) == 0x0
 02609  1096   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02610  1736   NtAllocateVirtualMemory  (-1, 82894848, 0, 8192, 4096, 4, ... 82894848, 8192, ) == 0x0
 02611  1736   NtProtectVirtualMemory  (-1, (0x4f0e000), 4096, 260, ... (0x4f0e000), 4096, 4, ) == 0x0
 02612  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 680, {1636, 1936}, ) == 0x0
 02613  1736   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1636,Tid=1936,}, 0x0, ) == 0x0
 02614  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75626, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75626, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0\220\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75627, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0\220\7\0\0" )  ... {28, 56, reply, 0, 1636, 1736, 75627, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75626, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0\220\7\0\0" ... {28, 56, reply, 0, 1636, 1736, 75627, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0d\6\0\0\220\7\0\0" )  ) == 0x0
 02615  1736   NtResumeThread  (680, ...
 02616  1096   NtSetEventBoostPriority  (128, ...
 02352  1292   NtWaitForSingleObject  ... ) == 0x0
 02617  1292   NtSetEventBoostPriority  (128, ...
 02365  1956   NtWaitForSingleObject  ... ) == 0x0
 02618  1956   NtSetEventBoostPriority  (128, ...
 02377  1980   NtWaitForSingleObject  ... ) == 0x0
 02619  1980   NtSetEventBoostPriority  (128, ...
 02393  1480   NtWaitForSingleObject  ... ) == 0x0
 02620  1480   NtSetEventBoostPriority  (128, ...
 02406  1556   NtWaitForSingleObject  ... ) == 0x0
 02621  1556   NtSetEventBoostPriority  (128, ...
 02419   460   NtWaitForSingleObject  ... ) == 0x0
 02622   460   NtSetEventBoostPriority  (128, ...
 02431  1856   NtWaitForSingleObject  ... ) == 0x0
 02623  1856   NtSetEventBoostPriority  (128, ...
 02457  1572   NtWaitForSingleObject  ... ) == 0x0
 02624  1572   NtSetEventBoostPriority  (128, ...
 02469  1604   NtWaitForSingleObject  ... ) == 0x0
 02625  1604   NtSetEventBoostPriority  (128, ...
 02481  1596   NtWaitForSingleObject  ... ) == 0x0
 02626  1596   NtSetEventBoostPriority  (128, ...
 02493  1240   NtWaitForSingleObject  ... ) == 0x0
 02627  1240   NtSetEventBoostPriority  (128, ...
 02517  1796   NtWaitForSingleObject  ... ) == 0x0
 02628  1796   NtSetEventBoostPriority  (128, ...
 02530  1156   NtWaitForSingleObject  ... ) == 0x0
 02629  1156   NtSetEventBoostPriority  (128, ...
 02542   712   NtWaitForSingleObject  ... ) == 0x0
 02630   712   NtSetEventBoostPriority  (128, ...
 02567  1764   NtWaitForSingleObject  ... ) == 0x0
 02631  1764   NtSetEventBoostPriority  (128, ...
 02579  1256   NtWaitForSingleObject  ... ) == 0x0
 02632  1256   NtSetEventBoostPriority  (128, ...
 02592   464   NtWaitForSingleObject  ... ) == 0x0
 02633   464   NtSetEventBoostPriority  (128, ...
 02604   444   NtWaitForSingleObject  ... ) == 0x0
 02634   444   NtTestAlert  (... ) == 0x0
 02633   464   NtSetEventBoostPriority  ... ) == 0x0
 02632  1256   NtSetEventBoostPriority  ... ) == 0x0
 02631  1764   NtSetEventBoostPriority  ... ) == 0x0
 02630   712   NtSetEventBoostPriority  ... ) == 0x0
 02629  1156   NtSetEventBoostPriority  ... ) == 0x0
 02628  1796   NtSetEventBoostPriority  ... ) == 0x0
 02627  1240   NtSetEventBoostPriority  ... ) == 0x0
 02626  1596   NtSetEventBoostPriority  ... ) == 0x0
 02625  1604   NtSetEventBoostPriority  ... ) == 0x0
 02624  1572   NtSetEventBoostPriority  ... ) == 0x0
 02623  1856   NtSetEventBoostPriority  ... ) == 0x0
 02622   460   NtSetEventBoostPriority  ... ) == 0x0
 02621  1556   NtSetEventBoostPriority  ... ) == 0x0
 02620  1480   NtSetEventBoostPriority  ... ) == 0x0
 02619  1980   NtSetEventBoostPriority  ... ) == 0x0
 02618  1956   NtSetEventBoostPriority  ... ) == 0x0
 02617  1292   NtSetEventBoostPriority  ... ) == 0x0
 02616  1096   NtSetEventBoostPriority  ... ) == 0x0
 02615  1736   NtResumeThread  ... 1, ) == 0x0
 02635   444   NtContinue  (81853744, 1, ...
 02636  1936   NtTestAlert  (...
 02637   464   NtTestAlert  (...
 02638  1256   NtTestAlert  (...
 02639  1764   NtTestAlert  (...
 02640   712   NtTestAlert  (...
 02641  1156   NtTestAlert  (...
 02642  1796   NtTestAlert  (...
 02643  1240   NtTestAlert  (...
 02644  1596   NtTestAlert  (...
 02645  1604   NtTestAlert  (...
 02646  1572   NtTestAlert  (...
 02647  1856   NtTestAlert  (...
 02648   460   NtTestAlert  (...
 02649  1556   NtTestAlert  (...
 02650  1480   NtTestAlert  (...
 02651  1980   NtTestAlert  (...
 02652  1956   NtTestAlert  (...
 02653  1096   NtSetEventBoostPriority  (164, ...
 02654  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02655   444   NtRegisterThreadTerminatePort  (24, ...
 02636  1936   NtTestAlert  ... ) == 0x0
 02637   464   NtTestAlert  ... ) == 0x0
 02638  1256   NtTestAlert  ... ) == 0x0
 02639  1764   NtTestAlert  ... ) == 0x0
 02640   712   NtTestAlert  ... ) == 0x0
 02641  1156   NtTestAlert  ... ) == 0x0
 02642  1796   NtTestAlert  ... ) == 0x0
 02643  1240   NtTestAlert  ... ) == 0x0
 02644  1596   NtTestAlert  ... ) == 0x0
 02645  1604   NtTestAlert  ... ) == 0x0
 02646  1572   NtTestAlert  ... ) == 0x0
 02647  1856   NtTestAlert  ... ) == 0x0
 02648   460   NtTestAlert  ... ) == 0x0
 02649  1556   NtTestAlert  ... ) == 0x0
 02650  1480   NtTestAlert  ... ) == 0x0
 02651  1980   NtTestAlert  ... ) == 0x0
 02652  1956   NtTestAlert  ... ) == 0x0
 01200  1300   NtWaitForSingleObject  ... ) == 0x0
 02653  1096   NtSetEventBoostPriority  ... ) == 0x0
 02654  1736   NtAllocateVirtualMemory  ... 82903040, 1048576, ) == 0x0
 02655   444   NtRegisterThreadTerminatePort  ... ) == 0x0
 02656  1936   NtContinue  (82902320, 1, ...
 02657   464   NtContinue  (80805168, 1, ...
 02658  1256   NtContinue  (79756592, 1, ...
 02659  1764   NtContinue  (78708016, 1, ...
 02660   712   NtContinue  (77659440, 1, ...
 02661  1156   NtContinue  (76610864, 1, ...
 02662  1796   NtContinue  (75562288, 1, ...
 02663  1240   NtContinue  (74513712, 1, ...
 02664  1596   NtContinue  (73465136, 1, ...
 02665  1604   NtContinue  (72416560, 1, ...
 02666  1572   NtContinue  (71367984, 1, ...
 02667  1856   NtContinue  (70319408, 1, ...
 02668   460   NtContinue  (69270832, 1, ...
 02669  1556   NtContinue  (68222256, 1, ...
 02670  1480   NtContinue  (67173680, 1, ...
 02671  1980   NtContinue  (66125104, 1, ...
 02672  1300   NtSetEventBoostPriority  (164, ...
 02673  1956   NtContinue  (65076528, 1, ...
 02674  1096   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02675  1736   NtAllocateVirtualMemory  (-1, 83943424, 0, 8192, 4096, 4, ...
 02676   444   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02677  1936   NtRegisterThreadTerminatePort  (24, ...
 02678   464   NtRegisterThreadTerminatePort  (24, ...
 02679  1256   NtRegisterThreadTerminatePort  (24, ...
 02680  1764   NtRegisterThreadTerminatePort  (24, ...
 02681   712   NtRegisterThreadTerminatePort  (24, ...
 02682  1156   NtRegisterThreadTerminatePort  (24, ...
 02683  1796   NtRegisterThreadTerminatePort  (24, ...
 02684  1240   NtRegisterThreadTerminatePort  (24, ...
 02685  1596   NtRegisterThreadTerminatePort  (24, ...
 02686  1604   NtRegisterThreadTerminatePort  (24, ...
 02687  1572   NtRegisterThreadTerminatePort  (24, ...
 02688  1856   NtRegisterThreadTerminatePort  (24, ...
 02689   460   NtRegisterThreadTerminatePort  (24, ...
 02690  1556   NtRegisterThreadTerminatePort  (24, ...
 02691  1480   NtRegisterThreadTerminatePort  (24, ...
 01206   748   NtWaitForSingleObject  ... ) == 0x0
 02672  1300   NtSetEventBoostPriority  ... ) == 0x0
 02692  1980   NtRegisterThreadTerminatePort  (24, ...
 02693  1956   NtRegisterThreadTerminatePort  (24, ...
 02674  1096   NtCreateEvent  ... 688, ) == 0x0
 02675  1736   NtAllocateVirtualMemory  ... 83943424, 8192, ) == 0x0
 02676   444   NtDuplicateObject  ... 692, ) == 0x0
 02677  1936   NtRegisterThreadTerminatePort  ... ) == 0x0
 02678   464   NtRegisterThreadTerminatePort  ... ) == 0x0
 02679  1256   NtRegisterThreadTerminatePort  ... ) == 0x0
 02680  1764   NtRegisterThreadTerminatePort  ... ) == 0x0
 02681   712   NtRegisterThreadTerminatePort  ... ) == 0x0
 02682  1156   NtRegisterThreadTerminatePort  ... ) == 0x0
 02683  1796   NtRegisterThreadTerminatePort  ... ) == 0x0
 02684  1240   NtRegisterThreadTerminatePort  ... ) == 0x0
 02685  1596   NtRegisterThreadTerminatePort  ... ) == 0x0
 02686  1604   NtRegisterThreadTerminatePort  ... ) == 0x0
 02687  1572   NtRegisterThreadTerminatePort  ... ) == 0x0
 02688  1856   NtRegisterThreadTerminatePort  ... ) == 0x0
 02689   460   NtRegisterThreadTerminatePort  ... ) == 0x0
 02690  1556   NtRegisterThreadTerminatePort  ... ) == 0x0
 02694   748   NtSetEventBoostPriority  (164, ...
 02691  1480   NtRegisterThreadTerminatePort  ... ) == 0x0
 02695  1300   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02692  1980   NtRegisterThreadTerminatePort  ... ) == 0x0
 02693  1956   NtRegisterThreadTerminatePort  ... ) == 0x0
 02696  1292   NtTestAlert  (...
 02697  1736   NtProtectVirtualMemory  (-1, (0x500e000), 4096, 260, ...
 02698   444   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02699  1096   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789236, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789236, 188, ...
 02700   464   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02701  1256   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02702  1764   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02703   712   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02704  1156   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02705  1796   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02706  1240   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02707  1596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02708  1604   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02709  1572   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02710  1856   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02711   460   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01209   428   NtWaitForSingleObject  ... ) == 0x0
 02694   748   NtSetEventBoostPriority  ... ) == 0x0
 02712  1556   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02713  1480   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02714  1936   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02715  1980   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02716  1956   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02696  1292   NtTestAlert  ... ) == 0x0
 02695  1300   NtCreateEvent  ... 696, ) == 0x0
 02697  1736   NtProtectVirtualMemory  ... (0x500e000), 4096, 4, ) == 0x0
 02699  1096   NtConnectPort  ... 700, 0x0, 0x0, 0x0, 188, ) == 0x0
 02698   444   NtWaitForSingleObject  ... ) == 0x102
 02700   464   NtDuplicateObject  ... 704, ) == 0x0
 02701  1256   NtDuplicateObject  ... 708, ) == 0x0
 02702  1764   NtDuplicateObject  ... 712, ) == 0x0
 02703   712   NtDuplicateObject  ... 716, ) == 0x0
 02704  1156   NtDuplicateObject  ... 720, ) == 0x0
 02705  1796   NtDuplicateObject  ... 724, ) == 0x0
 02706  1240   NtDuplicateObject  ... 728, ) == 0x0
 02707  1596   NtDuplicateObject  ... 732, ) == 0x0
 02708  1604   NtDuplicateObject  ... 736, ) == 0x0
 02709  1572   NtDuplicateObject  ... 740, ) == 0x0
 02710  1856   NtDuplicateObject  ... 744, ) == 0x0
 02717   428   NtSetEventBoostPriority  (164, ...
