Summary:


NtCallbackReturn(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtRequestWaitReplyPort(>) 
 5 

NtCreateFile(>) 
 1 
NtResumeThread(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtCreateEvent(>) 
 6 

NtCreateThread(>) 
 1 
NtSecureConnectPort(>) 
 1 
NtQuerySection(>) 
 2 
NtProtectVirtualMemory(>) 
 7 

NtGdiCreateBitmap(>) 
 1 
NtTestAlert(>) 
 1 
NtQueryVirtualMemory(>) 
 2 
NtQuerySystemInformation(>) 
 9 

NtGdiInit(>) 
 1 
NtUnmapViewOfSection(>) 
 1 
NtSetInformationFile(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserCallNoParam(>) 
 1 
NtSetInformationObject(>) 
 2 
NtOpenSection(>) 
 12 

NtGdiSelectBitmap(>) 
 1 
NtUserGetThreadDesktop(>) 
 1 
NtTerminateProcess(>) 
 2 
NtQueryValueKey(>) 
 12 

NtOpenDirectoryObject(>) 
 1 
NtWriteFile(>) 
 1 
NtCreateSection(>) 
 3 
NtMapViewOfSection(>) 
 13 

NtOpenKeyedEvent(>) 
 1 
NtContinue(>) 
 2 
NtDuplicateObject(>) 
 3 
NtOpenProcess(>) 
 15 

NtOpenMutant(>) 
 1 
NtCreateIoCompletion(>) 
 2 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserRegisterClassExWOW(>) 
 15 

NtOpenSymbolicLinkObject(>) 
 1 
NtFlushInstructionCache(>) 
 2 
NtOpenProcessToken(>) 
 3 
NtAllocateVirtualMemory(>) 
 18 

NtQueryObject(>) 
 1 
NtFreeVirtualMemory(>) 
 2 
NtSetInformationThread(>) 
 3 
NtOpenKey(>) 
 21 

NtQuerySymbolicLinkObject(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFsControlFile(>) 
 4 
NtQueryInformationProcess(>) 
 29 

NtQuerySystemTime(>) 
 1 
NtOpenFile(>) 
 2 
NtQueryAttributesFile(>) 
 4 
NtClose(>) 
 48 

NtQueryVolumeInformationFile(>) 
 1 
NtOpenProcessTokenEx(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtReadVirtualMemory(>) 
 689 

NtReadFile(>) 
 1 
NtOpenThreadToken(>) 
 2 
NtQueryInformationToken(>) 
 5 

Trace:
 00001   412   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   412   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   412   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   412   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   412   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   412   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   412   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   412   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   412   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   412   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   412   NtClose  (12, ... ) == 0x0
 00014   412   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   412   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   412   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   412   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   412   NtClose  (16, ... ) == 0x0
 00021   412   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   412   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   412   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   412   NtClose  (16, ... ) == 0x0
 00026   412   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   412   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   412   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   412   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 404, 412, 1501, 0} "`\177\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 404, 412, 1501, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 404, 412, 1501, 0} "`\177\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   412   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   412   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   412   NtClose  (16, ... ) == 0x0
 00036   412   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   412   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   412   NtClose  (28, ... ) == 0x0
 00041   412   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   412   NtClose  (28, ... ) == 0x0
 00045   412   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   412   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   412   NtClose  (28