 02711   460   NtDuplicateObject  ... 748, ) == 0x0
 02718   748   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02712  1556   NtDuplicateObject  ... 752, ) == 0x0
 02714  1936   NtDuplicateObject  ... 756, ) == 0x0
 02713  1480   NtDuplicateObject  ... 760, ) == 0x0
 02715  1980   NtDuplicateObject  ... 764, ) == 0x0
 02719  1292   NtContinue  (64027952, 1, ...
 02720  1300   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 02721  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02722  1096   NtRequestWaitReplyPort  (700, {200, 224, new_msg, 0, 1379392, 12, 2, 1310721}  (700, {200, 224, new_msg, 0, 1379392, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0\217K\223\317\276\332\1\332\0{\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\330z\25\0\12\10\252\272x\1\24\0\370z\25\0h\1\24\0\0\0\0\0\0\0\0\0\370z\25\0P\0\0\0\0{\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\360\0\372\31\221|\310\362\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02723   444   NtWaitForSingleObject  (164, 0, 0x0, ...
 02724   464   NtWaitForSingleObject  (312, 0, 0x0, ...
 02725  1256   NtWaitForSingleObject  (312, 0, 0x0, ...
 02726  1764   NtWaitForSingleObject  (312, 0, 0x0, ...
 02727   712   NtWaitForSingleObject  (312, 0, 0x0, ...
 02728  1156   NtWaitForSingleObject  (312, 0, 0x0, ...
 02729  1796   NtWaitForSingleObject  (312, 0, 0x0, ...
 02730  1240   NtWaitForSingleObject  (312, 0, 0x0, ...
 02731  1596   NtWaitForSingleObject  (312, 0, 0x0, ...
 02732  1604   NtWaitForSingleObject  (312, 0, 0x0, ...
 02733  1572   NtWaitForSingleObject  (312, 0, 0x0, ...
 01276  1024   NtWaitForSingleObject  ... ) == 0x0
 02717   428   NtSetEventBoostPriority  ... ) == 0x0
 02734  1856   NtWaitForSingleObject  (312, 0, 0x0, ...
 02735   460   NtWaitForSingleObject  (312, 0, 0x0, ...
 02718   748   NtCreateEvent  ... 768, ) == 0x0
 02736  1556   NtWaitForSingleObject  (312, 0, 0x0, ...
 02737  1936   NtWaitForSingleObject  (312, 0, 0x0, ...
 02738  1480   NtWaitForSingleObject  (312, 0, 0x0, ...
 02739  1980   NtWaitForSingleObject  (312, 0, 0x0, ...
 02740  1292   NtRegisterThreadTerminatePort  (24, ...
 02720  1300   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 02721  1736   NtCreateThread  ... 772, {1636, 1944}, ) == 0x0
 02741  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 02716  1956   NtDuplicateObject  ... 776, ) == 0x0
 02722  1096   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1636, 1096, 75629, 0}  ... {200, 224, reply, 0, 1636, 1096, 75629, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0\217K\223\317\276\332\1\332\0{\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\330z\25\0\12\10\252\272x\1\24\0\370z\25\0h\1\24\0\0\0\0\0\0\0\0\0\370z\25\0P\0\0\0\0{\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\360\0\372\31\221|\310\362\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02742   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 02740  1292   NtRegisterThreadTerminatePort  ... ) == 0x0
 02743  1300   NtSetEventBoostPriority  (312, ...
 02744  1736   NtQueryInformationThread  (772, Basic, 28, ...
 02745  1956   NtWaitForSingleObject  (312, 0, 0x0, ...
 02746   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02747  1292   NtWaitForSingleObject  (312, 0, 0x0, ...
 02724   464   NtWaitForSingleObject  ... ) == 0x0
 02743  1300   NtSetEventBoostPriority  ... ) == 0x0
 02744  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1636,Tid=1944,}, 0x0, ) == 0x0
 02746   428   NtCreateEvent  ... 780, ) == 0x0
 02748  1096   NtRequestWaitReplyPort  (700, {64, 88, new_msg, 0, 1636, 1096, 75589, 0}  (700, {64, 88, new_msg, 0, 1636, 1096, 75589, 0} "\1\332\0\0A\2\10\0\200Y\274\201Ni\257\341\264\311\275\201:\332R\200\377\377\377\377t\333\243\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 02749   464   NtSetEventBoostPriority  (312, ...
 02750  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 02751  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75627, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75627, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0d\6\0\0\230\7\0\0" ...  ...
 02752   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 02725  1256   NtWaitForSingleObject  ... ) == 0x0
 02749   464   NtSetEventBoostPriority  ... ) == 0x0
 02748  1096   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1636, 1096, 75630, 0}  ... {52, 76, reply, 0, 1636, 1096, 75630, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\2000/\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 02753  1256   NtSetEventBoostPriority  (312, ...
 02751  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75631, 0}  ... {28, 56, reply, 0, 1636, 1736, 75631, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\3\0\0d\6\0\0\230\7\0\0" )  ) == 0x0
 02726  1764   NtWaitForSingleObject  ... ) == 0x0
 02753  1256   NtSetEventBoostPriority  ... ) == 0x0
 02754  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 02755  1764   NtSetEventBoostPriority  (312, ...
 02756  1736   NtResumeThread  (772, ...
 02757   464   NtWaitForSingleObject  (312, 0, 0x0, ...
 02727   712   NtWaitForSingleObject  ... ) == 0x0
 02755  1764   NtSetEventBoostPriority  ... ) == 0x0
 02756  1736   NtResumeThread  ... 1, ) == 0x0
 02758   712   NtSetEventBoostPriority  (312, ...
 02759  1256   NtWaitForSingleObject  (312, 0, 0x0, ...
 02760  1944   NtWaitForSingleObject  (312, 0, 0x0, ...
 02728  1156   NtWaitForSingleObject  ... ) == 0x0
 02758   712   NtSetEventBoostPriority  ... ) == 0x0
 02761  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02762  1156   NtSetEventBoostPriority  (312, ...
 02763  1764   NtWaitForSingleObject  (312, 0, 0x0, ...
 02729  1796   NtWaitForSingleObject  ... ) == 0x0
 02762  1156   NtSetEventBoostPriority  ... ) == 0x0
 02761  1736   NtAllocateVirtualMemory  ... 83951616, 1048576, ) == 0x0
 02764  1796   NtSetEventBoostPriority  (312, ...
 02765   712   NtWaitForSingleObject  (312, 0, 0x0, ...
 02766  1156   NtWaitForSingleObject  (312, 0, 0x0, ...
 02730  1240   NtWaitForSingleObject  ... ) == 0x0
 02764  1796   NtSetEventBoostPriority  ... ) == 0x0
 02767  1240   NtSetEventBoostPriority  (312, ...
 02768  1736   NtAllocateVirtualMemory  (-1, 84992000, 0, 8192, 4096, 4, ...
 02731  1596   NtWaitForSingleObject  ... ) == 0x0
 02767  1240   NtSetEventBoostPriority  ... ) == 0x0
 02769  1596   NtSetEventBoostPriority  (312, ...
 02768  1736   NtAllocateVirtualMemory  ... 84992000, 8192, ) == 0x0
 02770  1796   NtWaitForSingleObject  (312, 0, 0x0, ...
 02732  1604   NtWaitForSingleObject  ... ) == 0x0
 02769  1596   NtSetEventBoostPriority  ... ) == 0x0
 02771  1736   NtProtectVirtualMemory  (-1, (0x510e000), 4096, 260, ...
 02772  1604   NtSetEventBoostPriority  (312, ...
 02773  1240   NtWaitForSingleObject  (312, 0, 0x0, ...
 02733  1572   NtWaitForSingleObject  ... ) == 0x0
 02772  1604   NtSetEventBoostPriority  ... ) == 0x0
 02771  1736   NtProtectVirtualMemory  ... (0x510e000), 4096, 4, ) == 0x0
 02774  1572   NtSetEventBoostPriority  (312, ...
 02775  1596   NtWaitForSingleObject  (312, 0, 0x0, ...
 02734  1856   NtWaitForSingleObject  ... ) == 0x0
 02774  1572   NtSetEventBoostPriority  ... ) == 0x0
 02776  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02777  1856   NtSetEventBoostPriority  (312, ...
 02778  1604   NtWaitForSingleObject  (312, 0, 0x0, ...
 02735   460   NtWaitForSingleObject  ... ) == 0x0
 02777  1856   NtSetEventBoostPriority  ... ) == 0x0
 02776  1736   NtCreateThread  ... 784, {1636, 432}, ) == 0x0
 02779   460   NtSetEventBoostPriority  (312, ...
 02780  1572   NtWaitForSingleObject  (312, 0, 0x0, ...
 02781  1856   NtWaitForSingleObject  (312, 0, 0x0, ...
 02736  1556   NtWaitForSingleObject  ... ) == 0x0
 02779   460   NtSetEventBoostPriority  ... ) == 0x0
 02782  1556   NtSetEventBoostPriority  (312, ...
 02783  1736   NtQueryInformationThread  (784, Basic, 28, ...
 02737  1936   NtWaitForSingleObject  ... ) == 0x0
 02782  1556   NtSetEventBoostPriority  ... ) == 0x0
 02784  1936   NtSetEventBoostPriority  (312, ...
 02783  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1636,Tid=432,}, 0x0, ) == 0x0
 02785   460   NtWaitForSingleObject  (312, 0, 0x0, ...
 02738  1480   NtWaitForSingleObject  ... ) == 0x0
 02784  1936   NtSetEventBoostPriority  ... ) == 0x0
 02786  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75631, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75631, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0d\6\0\0\260\1\0\0" ...  ...
 02787  1480   NtSetEventBoostPriority  (312, ...
 02788  1556   NtWaitForSingleObject  (312, 0, 0x0, ...
 02739  1980   NtWaitForSingleObject  ... ) == 0x0
 02787  1480   NtSetEventBoostPriority  ... ) == 0x0
 02786  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75632, 0}  ... {28, 56, reply, 0, 1636, 1736, 75632, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\3\0\0d\6\0\0\260\1\0\0" )  ) == 0x0
 02789  1980   NtSetEventBoostPriority  (312, ...
 02790  1936   NtWaitForSingleObject  (312, 0, 0x0, ...
 02741  1024   NtWaitForSingleObject  ... ) == 0x0
 02789  1980   NtSetEventBoostPriority  ... ) == 0x0
 02791  1736   NtResumeThread  (784, ...
 02792  1024   NtSetEventBoostPriority  (312, ...
 02793  1480   NtWaitForSingleObject  (312, 0, 0x0, ...
 02794  1980   NtWaitForSingleObject  (312, 0, 0x0, ...
 02742   748   NtWaitForSingleObject  ... ) == 0x0
 02792  1024   NtSetEventBoostPriority  ... ) == 0x0
 02795   748   NtSetEventBoostPriority  (312, ...
 02791  1736   NtResumeThread  ... 1, ) == 0x0
 02745  1956   NtWaitForSingleObject  ... ) == 0x0
 02795   748   NtSetEventBoostPriority  ... ) == 0x0
 02796  1956   NtSetEventBoostPriority  (312, ...
 02797  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02798  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 02799   432   NtWaitForSingleObject  (128, 0, 0x0, ...
 02747  1292   NtWaitForSingleObject  ... ) == 0x0
 02796  1956   NtSetEventBoostPriority  ... ) == 0x0
 02797  1736   NtAllocateVirtualMemory  ... 85000192, 1048576, ) == 0x0
 02800  1292   NtSetEventBoostPriority  (312, ...
 02801   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 02750  1300   NtWaitForSingleObject  ... ) == 0x0
 02802  1736   NtAllocateVirtualMemory  (-1, 86040576, 0, 8192, 4096, 4, ...
 02803  1300   NtSetEventBoostPriority  (312, ...
 02802  1736   NtAllocateVirtualMemory  ... 86040576, 8192, ) == 0x0
 02752   428   NtWaitForSingleObject  ... ) == 0x0
 02804   428   NtSetEventBoostPriority  (312, ...
 02754  1096   NtWaitForSingleObject  ... ) == 0x0
 02805  1096   NtSetEventBoostPriority  (312, ...
 02757   464   NtWaitForSingleObject  ... ) == 0x0
 02806   464   NtSetEventBoostPriority  (312, ...
 02759  1256   NtWaitForSingleObject  ... ) == 0x0
 02807  1256   NtSetEventBoostPriority  (312, ...
 02760  1944   NtWaitForSingleObject  ... ) == 0x0
 02808  1944   NtSetEventBoostPriority  (312, ...
 02763  1764   NtWaitForSingleObject  ... ) == 0x0
 02809  1764   NtSetEventBoostPriority  (312, ...
 02765   712   NtWaitForSingleObject  ... ) == 0x0
 02810   712   NtSetEventBoostPriority  (312, ...
 02766  1156   NtWaitForSingleObject  ... ) == 0x0
 02811  1156   NtSetEventBoostPriority  (312, ...
 02770  1796   NtWaitForSingleObject  ... ) == 0x0
 02812  1796   NtSetEventBoostPriority  (312, ...
 02773  1240   NtWaitForSingleObject  ... ) == 0x0
 02813  1240   NtSetEventBoostPriority  (312, ...
 02775  1596   NtWaitForSingleObject  ... ) == 0x0
 02814  1596   NtSetEventBoostPriority  (312, ...
 02778  1604   NtWaitForSingleObject  ... ) == 0x0
 02815  1604   NtSetEventBoostPriority  (312, ...
 02780  1572   NtWaitForSingleObject  ... ) == 0x0
 02816  1572   NtSetEventBoostPriority  (312, ...
 02781  1856   NtWaitForSingleObject  ... ) == 0x0
 02817  1856   NtSetEventBoostPriority  (312, ...
 02785   460   NtWaitForSingleObject  ... ) == 0x0
 02818   460   NtSetEventBoostPriority  (312, ...
 02788  1556   NtWaitForSingleObject  ... ) == 0x0
 02819  1556   NtSetEventBoostPriority  (312, ...
 02790  1936   NtWaitForSingleObject  ... ) == 0x0
 02820  1936   NtSetEventBoostPriority  (312, ...
 02793  1480   NtWaitForSingleObject  ... ) == 0x0
 02821  1480   NtSetEventBoostPriority  (312, ...
 02794  1980   NtWaitForSingleObject  ... ) == 0x0
 02822  1980   NtSetEventBoostPriority  (312, ...
 02798  1024   NtWaitForSingleObject  ... ) == 0x0
 02823  1024   NtSetEventBoostPriority  (312, ...
 02801   748   NtWaitForSingleObject  ... ) == 0x0
 02824   748   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ... 1417216, 4096, ) == 0x0
 02825   748   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ...
 02823  1024   NtSetEventBoostPriority  ... ) == 0x0
 02822  1980   NtSetEventBoostPriority  ... ) == 0x0
 02821  1480   NtSetEventBoostPriority  ... ) == 0x0
 02820  1936   NtSetEventBoostPriority  ... ) == 0x0
 02819  1556   NtSetEventBoostPriority  ... ) == 0x0
 02818   460   NtSetEventBoostPriority  ... ) == 0x0
 02817  1856   NtSetEventBoostPriority  ... ) == 0x0
 02816  1572   NtSetEventBoostPriority  ... ) == 0x0
 02815  1604   NtSetEventBoostPriority  ... ) == 0x0
 02814  1596   NtSetEventBoostPriority  ... ) == 0x0
 02813  1240   NtSetEventBoostPriority  ... ) == 0x0
 02812  1796   NtSetEventBoostPriority  ... ) == 0x0
 02811  1156   NtSetEventBoostPriority  ... ) == 0x0
 02810   712   NtSetEventBoostPriority  ... ) == 0x0
 02809  1764   NtSetEventBoostPriority  ... ) == 0x0
 02808  1944   NtSetEventBoostPriority  ... ) == 0x0
 02807  1256   NtSetEventBoostPriority  ... ) == 0x0
 02806   464   NtSetEventBoostPriority  ... ) == 0x0
 02805  1096   NtSetEventBoostPriority  ... ) == 0x0
 02804   428   NtSetEventBoostPriority  ... ) == 0x0
 02826  1736   NtProtectVirtualMemory  (-1, (0x520e000), 4096, 260, ...
 02803  1300   NtSetEventBoostPriority  ... ) == 0x0
 02800  1292   NtSetEventBoostPriority  ... ) == 0x0
 02827  1956   NtWaitForSingleObject  (312, 0, 0x0, ...
 02828  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 02829  1980   NtWaitForSingleObject  (312, 0, 0x0, ...
 02830  1480   NtWaitForSingleObject  (312, 0, 0x0, ...
 02831  1936   NtWaitForSingleObject  (312, 0, 0x0, ...
 02832  1556   NtWaitForSingleObject  (312, 0, 0x0, ...
 02833   460   NtWaitForSingleObject  (312, 0, 0x0, ...
 02834  1856   NtWaitForSingleObject  (312, 0, 0x0, ...
 02835  1572   NtWaitForSingleObject  (312, 0, 0x0, ...
 02836  1604   NtWaitForSingleObject  (312, 0, 0x0, ...
 02837  1596   NtWaitForSingleObject  (312, 0, 0x0, ...
 02838  1240   NtWaitForSingleObject  (312, 0, 0x0, ...
 02839  1796   NtWaitForSingleObject  (312, 0, 0x0, ...
 02840  1156   NtWaitForSingleObject  (312, 0, 0x0, ...
 02841   712   NtWaitForSingleObject  (312, 0, 0x0, ...
 02842  1764   NtWaitForSingleObject  (312, 0, 0x0, ...
 02825   748   NtAllocateVirtualMemory  ... 1421312, 4096, ) == 0x0
 02843  1256   NtWaitForSingleObject  (312, 0, 0x0, ...
 02844   464   NtWaitForSingleObject  (312, 0, 0x0, ...
 02845  1944   NtSetEventBoostPriority  (128, ...
 02846  1096   NtClose  (688, ...
 02826  1736   NtProtectVirtualMemory  ... (0x520e000), 4096, 4, ) == 0x0
 02847  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 02848  1292   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02849   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 02850   748   NtSetEventBoostPriority  (312, ...
 02799   432   NtWaitForSingleObject  ... ) == 0x0
 02845  1944   NtSetEventBoostPriority  ... ) == 0x0
 02846  1096   NtClose  ... ) == 0x0
 02851  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02848  1292   NtDuplicateObject  ... 688, ) == 0x0
 02852   432   NtTestAlert  (...
 02827  1956   NtWaitForSingleObject  ... ) == 0x0
 02850   748   NtSetEventBoostPriority  ... ) == 0x0
 02853  1944   NtTestAlert  (...
 02854  1096   NtClose  (700, ...
 02851  1736   NtCreateThread  ... 788, {1636, 1864}, ) == 0x0
 02852   432   NtTestAlert  ... ) == 0x0
 02855  1956   NtSetEventBoostPriority  (312, ...
 02856   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 02853  1944   NtTestAlert  ... ) == 0x0
 02854  1096   NtClose  ... ) == 0x0
 02857  1736   NtQueryInformationThread  (788, Basic, 28, ...
 02858  1292   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02828  1024   NtWaitForSingleObject  ... ) == 0x0
 02855  1956   NtSetEventBoostPriority  ... ) == 0x0
 02859  1944   NtContinue  (83950896, 1, ...
 02860  1096   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02857  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1636,Tid=1864,}, 0x0, ) == 0x0
 02861  1024   NtSetEventBoostPriority  (312, ...
 02858  1292   NtWaitForSingleObject  ... ) == 0x102
 02862  1956   NtWaitForSingleObject  (312, 0, 0x0, ...
 02863  1944   NtRegisterThreadTerminatePort  (24, ...
 02860  1096   NtCreateKey  ... 700, 2, ) == 0x0
 02864   432   NtContinue  (84999472, 1, ...
 02829  1980   NtWaitForSingleObject  ... ) == 0x0
 02865  1292   NtWaitForSingleObject  (164, 0, 0x0, ...
 02861  1024   NtSetEventBoostPriority  ... ) == 0x0
 02866  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75632, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75632, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0d\6\0\0H\7\0\0" ...  ...
 02863  1944   NtRegisterThreadTerminatePort  ... ) == 0x0
 02867   432   NtRegisterThreadTerminatePort  (24, ...
 02868  1980   NtSetEventBoostPriority  (312, ...
 02869  1024   NtSetEventBoostPriority  (164, ...
 02866  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75634, 0}  ... {28, 56, reply, 0, 1636, 1736, 75634, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0d\6\0\0H\7\0\0" )  ) == 0x0
 02870  1944   NtWaitForSingleObject  (312, 0, 0x0, ...
 02867   432   NtRegisterThreadTerminatePort  ... ) == 0x0
 02830  1480   NtWaitForSingleObject  ... ) == 0x0
 01283  1132   NtWaitForSingleObject  ... ) == 0x0
 02869  1024   NtSetEventBoostPriority  ... ) == 0x0
 02871  1736   NtResumeThread  (788, ...
 02872   432   NtWaitForSingleObject  (312, 0, 0x0, ...
 02873  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 02874  1480   NtSetEventBoostPriority  (312, ...
 02868  1980   NtSetEventBoostPriority  ... ) == 0x0
 02875  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02871  1736   NtResumeThread  ... 1, ) == 0x0
 02831  1936   NtWaitForSingleObject  ... ) == 0x0
 02876  1980   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02875  1096   NtOpenKey  ... 792, ) == 0x0
 02877  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02878  1936   NtSetEventBoostPriority  (312, ...
 02879  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02874  1480   NtSetEventBoostPriority  ... ) == 0x0
 02880  1024   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02881  1864   NtTestAlert  (...
 02876  1980   NtWaitForSingleObject  ... ) == 0x102
 02832  1556   NtWaitForSingleObject  ... ) == 0x0
 02879  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02882  1480   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02880  1024   NtCreateEvent  ... 796, ) == 0x0
 02881  1864   NtTestAlert  ... ) == 0x0
 02883  1980   NtWaitForSingleObject  (164, 0, 0x0, ...
 02884  1556   NtSetEventBoostPriority  (312, ...
 02885  1096   NtQueryValueKey  (700,  (700, "Hostname", Partial, 144, ... , Partial, 144, ...
 02886  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 02887  1864   NtContinue  (86048048, 1, ...
 02833   460   NtWaitForSingleObject  ... ) == 0x0
 02885  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02888  1864   NtRegisterThreadTerminatePort  (24, ...
 02889   460   NtSetEventBoostPriority  (312, ...
 02884  1556   NtSetEventBoostPriority  ... ) == 0x0
 02878  1936   NtSetEventBoostPriority  ... ) == 0x0
 02877  1736   NtAllocateVirtualMemory  ... 86048768, 1048576, ) == 0x0
 02882  1480   NtWaitForSingleObject  ... ) == 0x102
 02888  1864   NtRegisterThreadTerminatePort  ... ) == 0x0
 02834  1856   NtWaitForSingleObject  ... ) == 0x0
 02890  1556   NtWaitForSingleObject  (312, 0, 0x0, ...
 02891  1936   NtWaitForSingleObject  (356, 0, 0x0, ...
 02892  1736   NtAllocateVirtualMemory  (-1, 87089152, 0, 8192, 4096, 4, ...
 02893  1480   NtWaitForSingleObject  (164, 0, 0x0, ...
 02889   460   NtSetEventBoostPriority  ... ) == 0x0
 02894  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 02895  1856   NtSetEventBoostPriority  (312, ...
 02892  1736   NtAllocateVirtualMemory  ... 87089152, 8192, ) == 0x0
 02896   460   NtWaitForSingleObject  (312, 0, 0x0, ...
 02835  1572   NtWaitForSingleObject  ... ) == 0x0
 02897  1736   NtProtectVirtualMemory  (-1, (0x530e000), 4096, 260, ...
 02898  1572   NtSetEventBoostPriority  (312, ...
 02897  1736   NtProtectVirtualMemory  ... (0x530e000), 4096, 4, ) == 0x0
 02836  1604   NtWaitForSingleObject  ... ) == 0x0
 02899  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02900  1604   NtSetEventBoostPriority  (312, ...
 02898  1572   NtSetEventBoostPriority  ... ) == 0x0
 02895  1856   NtSetEventBoostPriority  ... ) == 0x0
 02901  1864   NtWaitForSingleObject  (312, 0, 0x0, ...
 02837  1596   NtWaitForSingleObject  ... ) == 0x0
 02902  1572   NtWaitForSingleObject  (312, 0, 0x0, ...
 02903  1856   NtWaitForSingleObject  (312, 0, 0x0, ...
 02904  1596   NtSetEventBoostPriority  (312, ...
 02838  1240   NtWaitForSingleObject  ... ) == 0x0
 02905  1240   NtSetEventBoostPriority  (312, ...
 02839  1796   NtWaitForSingleObject  ... ) == 0x0
 02906  1796   NtSetEventBoostPriority  (312, ...
 02840  1156   NtWaitForSingleObject  ... ) == 0x0
 02907  1156   NtSetEventBoostPriority  (312, ...
 02841   712   NtWaitForSingleObject  ... ) == 0x0
 02908   712   NtSetEventBoostPriority  (312, ...
 02842  1764   NtWaitForSingleObject  ... ) == 0x0
 02909  1764   NtSetEventBoostPriority  (312, ...
 02843  1256   NtWaitForSingleObject  ... ) == 0x0
 02910  1256   NtSetEventBoostPriority  (312, ...
 02847  1300   NtWaitForSingleObject  ... ) == 0x0
 02911  1300   NtSetEventBoostPriority  (312, ...
 02849   428   NtWaitForSingleObject  ... ) == 0x0
 02912   428   NtSetEventBoostPriority  (312, ...
 02844   464   NtWaitForSingleObject  ... ) == 0x0
 02913   464   NtSetEventBoostPriority  (312, ...
 02856   748   NtWaitForSingleObject  ... ) == 0x0
 02914   748   NtSetEventBoostPriority  (312, ...
 02862  1956   NtWaitForSingleObject  ... ) == 0x0
 02915  1956   NtSetEventBoostPriority  (312, ...
 02870  1944   NtWaitForSingleObject  ... ) == 0x0
 02916  1944   NtSetEventBoostPriority  (312, ...
 02873  1132   NtWaitForSingleObject  ... ) == 0x0
 02917  1132   NtSetEventBoostPriority  (312, ...
 02872   432   NtWaitForSingleObject  ... ) == 0x0
 02918   432   NtSetEventBoostPriority  (312, ...
 02886  1024   NtWaitForSingleObject  ... ) == 0x0
 02919  1024   NtSetEventBoostPriority  (312, ...
 02890  1556   NtWaitForSingleObject  ... ) == 0x0
 02920  1556   NtSetEventBoostPriority  (312, ...
 02894  1096   NtWaitForSingleObject  ... ) == 0x0
 02921  1096   NtSetEventBoostPriority  (312, ...
 02896   460   NtWaitForSingleObject  ... ) == 0x0
 02922   460   NtSetEventBoostPriority  (312, ...
 02901  1864   NtWaitForSingleObject  ... ) == 0x0
 02923  1864   NtSetEventBoostPriority  (312, ...
 02902  1572   NtWaitForSingleObject  ... ) == 0x0
 02924  1572   NtSetEventBoostPriority  (312, ...
 02903  1856   NtWaitForSingleObject  ... ) == 0x0
 02925  1856   NtWaitForSingleObject  (356, 0, 0x0, ...
 02924  1572   NtSetEventBoostPriority  ... ) == 0x0
 02923  1864   NtSetEventBoostPriority  ... ) == 0x0
 02922   460   NtSetEventBoostPriority  ... ) == 0x0
 02921  1096   NtSetEventBoostPriority  ... ) == 0x0
 02920  1556   NtSetEventBoostPriority  ... ) == 0x0
 02919  1024   NtSetEventBoostPriority  ... ) == 0x0
 02918   432   NtSetEventBoostPriority  ... ) == 0x0
 02917  1132   NtSetEventBoostPriority  ... ) == 0x0
 02916  1944   NtSetEventBoostPriority  ... ) == 0x0
 02914   748   NtSetEventBoostPriority  ... ) == 0x0
 02912   428   NtSetEventBoostPriority  ... ) == 0x0
 02911  1300   NtSetEventBoostPriority  ... ) == 0x0
 02915  1956   NtSetEventBoostPriority  ... ) == 0x0
 02913   464   NtSetEventBoostPriority  ... ) == 0x0
 02910  1256   NtSetEventBoostPriority  ... ) == 0x0
 02909  1764   NtSetEventBoostPriority  ... ) == 0x0
 02908   712   NtSetEventBoostPriority  ... ) == 0x0
 02907  1156   NtSetEventBoostPriority  ... ) == 0x0
 02906  1796   NtSetEventBoostPriority  ... ) == 0x0
 02905  1240   NtSetEventBoostPriority  ... ) == 0x0
 02904  1596   NtSetEventBoostPriority  ... ) == 0x0
 02900  1604   NtSetEventBoostPriority  ... ) == 0x0
 02899  1736   NtCreateThread  ... 800, {1636, 308}, ) == 0x0
 02926  1864   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02927  1572   NtWaitForSingleObject  (356, 0, 0x0, ...
 02928  1096   NtQueryValueKey  (700,  (700, "Hostname", Partial, 144, ... , Partial, 144, ...
 02929   460   NtWaitForSingleObject  (356, 0, 0x0, ...
 02930  1556   NtSetEventBoostPriority  (356, ...
 02931  1024   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ...
 02932   432   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02933  1132   NtSetEventBoostPriority  (164, ...
 02934  1944   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02935   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 02936   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 02937  1956   NtWaitForSingleObject  (356, 0, 0x0, ...
 02938   464   NtWaitForSingleObject  (312, 0, 0x0, ...
 02939  1256   NtWaitForSingleObject  (312, 0, 0x0, ...
 02940  1764   NtWaitForSingleObject  (312, 0, 0x0, ...
 02941   712   NtWaitForSingleObject  (312, 0, 0x0, ...
 02942  1156   NtWaitForSingleObject  (312, 0, 0x0, ...
 02943  1796   NtWaitForSingleObject  (312, 0, 0x0, ...
 02944  1240   NtWaitForSingleObject  (312, 0, 0x0, ...
 02945  1596   NtWaitForSingleObject  (312, 0, 0x0, ...
 02946  1604   NtWaitForSingleObject  (312, 0, 0x0, ...
 02947  1736   NtQueryInformationThread  (800, Basic, 28, ...
 02948  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 02926  1864   NtDuplicateObject  ... 804, ) == 0x0
 02891  1936   NtWaitForSingleObject  ... ) == 0x0
 02930  1556   NtSetEventBoostPriority  ... ) == 0x0
 02931  1024   NtAllocateVirtualMemory  ... 1425408, 4096, ) == 0x0
 02932   432   NtDuplicateObject  ... 808, ) == 0x0
 01286   252   NtWaitForSingleObject  ... ) == 0x0
 02933  1132   NtSetEventBoostPriority  ... ) == 0x0
 02934  1944   NtDuplicateObject  ... 812, ) == 0x0
 02928  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02947  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1636,Tid=308,}, 0x0, ) == 0x0
 02949  1936   NtWaitForSingleObject  (312, 0, 0x0, ...
 02950  1864   NtWaitForSingleObject  (312, 0, 0x0, ...
 02951  1556   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02952  1024   NtSetEventBoostPriority  (312, ...
 02953   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 02954   432   NtWaitForSingleObject  (312, 0, 0x0, ...
 02955  1132   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02956  1944   NtWaitForSingleObject  (312, 0, 0x0, ...
 02957  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 02958  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75634, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75634, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0d\6\0\04\1\0\0" ...  ...
 02951  1556   NtWaitForSingleObject  ... ) == 0x102
 02936   748   NtWaitForSingleObject  ... ) == 0x0
 02952  1024   NtSetEventBoostPriority  ... ) == 0x0
 02955  1132   NtCreateEvent  ... 816, ) == 0x0
 02958  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75635, 0}  ... {28, 56, reply, 0, 1636, 1736, 75635, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0d\6\0\04\1\0\0" )  ) == 0x0
 02959   748   NtSetEventBoostPriority  (312, ...
 02960  1556   NtWaitForSingleObject  (312, 0, 0x0, ...
 02961  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 02962  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 02938   464   NtWaitForSingleObject  ... ) == 0x0
 02959   748   NtSetEventBoostPriority  ... ) == 0x0
 02963  1736   NtResumeThread  (800, ...
 02964   464   NtSetEventBoostPriority  (312, ...
 02965   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 02939  1256   NtWaitForSingleObject  ... ) == 0x0
 02964   464   NtSetEventBoostPriority  ... ) == 0x0
 02963  1736   NtResumeThread  ... 1, ) == 0x0
 02966  1256   NtSetEventBoostPriority  (312, ...
 02967   308   NtWaitForSingleObject  (312, 0, 0x0, ...
 02940  1764   NtWaitForSingleObject  ... ) == 0x0
 02966  1256   NtSetEventBoostPriority  ... ) == 0x0
 02968  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02969  1764   NtSetEventBoostPriority  (312, ...
 02970   464   NtWaitForSingleObject  (356, 0, 0x0, ...
 02941   712   NtWaitForSingleObject  ... ) == 0x0
 02969  1764   NtSetEventBoostPriority  ... ) == 0x0
 02968  1736   NtAllocateVirtualMemory  ... 87097344, 1048576, ) == 0x0
 02971   712   NtSetEventBoostPriority  (312, ...
 02972  1256   NtWaitForSingleObject  (356, 0, 0x0, ...
 02942  1156   NtWaitForSingleObject  ... ) == 0x0
 02971   712   NtSetEventBoostPriority  ... ) == 0x0
 02973  1736   NtAllocateVirtualMemory  (-1, 88137728, 0, 8192, 4096, 4, ...
 02974  1156   NtSetEventBoostPriority  (312, ...
 02975  1764   NtWaitForSingleObject  (356, 0, 0x0, ...
 02943  1796   NtWaitForSingleObject  ... ) == 0x0
 02974  1156   NtSetEventBoostPriority  ... ) == 0x0
 02973  1736   NtAllocateVirtualMemory  ... 88137728, 8192, ) == 0x0
 02976  1796   NtSetEventBoostPriority  (312, ...
 02977   712   NtWaitForSingleObject  (356, 0, 0x0, ...
 02978  1156   NtWaitForSingleObject  (356, 0, 0x0, ...
 02944  1240   NtWaitForSingleObject  ... ) == 0x0
 02976  1796   NtSetEventBoostPriority  ... ) == 0x0
 02979  1240   NtSetEventBoostPriority  (312, ...
 02980  1736   NtProtectVirtualMemory  (-1, (0x540e000), 4096, 260, ...
 02945  1596   NtWaitForSingleObject  ... ) == 0x0
 02979  1240   NtSetEventBoostPriority  ... ) == 0x0
 02981  1596   NtSetEventBoostPriority  (312, ...
 02980  1736   NtProtectVirtualMemory  ... (0x540e000), 4096, 4, ) == 0x0
 02982  1796   NtWaitForSingleObject  (356, 0, 0x0, ...
 02946  1604   NtWaitForSingleObject  ... ) == 0x0
 02981  1596   NtSetEventBoostPriority  ... ) == 0x0
 02983  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02984  1604   NtSetEventBoostPriority  (312, ...
 02985  1240   NtWaitForSingleObject  (356, 0, 0x0, ...
 02948  1300   NtWaitForSingleObject  ... ) == 0x0
 02984  1604   NtSetEventBoostPriority  ... ) == 0x0
 02983  1736   NtCreateThread  ... 820, {1636, 1592}, ) == 0x0
 02986  1300   NtSetEventBoostPriority  (312, ...
 02987  1596   NtWaitForSingleObject  (356, 0, 0x0, ...
 02949  1936   NtWaitForSingleObject  ... ) == 0x0
 02986  1300   NtSetEventBoostPriority  ... ) == 0x0
 02988  1736   NtQueryInformationThread  (820, Basic, 28, ...
 02989  1936   NtSetEventBoostPriority  (312, ...
 02990  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 02950  1864   NtWaitForSingleObject  ... ) == 0x0
 02989  1936   NtSetEventBoostPriority  ... ) == 0x0
 02988  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1636,Tid=1592,}, 0x0, ) == 0x0
 02991  1604   NtWaitForSingleObject  (356, 0, 0x0, ...
 02992  1864   NtSetEventBoostPriority  (312, ...
 02993  1936   NtSetEventBoostPriority  (356, ...
 02953   252   NtWaitForSingleObject  ... ) == 0x0
 02992  1864   NtSetEventBoostPriority  ... ) == 0x0
 02994   252   NtSetEventBoostPriority  (312, ...
 02925  1856   NtWaitForSingleObject  ... ) == 0x0
 02993  1936   NtSetEventBoostPriority  ... ) == 0x0
 02995  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75635, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75635, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0d\6\0\08\6\0\0" ...  ...
 02954   432   NtWaitForSingleObject  ... ) == 0x0
 02996  1856   NtWaitForSingleObject  (312, 0, 0x0, ...
 02994   252   NtSetEventBoostPriority  ... ) == 0x0
 02997  1936   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02998   432   NtSetEventBoostPriority  (312, ...
 02995  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75636, 0}  ... {28, 56, reply, 0, 1636, 1736, 75636, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0d\6\0\08\6\0\0" )  ) == 0x0
 02999  1864   NtWaitForSingleObject  (312, 0, 0x0, ...
 02956  1944   NtWaitForSingleObject  ... ) == 0x0
 02998   432   NtSetEventBoostPriority  ... ) == 0x0
 02997  1936   NtWaitForSingleObject  ... ) == 0x102
 03000  1736   NtResumeThread  (820, ...
 03001  1944   NtSetEventBoostPriority  (312, ...
 03002   252   NtSetEventBoostPriority  (164, ...
 03003  1936   NtWaitForSingleObject  (164, 0, 0x0, ...
 02957  1096   NtWaitForSingleObject  ... ) == 0x0
 03001  1944   NtSetEventBoostPriority  ... ) == 0x0
 03000  1736   NtResumeThread  ... 1, ) == 0x0
 01531  1324   NtWaitForSingleObject  ... ) == 0x0
 03002   252   NtSetEventBoostPriority  ... ) == 0x0
 03004   432   NtWaitForSingleObject  (312, 0, 0x0, ...
 03005  1592   NtWaitForSingleObject  (128, 0, 0x0, ...
 03006  1096   NtSetEventBoostPriority  (312, ...
 03007  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03008  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03009   252   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02935   428   NtWaitForSingleObject  ... ) == 0x0
 03006  1096   NtSetEventBoostPriority  ... ) == 0x0
 03010  1944   NtWaitForSingleObject  (312, 0, 0x0, ...
 03011   428   NtSetEventBoostPriority  (312, ...
 03009   252   NtCreateEvent  ... 824, ) == 0x0
 03008  1736   NtAllocateVirtualMemory  ... 88145920, 1048576, ) == 0x0
 02961  1024   NtWaitForSingleObject  ... ) == 0x0
 03012   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03013  1736   NtAllocateVirtualMemory  (-1, 89186304, 0, 8192, 4096, 4, ...
 03014  1024   NtSetEventBoostPriority  (312, ...
 03013  1736   NtAllocateVirtualMemory  ... 89186304, 8192, ) == 0x0
 02962  1132   NtWaitForSingleObject  ... ) == 0x0
 03014  1024   NtSetEventBoostPriority  ... ) == 0x0
 03015  1132   NtSetEventBoostPriority  (312, ...
 03016  1736   NtProtectVirtualMemory  (-1, (0x550e000), 4096, 260, ...
 03011   428   NtSetEventBoostPriority  ... ) == 0x0
 03017  1096   NtClose  (700, ...
 02960  1556   NtWaitForSingleObject  ... ) == 0x0
 03015  1132   NtSetEventBoostPriority  ... ) == 0x0
 03016  1736   NtProtectVirtualMemory  ... (0x550e000), 4096, 4, ) == 0x0
 03018   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03019  1556   NtSetEventBoostPriority  (312, ...
 03017  1096   NtClose  ... ) == 0x0
 03020  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03021  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02965   748   NtWaitForSingleObject  ... ) == 0x0
 03022  1096   NtClose  (792, ...
 03019  1556   NtSetEventBoostPriority  ... ) == 0x0
 03023  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 03024   748   NtSetEventBoostPriority  (312, ...
 03022  1096   NtClose  ... ) == 0x0
 03025  1556   NtWaitForSingleObject  (164, 0, 0x0, ...
 02967   308   NtWaitForSingleObject  ... ) == 0x0
 03026  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 03027   308   NtSetEventBoostPriority  (312, ...
 02990  1300   NtWaitForSingleObject  ... ) == 0x0
 03028  1300   NtSetEventBoostPriority  (312, ...
 02996  1856   NtWaitForSingleObject  ... ) == 0x0
 03029  1856   NtSetEventBoostPriority  (312, ...
 02999  1864   NtWaitForSingleObject  ... ) == 0x0
 03030  1864   NtSetEventBoostPriority  (312, ...
 03004   432   NtWaitForSingleObject  ... ) == 0x0
 03031   432   NtSetEventBoostPriority  (312, ...
 03007  1324   NtWaitForSingleObject  ... ) == 0x0
 03032  1324   NtSetEventBoostPriority  (312, ...
 03010  1944   NtWaitForSingleObject  ... ) == 0x0
 03033  1944   NtSetEventBoostPriority  (312, ...
 03012   252   NtWaitForSingleObject  ... ) == 0x0
 03034   252   NtSetEventBoostPriority  (312, ...
 03018   428   NtWaitForSingleObject  ... ) == 0x0
 03035   428   NtSetEventBoostPriority  (312, ...
 03020  1024   NtWaitForSingleObject  ... ) == 0x0
 03036  1024   NtSetEventBoostPriority  (312, ...
 03023  1132   NtWaitForSingleObject  ... ) == 0x0
 03037  1132   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ... 1429504, 4096, ) == 0x0
 03038  1132   NtSetEventBoostPriority  (312, ...
 03036  1024   NtSetEventBoostPriority  ... ) == 0x0
 03035   428   NtSetEventBoostPriority  ... ) == 0x0
 03034   252   NtSetEventBoostPriority  ... ) == 0x0
 03033  1944   NtSetEventBoostPriority  ... ) == 0x0
 03032  1324   NtSetEventBoostPriority  ... ) == 0x0
 03031   432   NtSetEventBoostPriority  ... ) == 0x0
 03030  1864   NtSetEventBoostPriority  ... ) == 0x0
 03029  1856   NtSetEventBoostPriority  ... ) == 0x0
 03027   308   NtSetEventBoostPriority  ... ) == 0x0
 03028  1300   NtSetEventBoostPriority  ... ) == 0x0
 03024   748   NtSetEventBoostPriority  ... ) == 0x0
 03021  1736   NtCreateThread  ... 792, {1636, 1500}, ) == 0x0
 03039  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03026  1096   NtWaitForSingleObject  ... ) == 0x0
 03038  1132   NtSetEventBoostPriority  ... ) == 0x0
 03040   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03041  1944   NtWaitForSingleObject  (356, 0, 0x0, ...
 03042   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03043   432   NtWaitForSingleObject  (356, 0, 0x0, ...
 03044  1864   NtWaitForSingleObject  (356, 0, 0x0, ...
 03045  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03046  1856   NtSetEventBoostPriority  (356, ...
 03047  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03048   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 03049  1736   NtQueryInformationThread  (792, Basic, 28, ...
 03050   308   NtSetEventBoostPriority  (128, ...
 03051  1096   NtSetEventBoostPriority  (312, ...
 03052  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 02927  1572   NtWaitForSingleObject  ... ) == 0x0
 03046  1856   NtSetEventBoostPriority  ... ) == 0x0
 03049  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1636,Tid=1500,}, 0x0, ) == 0x0
 03005  1592   NtWaitForSingleObject  ... ) == 0x0
 03050   308   NtSetEventBoostPriority  ... ) == 0x0
 03040   428   NtWaitForSingleObject  ... ) == 0x0
 03051  1096   NtSetEventBoostPriority  ... ) == 0x0
 03053  1572   NtSetEventBoostPriority  (356, ...
 03054  1856   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03055  1592   NtWaitForSingleObject  (312, 0, 0x0, ...
 03056  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75636, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75636, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0d\6\0\0\334\5\0\0" ...  ...
 03057   428   NtSetEventBoostPriority  (312, ...
 03058   308   NtTestAlert  (...
 02929   460   NtWaitForSingleObject  ... ) == 0x0
 03053  1572   NtSetEventBoostPriority  ... ) == 0x0
 03054  1856   NtWaitForSingleObject  ... ) == 0x102
 03039  1024   NtWaitForSingleObject  ... ) == 0x0
 03057   428   NtSetEventBoostPriority  ... ) == 0x0
 03056  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75637, 0}  ... {28, 56, reply, 0, 1636, 1736, 75637, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\3\0\0d\6\0\0\334\5\0\0" )  ) == 0x0
 03059   460   NtWaitForSingleObject  (312, 0, 0x0, ...
 03058   308   NtTestAlert  ... ) == 0x0
 03060  1572   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03061  1024   NtSetEventBoostPriority  (312, ...
 03062  1856   NtWaitForSingleObject  (164, 0, 0x0, ...
 03063   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03064  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 03065   308   NtContinue  (87096624, 1, ...
 03066  1736   NtResumeThread  (792, ...
 03042   252   NtWaitForSingleObject  ... ) == 0x0
 03061  1024   NtSetEventBoostPriority  ... ) == 0x0
 03060  1572   NtWaitForSingleObject  ... ) == 0x102
 03067   308   NtRegisterThreadTerminatePort  (24, ...
 03066  1736   NtResumeThread  ... 1, ) == 0x0
 03068   252   NtSetEventBoostPriority  (312, ...
 03069  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03070  1572   NtWaitForSingleObject  (164, 0, 0x0, ...
 03071  1500   NtWaitForSingleObject  (128, 0, 0x0, ...
 03072  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03045  1324   NtWaitForSingleObject  ... ) == 0x0
 03068   252   NtSetEventBoostPriority  ... ) == 0x0
 03073  1324   NtSetEventBoostPriority  (312, ...
 03072  1736   NtAllocateVirtualMemory  ... 89194496, 1048576, ) == 0x0
 03047  1300   NtWaitForSingleObject  ... ) == 0x0
 03073  1324   NtSetEventBoostPriority  ... ) == 0x0
 03074   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03075  1300   NtSetEventBoostPriority  (312, ...
 03076  1736   NtAllocateVirtualMemory  (-1, 90234880, 0, 8192, 4096, 4, ...
 03077  1324   NtSetEventBoostPriority  (164, ...
 03067   308   NtRegisterThreadTerminatePort  ... ) == 0x0
 03048   748   NtWaitForSingleObject  ... ) == 0x0
 03075  1300   NtSetEventBoostPriority  ... ) == 0x0
 03076  1736   NtAllocateVirtualMemory  ... 90234880, 8192, ) == 0x0
 03078   748   NtSetEventBoostPriority  (312, ...
 03079   308   NtWaitForSingleObject  (312, 0, 0x0, ...
 01595  2040   NtWaitForSingleObject  ... ) == 0x0
 03077  1324   NtSetEventBoostPriority  ... ) == 0x0
 03080  1300   NtAllocateVirtualMemory  (-1, 14733312, 0, 4096, 4096, 260, ...
 03052  1132   NtWaitForSingleObject  ... ) == 0x0
 03078   748   NtSetEventBoostPriority  ... ) == 0x0
 03081  2040   NtWaitForSingleObject  (312, 0, 0x0, ...
 03082  1324   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03083  1132   NtSetEventBoostPriority  (312, ...
 03080  1300   NtAllocateVirtualMemory  ... 14733312, 4096, ) == 0x0
 03084  1736   NtProtectVirtualMemory  (-1, (0x560e000), 4096, 260, ...
 03055  1592   NtWaitForSingleObject  ... ) == 0x0
 03083  1132   NtSetEventBoostPriority  ... ) == 0x0
 03082  1324   NtCreateEvent  ... 700, ) == 0x0
 03085  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03086  1592   NtSetEventBoostPriority  (312, ...
 03084  1736   NtProtectVirtualMemory  ... (0x560e000), 4096, 4, ) == 0x0
 03087   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 03088  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03059   460   NtWaitForSingleObject  ... ) == 0x0
 03086  1592   NtSetEventBoostPriority  ... ) == 0x0
 03089  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03090   460   NtSetEventBoostPriority  (312, ...
 03091  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 03064  1096   NtWaitForSingleObject  ... ) == 0x0
 03090   460   NtSetEventBoostPriority  ... ) == 0x0
 03089  1736   NtCreateThread  ... 828, {1636, 2032}, ) == 0x0
 03092  1096   NtSetEventBoostPriority  (312, ...
 03093  1592   NtSetEventBoostPriority  (128, ...
 03063   428   NtWaitForSingleObject  ... ) == 0x0
 03092  1096   NtSetEventBoostPriority  ... ) == 0x0
 03094  1736   NtQueryInformationThread  (828, Basic, 28, ...
 03095   428   NtSetEventBoostPriority  (312, ...
 03071  1500   NtWaitForSingleObject  ... ) == 0x0
 03093  1592   NtSetEventBoostPriority  ... ) == 0x0
 03096  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 03069  1024   NtWaitForSingleObject  ... ) == 0x0
 03097  1500   NtWaitForSingleObject  (312, 0, 0x0, ...
 03094  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1636,Tid=2032,}, 0x0, ) == 0x0
 03098  1592   NtTestAlert  (...
 03095   428   NtSetEventBoostPriority  ... ) == 0x0
 03099   460   NtSetEventBoostPriority  (356, ...
 03100  1024   NtSetEventBoostPriority  (312, ...
 03098  1592   NtTestAlert  ... ) == 0x0
 03101   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 02937  1956   NtWaitForSingleObject  ... ) == 0x0
 03099   460   NtSetEventBoostPriority  ... ) == 0x0
 03074   252   NtWaitForSingleObject  ... ) == 0x0
 03100  1024   NtSetEventBoostPriority  ... ) == 0x0
 03102  1592   NtContinue  (88145200, 1, ...
 03103  1956   NtWaitForSingleObject  (312, 0, 0x0, ...
 03104   252   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ...
 03105   460   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03106  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75637, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75637, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0d\6\0\0\360\7\0\0" ...  ...
 03104   252   NtAllocateVirtualMemory  ... 1433600, 4096, ) == 0x0
 03107  1592   NtRegisterThreadTerminatePort  (24, ...
 03105   460   NtWaitForSingleObject  ... ) == 0x102
 03108   252   NtSetEventBoostPriority  (312, ...
 03106  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75638, 0}  ... {28, 56, reply, 0, 1636, 1736, 75638, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0d\6\0\0\360\7\0\0" )  ) == 0x0
 03109  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03079   308   NtWaitForSingleObject  ... ) == 0x0
 03110   460   NtWaitForSingleObject  (164, 0, 0x0, ...
 03111  1736   NtResumeThread  (828, ...
 03112   308   NtSetEventBoostPriority  (312, ...
 03108   252   NtSetEventBoostPriority  ... ) == 0x0
 03107  1592   NtRegisterThreadTerminatePort  ... ) == 0x0
 03111  1736   NtResumeThread  ... 1, ) == 0x0
 03081  2040   NtWaitForSingleObject  ... ) == 0x0
 03112   308   NtSetEventBoostPriority  ... ) == 0x0
 03113  2032   NtWaitForSingleObject  (128, 0, 0x0, ...
 03114  1592   NtWaitForSingleObject  (312, 0, 0x0, ...
 03115  2040   NtSetEventBoostPriority  (312, ...
 03116  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03117   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03085  1300   NtWaitForSingleObject  ... ) == 0x0
 03115  2040   NtSetEventBoostPriority  ... ) == 0x0
 03118   308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03119  1300   NtSetEventBoostPriority  (312, ...
 03116  1736   NtAllocateVirtualMemory  ... 90243072, 1048576, ) == 0x0
 03087   748   NtWaitForSingleObject  ... ) == 0x0
 03119  1300   NtSetEventBoostPriority  ... ) == 0x0
 03118   308   NtDuplicateObject  ... 832, ) == 0x0
 03120   748   NtSetEventBoostPriority  (312, ...
 03121  1736   NtAllocateVirtualMemory  (-1, 91283456, 0, 8192, 4096, 4, ...
 03122  2040   NtSetEventBoostPriority  (164, ...
 03088  1324   NtWaitForSingleObject  ... ) == 0x0
 03120   748   NtSetEventBoostPriority  ... ) == 0x0
 03123   308   NtWaitForSingleObject  (312, 0, 0x0, ...
 03121  1736   NtAllocateVirtualMemory  ... 91283456, 8192, ) == 0x0
 03124  1324   NtSetEventBoostPriority  (312, ...
 01602  1776   NtWaitForSingleObject  ... ) == 0x0
 03122  2040   NtSetEventBoostPriority  ... ) == 0x0
 03125   748   NtAllocateVirtualMemory  (-1, 13684736, 0, 4096, 4096, 260, ...
 03091  1132   NtWaitForSingleObject  ... ) == 0x0
 03126  1776   NtWaitForSingleObject  (312, 0, 0x0, ...
 03124  1324   NtSetEventBoostPriority  ... ) == 0x0
 03127  1736   NtProtectVirtualMemory  (-1, (0x570e000), 4096, 260, ...
 03128  2040   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03129  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03130  1132   NtSetEventBoostPriority  (312, ...
 03125   748   NtAllocateVirtualMemory  ... 13684736, 4096, ) == 0x0
 03127  1736   NtProtectVirtualMemory  ... (0x570e000), 4096, 4, ) == 0x0
 03128  2040   NtCreateEvent  ... 836, ) == 0x0
 03097  1500   NtWaitForSingleObject  ... ) == 0x0
 03130  1132   NtSetEventBoostPriority  ... ) == 0x0
 03131   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 03132  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03133  1500   NtSetEventBoostPriority  (312, ...
 03134  2040   NtWaitForSingleObject  (312, 0, 0x0, ...
 03135  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 03136  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03096  1096   NtWaitForSingleObject  ... ) == 0x0
 03133  1500   NtSetEventBoostPriority  ... ) == 0x0
 03132  1736   NtCreateThread  ... 840, {1636, 1528}, ) == 0x0
 03137  1096   NtSetEventBoostPriority  (312, ...
 03101   428   NtWaitForSingleObject  ... ) == 0x0
 03138   428   NtSetEventBoostPriority  (312, ...
 03103  1956   NtWaitForSingleObject  ... ) == 0x0
 03139  1956   NtSetEventBoostPriority  (312, ...
 03109  1024   NtWaitForSingleObject  ... ) == 0x0
 03140  1024   NtSetEventBoostPriority  (312, ...
 03114  1592   NtWaitForSingleObject  ... ) == 0x0
 03141  1592   NtSetEventBoostPriority  (312, ...
 03117   252   NtWaitForSingleObject  ... ) == 0x0
 03142   252   NtSetEventBoostPriority  (312, ...
 03123   308   NtWaitForSingleObject  ... ) == 0x0
 03143   308   NtSetEventBoostPriority  (312, ...
 03126  1776   NtWaitForSingleObject  ... ) == 0x0
 03144  1776   NtSetEventBoostPriority  (312, ...
 03129  1300   NtWaitForSingleObject  ... ) == 0x0
 03145  1300   NtSetEventBoostPriority  (312, ...
 03131   748   NtWaitForSingleObject  ... ) == 0x0
 03146   748   NtSetEventBoostPriority  (312, ...
 03134  2040   NtWaitForSingleObject  ... ) == 0x0
 03147  2040   NtSetEventBoostPriority  (312, ...
 03136  1324   NtWaitForSingleObject  ... ) == 0x0
 03148  1324   NtSetEventBoostPriority  (312, ...
 03135  1132   NtWaitForSingleObject  ... ) == 0x0
 03149  1132   NtAllocateVirtualMemory  (-1, 17879040, 0, 4096, 4096, 260, ... 17879040, 4096, ) == 0x0
 03150  1132   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 844, ) == 0x0
 03148  1324   NtSetEventBoostPriority  ... ) == 0x0
 03147  2040   NtSetEventBoostPriority  ... ) == 0x0
 03146   748   NtSetEventBoostPriority  ... ) == 0x0
 03145  1300   NtSetEventBoostPriority  ... ) == 0x0
 03144  1776   NtSetEventBoostPriority  ... ) == 0x0
 03143   308   NtSetEventBoostPriority  ... ) == 0x0
 03142   252   NtSetEventBoostPriority  ... ) == 0x0
 03141  1592   NtSetEventBoostPriority  ... ) == 0x0
 03140  1024   NtSetEventBoostPriority  ... ) == 0x0
 03139  1956   NtSetEventBoostPriority  ... ) == 0x0
 03138   428   NtSetEventBoostPriority  ... ) == 0x0
 03151  1736   NtQueryInformationThread  (840, Basic, 28, ...
 03137  1096   NtSetEventBoostPriority  ... ) == 0x0
 03152  1500   NtSetEventBoostPriority  (128, ...
 03153  1324   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ...
 03154  1132   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03155  2040   NtWaitForSingleObject  (312, 0, 0x0, ...
 03156  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03157   748   NtWaitForSingleObject  (312, 0, 0x0, ...
 03158  1776   NtWaitForSingleObject  (312, 0, 0x0, ...
 03159   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03160   308   NtWaitForSingleObject  (312, 0, 0x0, ...
 03161  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03162  1592   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03163  1956   NtSetEventBoostPriority  (356, ...
 03151  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1636,Tid=1528,}, 0x0, ) == 0x0
 03164  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 03113  2032   NtWaitForSingleObject  ... ) == 0x0
 03152  1500   NtSetEventBoostPriority  ... ) == 0x0
 03165   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03154  1132   NtDuplicateObject  ... 848, ) == 0x0
 03153  1324   NtAllocateVirtualMemory  ... 1437696, 4096, ) == 0x0
 03162  1592   NtDuplicateObject  ... 852, ) == 0x0
 02970   464   NtWaitForSingleObject  ... ) == 0x0
 03163  1956   NtSetEventBoostPriority  ... ) == 0x0
 03166  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75638, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75638, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0d\6\0\0\370\5\0\0" ...  ...
 03167  2032   NtTestAlert  (...
 03168  1500   NtTestAlert  (...
 03169  1132   NtWaitForSingleObject  (312, 0, 0x0, ...
 03170  1324   NtSetEventBoostPriority  (312, ...
 03171   464   NtWaitForSingleObject  (312, 0, 0x0, ...
 03172  1592   NtWaitForSingleObject  (312, 0, 0x0, ...
 03173  1956   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03167  2032   NtTestAlert  ... ) == 0x0
 03166  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75639, 0}  ... {28, 56, reply, 0, 1636, 1736, 75639, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0d\6\0\0\370\5\0\0" )  ) == 0x0
 03168  1500   NtTestAlert  ... ) == 0x0
 03155  2040   NtWaitForSingleObject  ... ) == 0x0
 03170  1324   NtSetEventBoostPriority  ... ) == 0x0
 03173  1956   NtWaitForSingleObject  ... ) == 0x102
 03174  2032   NtContinue  (90242352, 1, ...
 03175  2040   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ...
 03176  1500   NtContinue  (89193776, 1, ...
 03177  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03178  1956   NtWaitForSingleObject  (312, 0, 0x0, ...
 03175  2040   NtAllocateVirtualMemory  ... 1441792, 4096, ) == 0x0
 03179  2032   NtRegisterThreadTerminatePort  (24, ...
 03180  1500   NtRegisterThreadTerminatePort  (24, ...
 03181  1736   NtResumeThread  (840, ...
 03182  2040   NtSetEventBoostPriority  (312, ...
 03179  2032   NtRegisterThreadTerminatePort  ... ) == 0x0
 03181  1736   NtResumeThread  ... 1, ) == 0x0
 03180  1500   NtRegisterThreadTerminatePort  ... ) == 0x0
 03183  2032   NtWaitForSingleObject  (312, 0, 0x0, ...
 03184  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03185  1500   NtWaitForSingleObject  (312, 0, 0x0, ...
 03184  1736   NtAllocateVirtualMemory  ... 91291648, 1048576, ) == 0x0
 03186  1736   NtAllocateVirtualMemory  (-1, 92332032, 0, 8192, 4096, 4, ... 92332032, 8192, ) == 0x0
 03187  1736   NtProtectVirtualMemory  (-1, (0x580e000), 4096, 260, ... (0x580e000), 4096, 4, ) == 0x0
 03188  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 856, {1636, 1804}, ) == 0x0
 03189  1736   NtQueryInformationThread  (856, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1636,Tid=1804,}, 0x0, ) == 0x0
 03157   748   NtWaitForSingleObject  ... ) == 0x0
 03182  2040   NtSetEventBoostPriority  ... ) == 0x0
 03190  1528   NtWaitForSingleObject  (312, 0, 0x0, ...
 03191   748   NtSetEventBoostPriority  (312, ...
 03192  2040   NtWaitForSingleObject  (312, 0, 0x0, ...
 03158  1776   NtWaitForSingleObject  ... ) == 0x0
 03191   748   NtSetEventBoostPriority  ... ) == 0x0
 03193  1776   NtSetEventBoostPriority  (312, ...
 03156  1300   NtWaitForSingleObject  ... ) == 0x0
 03194  1300   NtSetEventBoostPriority  (312, ...
 03160   308   NtWaitForSingleObject  ... ) == 0x0
 03195   308   NtSetEventBoostPriority  (312, ...
 03159   252   NtWaitForSingleObject  ... ) == 0x0
 03196   252   NtSetEventBoostPriority  (312, ...
 03164  1096   NtWaitForSingleObject  ... ) == 0x0
 03197  1096   NtSetEventBoostPriority  (312, ...
 03165   428   NtWaitForSingleObject  ... ) == 0x0
 03198   428   NtSetEventBoostPriority  (312, ...
 03169  1132   NtWaitForSingleObject  ... ) == 0x0
 03199  1132   NtSetEventBoostPriority  (312, ...
 03171   464   NtWaitForSingleObject  ... ) == 0x0
 03200   464   NtSetEventBoostPriority  (312, ...
 03172  1592   NtWaitForSingleObject  ... ) == 0x0
 03201  1592   NtSetEventBoostPriority  (312, ...
 03161  1024   NtWaitForSingleObject  ... ) == 0x0
 03202  1024   NtSetEventBoostPriority  (312, ...
 03177  1324   NtWaitForSingleObject  ... ) == 0x0
 03203  1324   NtSetEventBoostPriority  (312, ...
 03178  1956   NtWaitForSingleObject  ... ) == 0x0
 03204  1956   NtSetEventBoostPriority  (312, ...
 03183  2032   NtWaitForSingleObject  ... ) == 0x0
 03205  2032   NtSetEventBoostPriority  (312, ...
 03185  1500   NtWaitForSingleObject  ... ) == 0x0
 03206  1500   NtSetEventBoostPriority  (312, ...
 03190  1528   NtWaitForSingleObject  ... ) == 0x0
 03207  1528   NtSetEventBoostPriority  (312, ...
 03192  2040   NtWaitForSingleObject  ... ) == 0x0
 03208  2040   NtAllocateVirtualMemory  (-1, 23121920, 0, 4096, 4096, 260, ... 23121920, 4096, ) == 0x0
 03207  1528   NtSetEventBoostPriority  ... ) == 0x0
 03206  1500   NtSetEventBoostPriority  ... ) == 0x0
 03205  2032   NtSetEventBoostPriority  ... ) == 0x0
 03203  1324   NtSetEventBoostPriority  ... ) == 0x0
 03201  1592   NtSetEventBoostPriority  ... ) == 0x0
 03200   464   NtSetEventBoostPriority  ... ) == 0x0
 03199  1132   NtSetEventBoostPriority  ... ) == 0x0
 03198   428   NtSetEventBoostPriority  ... ) == 0x0
 03197  1096   NtSetEventBoostPriority  ... ) == 0x0
 03195   308   NtSetEventBoostPriority  ... ) == 0x0
 03193  1776   NtSetEventBoostPriority  ... ) == 0x0
 03209   748   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03204  1956   NtSetEventBoostPriority  ... ) == 0x0
 03202  1024   NtSetEventBoostPriority  ... ) == 0x0
 03196   252   NtSetEventBoostPriority  ... ) == 0x0
 03194  1300   NtSetEventBoostPriority  ... ) == 0x0
 03210  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75639, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75639, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0d\6\0\0\14\7\0\0" ...  ...
 03211  2040   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03212  1528   NtTestAlert  (...
 03213  1500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03214  2032   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03215  1324   NtAllocateVirtualMemory  (-1, 31510528, 0, 4096, 4096, 260, ...
 03216  1592   NtWaitForSingleObject  (356, 0, 0x0, ...
 03217   464   NtSetEventBoostPriority  (356, ...
 03218   428   NtAllocateVirtualMemory  (-1, 12636160, 0, 4096, 4096, 260, ...
 03219  1132   NtWaitForSingleObject  (356, 0, 0x0, ...
 03220   308   NtWaitForSingleObject  (356, 0, 0x0, ...
 03221  1776   NtSetEventBoostPriority  (164, ...
 03222  1096   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 03223  1956   NtWaitForSingleObject  (164, 0, 0x0, ...
 03224  1024   NtAllocateVirtualMemory  (-1, 18927616, 0, 4096, 4096, 260, ...
 03225   252   NtAllocateVirtualMemory  (-1, 16830464, 0, 4096, 4096, 260, ...
 03226  1300   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03210  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75640, 0}  ... {28, 56, reply, 0, 1636, 1736, 75640, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\3\0\0d\6\0\0\14\7\0\0" )  ) == 0x0
 03211  2040   NtCreateEvent  ... 860, ) == 0x0
 03212  1528   NtTestAlert  ... ) == 0x0
 03213  1500   NtDuplicateObject  ... 864, ) == 0x0
 03214  2032   NtDuplicateObject  ... 868, ) == 0x0
 03215  1324   NtAllocateVirtualMemory  ... 31510528, 4096, ) == 0x0
 02972  1256   NtWaitForSingleObject  ... ) == 0x0
 03217   464   NtSetEventBoostPriority  ... ) == 0x0
 03209   748   NtCreateEvent  ... 872, ) == 0x0
 03218   428   NtAllocateVirtualMemory  ... 12636160, 4096, ) == 0x0
 03222  1096   NtCreateKey  ... 876, 2, ) == 0x0
 03224  1024   NtAllocateVirtualMemory  ... 18927616, 4096, ) == 0x0
 03225   252   NtAllocateVirtualMemory  ... 16830464, 4096, ) == 0x0
 03226  1300   NtCreateEvent  ... 880, ) == 0x0
 03227  1736   NtResumeThread  (856, ...
 03228  2040   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03229  1528   NtContinue  (91290928, 1, ...
 03230  1500   NtWaitForSingleObject  (356, 0, 0x0, ...
 03231  2032   NtWaitForSingleObject  (356, 0, 0x0, ...
 03232  1256   NtSetEventBoostPriority  (356, ...
 03233  1324   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03234   464   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03235   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03236   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03237  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01605  1708   NtWaitForSingleObject  ... ) == 0x0
 03221  1776   NtSetEventBoostPriority  ... ) == 0x0
 03238  1024   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03239   252   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03227  1736   NtResumeThread  ... 1, ) == 0x0
 03228  2040   NtDuplicateObject  ... 884, ) == 0x0
 03240  1528   NtRegisterThreadTerminatePort  (24, ...
 02975  1764   NtWaitForSingleObject  ... ) == 0x0
 03232  1256   NtSetEventBoostPriority  ... ) == 0x0
 03233  1324   NtCreateEvent  ... 888, ) == 0x0
 03234   464   NtWaitForSingleObject  ... ) == 0x102
 03235   748   NtDuplicateObject  ... 892, ) == 0x0
 03236   428   NtCreateEvent  ... 896, ) == 0x0
 03237  1096   NtOpenKey  ... 900, ) == 0x0
 03241  1708   NtSetEventBoostPriority  (164, ...
 03242  1776   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03238  1024   NtCreateEvent  ... 904, ) == 0x0
 03239   252   NtCreateEvent  ... 908, ) == 0x0
 03243  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03244  2040   NtWaitForSingleObject  (356, 0, 0x0, ...
 03245  1764   NtSetEventBoostPriority  (356, ...
 03240  1528   NtRegisterThreadTerminatePort  ... ) == 0x0
 03246  1256   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03247  1324   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03248   464   NtWaitForSingleObject  (164, 0, 0x0, ...
 03249   748   NtWaitForSingleObject  (356, 0, 0x0, ...
 03250   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03251  1096   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01609  2036   NtWaitForSingleObject  ... ) == 0x0
 03241  1708   NtSetEventBoostPriority  ... ) == 0x0
 03242  1776   NtCreateEvent  ... 912, ) == 0x0
 03252  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03253   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03254  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03255  1804   NtTestAlert  (...
 02977   712   NtWaitForSingleObject  ... ) == 0x0
 03245  1764   NtSetEventBoostPriority  ... ) == 0x0
 03256  1528   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03243  1736   NtAllocateVirtualMemory  ... 92340224, 1048576, ) == 0x0
 03247  1324   NtDuplicateObject  ... 916, ) == 0x0
 03246  1256   NtWaitForSingleObject  ... ) == 0x102
 03250   428   NtDuplicateObject  ... 920, ) == 0x0
 03257  2036   NtSetEventBoostPriority  (164, ...
 03251  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03258  1708   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03259  1776   NtAllocateVirtualMemory  (-1, 1445888, 0, 4096, 4096, 4, ...
 03252  1024   NtDuplicateObject  ... 924, ) == 0x0
 03253   252   NtDuplicateObject  ... 928, ) == 0x0
 03254  1300   NtDuplicateObject  ... 932, ) == 0x0
 03260   712   NtWaitForSingleObject  (312, 0, 0x0, ...
 03255  1804   NtTestAlert  ... ) == 0x0
 03261  1764   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03262  1736   NtAllocateVirtualMemory  (-1, 93380608, 0, 8192, 4096, 4, ...
 03256  1528   NtDuplicateObject  ... 936, ) == 0x0
 03263  1256   NtWaitForSingleObject  (164, 0, 0x0, ...
 01613  1388   NtWaitForSingleObject  ... ) == 0x0
 03257  2036   NtSetEventBoostPriority  ... ) == 0x0
 03264   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03265  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03266  1096   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 03259  1776   NtAllocateVirtualMemory  ... 1445888, 4096, ) == 0x0
 03267  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03268   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03269  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03270  1804   NtContinue  (92339504, 1, ...
 03258  1708   NtCreateEvent  ... 940, ) == 0x0
 03262  1736   NtAllocateVirtualMemory  ... 93380608, 8192, ) == 0x0
 03271  1528   NtWaitForSingleObject  (312, 0, 0x0, ...
 03272  1388   NtWaitForSingleObject  (312, 0, 0x0, ...
 03273  2036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03261  1764   NtWaitForSingleObject  ... ) == 0x102
 03266  1096   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03274  1776   NtSetEventBoostPriority  (312, ...
 03275  1804   NtRegisterThreadTerminatePort  (24, ...
 03276  1708   NtWaitForSingleObject  (312, 0, 0x0, ...
 03277  1736   NtProtectVirtualMemory  (-1, (0x590e000), 4096, 260, ...
 03278  1764   NtWaitForSingleObject  (312, 0, 0x0, ...
 03279  1096   NtQueryValueKey  (876,  (876, "Domain", Partial, 144, ... , Partial, 144, ...
 03273  2036   NtCreateEvent  ... 944, ) == 0x0
 03275  1804   NtRegisterThreadTerminatePort  ... ) == 0x0
 03277  1736   NtProtectVirtualMemory  ... (0x590e000), 4096, 4, ) == 0x0
 03279  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03280  2036   NtWaitForSingleObject  (312, 0, 0x0, ...
 03260   712   NtWaitForSingleObject  ... ) == 0x0
 03274  1776   NtSetEventBoostPriority  ... ) == 0x0
 03281  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03282  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 03283   712   NtSetEventBoostPriority  (312, ...
 03284  1776   NtWaitForSingleObject  (312, 0, 0x0, ...
 03285  1804   NtWaitForSingleObject  (312, 0, 0x0, ...
 03265  1324   NtWaitForSingleObject  ... ) == 0x0
 03283   712   NtSetEventBoostPriority  ... ) == 0x0
 03286  1324   NtSetEventBoostPriority  (312, ...
 03281  1736   NtCreateThread  ... 948, {1636, 336}, ) == 0x0
 03267  1024   NtWaitForSingleObject  ... ) == 0x0
 03286  1324   NtSetEventBoostPriority  ... ) == 0x0
 03287  1024   NtSetEventBoostPriority  (312, ...
 03288  1736   NtQueryInformationThread  (948, Basic, 28, ...
 03268   252   NtWaitForSingleObject  ... ) == 0x0
 03287  1024   NtSetEventBoostPriority  ... ) == 0x0
 03289  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03290   252   NtSetEventBoostPriority  (312, ...
 03288  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1636,Tid=336,}, 0x0, ) == 0x0
 03291   712   NtSetEventBoostPriority  (356, ...
 03292  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03269  1300   NtWaitForSingleObject  ... ) == 0x0
 03290   252   NtSetEventBoostPriority  ... ) == 0x0
 03293  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75640, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75640, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0d\6\0\0P\1\0\0" ...  ...
 02978  1156   NtWaitForSingleObject  ... ) == 0x0
 03291   712   NtSetEventBoostPriority  ... ) == 0x0
 03294  1300   NtSetEventBoostPriority  (312, ...
 03295  1156   NtWaitForSingleObject  (312, 0, 0x0, ...
 03293  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75641, 0}  ... {28, 56, reply, 0, 1636, 1736, 75641, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0d\6\0\0P\1\0\0" )  ) == 0x0
 03272  1388   NtWaitForSingleObject  ... ) == 0x0
 03294  1300   NtSetEventBoostPriority  ... ) == 0x0
 03296   712   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03297   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03298  1388   NtSetEventBoostPriority  (312, ...
 03299  1736   NtResumeThread  (948, ...
 03296   712   NtWaitForSingleObject  ... ) == 0x102
 03271  1528   NtWaitForSingleObject  ... ) == 0x0
 03298  1388   NtSetEventBoostPriority  ... ) == 0x0
 03299  1736   NtResumeThread  ... 1, ) == 0x0
 03300  1528   NtSetEventBoostPriority  (312, ...
 03301   712   NtWaitForSingleObject  (312, 0, 0x0, ...
 03302  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03303   336   NtAllocateVirtualMemory  (-1, 3633152, 0, 4096, 4096, 4, ...
 03264   428   NtWaitForSingleObject  ... ) == 0x0
 03300  1528   NtSetEventBoostPriority  ... ) == 0x0
 03304  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03305  1388   NtWaitForSingleObject  (312, 0, 0x0, ...
 03306   428   NtSetEventBoostPriority  (312, ...
 03303   336   NtAllocateVirtualMemory  ... 3633152, 4096, ) == 0x0
 03304  1736   NtAllocateVirtualMemory  ... 93388800, 1048576, ) == 0x0
 03276  1708   NtWaitForSingleObject  ... ) == 0x0
 03307   336   NtWaitForSingleObject  (312, 0, 0x0, ...
 03308  1736   NtAllocateVirtualMemory  (-1, 94429184, 0, 8192, 4096, 4, ...
 03309  1708   NtSetEventBoostPriority  (312, ...
 03308  1736   NtAllocateVirtualMemory  ... 94429184, 8192, ) == 0x0
 03278  1764   NtWaitForSingleObject  ... ) == 0x0
 03309  1708   NtSetEventBoostPriority  ... ) == 0x0
 03306   428   NtSetEventBoostPriority  ... ) == 0x0
 03310  1528   NtWaitForSingleObject  (312, 0, 0x0, ...
 03311  1764   NtSetEventBoostPriority  (312, ...
 03312  1736   NtProtectVirtualMemory  (-1, (0x5a0e000), 4096, 260, ...
 03313   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03280  2036   NtWaitForSingleObject  ... ) == 0x0
 03311  1764   NtSetEventBoostPriority  ... ) == 0x0
 03312  1736   NtProtectVirtualMemory  ... (0x5a0e000), 4096, 4, ) == 0x0
 03314  2036   NtSetEventBoostPriority  (312, ...
 03315  1708   NtWaitForSingleObject  (312, 0, 0x0, ...
 03282  1096   NtWaitForSingleObject  ... ) == 0x0
 03314  2036   NtSetEventBoostPriority  ... ) == 0x0
 03316  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03317  1096   NtSetEventBoostPriority  (312, ...
 03318  1764   NtWaitForSingleObject  (164, 0, 0x0, ...
 03284  1776   NtWaitForSingleObject  ... ) == 0x0
 03317  1096   NtSetEventBoostPriority  ... ) == 0x0
 03316  1736   NtCreateThread  ... 952, {1636, 1948}, ) == 0x0
 03319  1776   NtSetEventBoostPriority  (312, ...
 03320  2036   NtWaitForSingleObject  (312, 0, 0x0, ...
 03285  1804   NtWaitForSingleObject  ... ) == 0x0
 03319  1776   NtSetEventBoostPriority  ... ) == 0x0
 03321  1736   NtQueryInformationThread  (952, Basic, 28, ...
 03322  1804   NtSetEventBoostPriority  (312, ...
 03323  1096   NtQueryValueKey  (876,  (876, "Domain", Partial, 144, ... , Partial, 144, ...
 03292  1024   NtWaitForSingleObject  ... ) == 0x0
 03322  1804   NtSetEventBoostPriority  ... ) == 0x0
 03321  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1636,Tid=1948,}, 0x0, ) == 0x0
 03324  1024   NtSetEventBoostPriority  (312, ...
 03323  1096   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03325  1804   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03326  1776   NtWaitForSingleObject  (312, 0, 0x0, ...
 03289  1324   NtWaitForSingleObject  ... ) == 0x0
 03324  1024   NtSetEventBoostPriority  ... ) == 0x0
 03327  1096   NtWaitForSingleObject  (312, 0, 0x0, ...
 03328  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75641, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75641, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\3\0\0d\6\0\0\234\7\0\0" ...  ...
 03329  1324   NtSetEventBoostPriority  (312, ...
 03330  1024   NtWaitForSingleObject  (312, 0, 0x0, ...
 03295  1156   NtWaitForSingleObject  ... ) == 0x0
 03328  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75642, 0}  ... {28, 56, reply, 0, 1636, 1736, 75642, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\3\0\0d\6\0\0\234\7\0\0" )  ) == 0x0
 03329  1324   NtSetEventBoostPriority  ... ) == 0x0
 03325  1804   NtDuplicateObject  ... 956, ) == 0x0
 03331  1156   NtSetEventBoostPriority  (312, ...
 03332  1736   NtResumeThread  (952, ...
 03333  1324   NtWaitForSingleObject  (312, 0, 0x0, ...
 03297   252   NtWaitForSingleObject  ... ) == 0x0
 03331  1156   NtSetEventBoostPriority  ... ) == 0x0
 03334  1804   NtWaitForSingleObject  (312, 0, 0x0, ...
 03332  1736   NtResumeThread  ... 1, ) == 0x0
 03335   252   NtSetEventBoostPriority  (312, ...
 03336  1948   NtWaitForSingleObject  (128, 0, 0x0, ...
 03302  1300   NtWaitForSingleObject  ... ) == 0x0
 03335   252   NtSetEventBoostPriority  ... ) == 0x0
 03337  1736   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03338  1300   NtSetEventBoostPriority  (312, ...
 03339   252   NtWaitForSingleObject  (312, 0, 0x0, ...
 03340  1156   NtSetEventBoostPriority  (356, ...
 03301   712   NtWaitForSingleObject  ... ) == 0x0
 03338  1300   NtSetEventBoostPriority  ... ) == 0x0
 03337  1736   NtAllocateVirtualMemory  ... 94437376, 1048576, ) == 0x0
 03341   712   NtSetEventBoostPriority  (312, ...
 02982  1796   NtWaitForSingleObject  ... ) == 0x0
 03340  1156   NtSetEventBoostPriority  ... ) == 0x0
 03342  1300   NtWaitForSingleObject  (312, 0, 0x0, ...
 03305  1388   NtWaitForSingleObject  ... ) == 0x0
 03343  1796   NtWaitForSingleObject  (312, 0, 0x0, ...
 03344  1736   NtAllocateVirtualMemory  (-1, 95477760, 0, 8192, 4096, 4, ...
 03345  1156   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03341   712   NtSetEventBoostPriority  ... ) == 0x0
 03346  1388   NtSetEventBoostPriority  (312, ...
 03344  1736   NtAllocateVirtualMemory  ... 95477760, 8192, ) == 0x0
 03345  1156   NtWaitForSingleObject  ... ) == 0x102
 03347   712   NtWaitForSingleObject  (164, 0, 0x0, ...
 03307   336   NtWaitForSingleObject  ... ) == 0x0
 03346  1388   NtSetEventBoostPriority  ... ) == 0x0
 03348  1736   NtProtectVirtualMemory  (-1, (0x5b0e000), 4096, 260, ...
 03349  1156   NtWaitForSingleObject  (312, 0, 0x0, ...
 03350   336   NtSetEventBoostPriority  (312, ...
 03351  1388   NtWaitForSingleObject  (312, 0, 0x0, ...
 03348  1736   NtProtectVirtualMemory  ... (0x5b0e000), 4096, 4, ) == 0x0
 03310  1528   NtWaitForSingleObject  ... ) == 0x0
 03350   336   NtSetEventBoostPriority  ... ) == 0x0
 03352  1528   NtSetEventBoostPriority  (312, ...
 03353  1736   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03313   428   NtWaitForSingleObject  ... ) == 0x0
 03352  1528   NtSetEventBoostPriority  ... ) == 0x0
 03354   336   NtSetEventBoostPriority  (128, ...
 03355   428   NtSetEventBoostPriority  (312, ...
 03356  1528   NtWaitForSingleObject  (312, 0, 0x0, ...
 03315  1708   NtWaitForSingleObject  ... ) == 0x0
 03355   428   NtSetEventBoostPriority  ... ) == 0x0
 03336  1948   NtWaitForSingleObject  ... ) == 0x0
 03354   336   NtSetEventBoostPriority  ... ) == 0x0
 03353  1736   NtCreateThread  ... 960, {1636, 1800}, ) == 0x0
 03357  1708   NtAllocateVirtualMemory  (-1, 1449984, 0, 4096, 4096, 4, ...
 03358  1948   NtWaitForSingleObject  (312, 0, 0x0, ...
 03359   336   NtTestAlert  (...
 03357  1708   NtAllocateVirtualMemory  ... 1449984, 4096, ) == 0x0
 03360  1736   NtQueryInformationThread  (960, Basic, 28, ...
 03361  1708   NtSetEventBoostPriority  (312, ...
 03359   336   NtTestAlert  ... ) == 0x0
 03360  1736   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1636,Tid=1800,}, 0x0, ) == 0x0
 03362   428   NtWaitForSingleObject  (312, 0, 0x0, ...
 03363   336   NtContinue  (93388080, 1, ...
 03364  1736   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1636, 1736, 75642, 0}  (24, {28, 56, new_msg, 0, 1636, 1736, 75642, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0d\6\0\0\10\7\0\0" ...  ...
 03365   336   NtRegisterThreadTerminatePort  (24, ...
 03364  1736   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1636, 1736, 75643, 0}  ... {28, 56, reply, 0, 1636, 1736, 75643, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0d\6\0\0\10\7\0\0" )  ) == 0x0
 03320  2036   NtWaitForSingleObject  ... ) == 0x0
 03361  1708   NtSetEventBoostPriority  ... ) == 0x0
 03365   336   NtRegisterThreadTerminatePort  ... ) == 0x0
 03366  2036   NtSetEventBoostPriority  (312, ...
 03367  1708   NtWaitForSingleObject  (312, 0, 0x0, ...
 03368   336   NtWaitForSingleObject  (312, 0, 0x0, ...
 03326  1776   NtWaitForSingleObject  ... ) == 0x0
 03366  2036   NtSetEventBoostPriority  ... ) == 0x0
 03369  1776   NtSetEventBoostPriority  (312, ...
 03327  1096   NtWaitForSingleObject  ... ) == 0x0
 03370  1096   NtSetEventBoostPriority  (312, ...
 03333  1324   NtWaitForSingleObject  ... ) == 0x0
 03371  1324   NtSetEventBoostPriority  (312, ...
 03330  1024   NtWaitForSingleObject  ... ) == 0x0
 03372  1024   NtSetEventBoostPriority  (312, ...
 03334  1804   NtWaitForSingleObject  ... ) == 0x0
 03373  1804   NtSetEventBoostPriority  (312, ...
 03339   252   NtWaitForSingleObject  ... ) == 0x0
 03374   252   NtSetEventBoostPriority  (312, ...
 03343  1796   NtWaitForSingleObject  ... ) == 0x0
 03375  1796   NtSetEventBoostPriority  (312, ...
 03342  1300   NtWaitForSingleObject  ... ) == 0x0
 03376  1300   NtSetEventBoostPriority  (312, ...
 03349  1156   NtWaitForSingleObject  ... ) == 0x0
 03377  1156   NtSetEventBoostPriority  (312, ...
 03351  1388   NtWaitForSingleObject  ... ) == 0x0
 03378  1388   NtSetEventBoostPriority  (312, ...
 03356  1528   NtWaitForSingleObject  ... ) == 0x0
 03379  1528   NtSetEventBoostPriority  (312, ...
 03358  1948   NtWaitForSingleObject  ... ) == 0x0
 03380  1948   NtSetEventBoostPriority  (312, ...
 03362   428   NtWaitForSingleObject  ... ) == 0x0
 03381   428   NtSetEventBoostPriority  (312, ...
 03367  1708   NtWaitForSingleObject  ... ) == 0x0
 03382  1708   NtSetEventBoostPriority  (312, ...
 03368   336   NtWaitForSingleObject  ... ) == 0x0
 03383   336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 964, ) == 0x0
 03382  1708   NtSetEventBoostPriority  ... ) == 0x0
 03381   428   NtSetEventBoostPriority  ... ) == 0x0
 03380  1948   NtSetEventBoostPriority  ... ) == 0x0
 03375  1796   NtSetEventBoostPriority  ... ) == 0x0
 03373  1804   NtSetEventBoostPriority  ... ) == 0x0
 03371  1324   NtSetEventBoostPriority  ... ) == 0x0
 03370  1096   NtSetEventBoostPriority  ... ) == 0x0
 03369  1776   NtSetEventBoostPriority  ... ) == 0x0
 03384  2036   NtAllocateVirtualMemory  (-1, 28364800, 0, 4096, 4096, 260, ...
 03379  1528   NtSetEventBoostPriority  ... ) == 0x0
 03378  1388   NtSetEventBoostPriority  ... ) == 0x0
 03377  1156   NtSetEventBoostPriority  ... ) == 0x0
 03376  1300   NtSetEventBoostPriority  ... ) == 0x0
 03374   252   NtSetEventBoostPriority  ... ) == 0x0
 03372  1024   NtSetEventBoostPriority  ... ) == 0x0
 03385  1736   NtResumeThread  (960, ...
 03386   336   NtWaitForSingleObject  (356, 0, 0x0, ...
 03387   428   NtWaitForSingleObject  (356, 0, 0x0, ...
 03388  1708   NtAllocateVirtualMemory  (-1, 29413376, 0, 4096, 4096, 260, ...
 03389  1948   NtTestAlert  (...
 03390  1796   NtSetEventBoostPriority  (356, ...
 03391  1804   NtWaitForSingleObject  (356, 0, 0x0, ...
 03392  1324   NtWaitForSingleObject  (356, 0, 0x0, ...
 03393  1776   NtAllocateVirtualMemory  (-1, 30461952, 0, 4096, 4096, 260, ...
 03394  1096   NtClose  (876, ...
 03395  1528   NtWaitForSingleObject  (356, 0, 0x0, ...
 03396  1388   NtSetEventBoostPriority  (164, ...
 03397  1156   NtWaitForSingleObject  (164, 0, 0x0, ...
 03398  1300   NtWaitForSingleObject  (356, 0, 0x0, ...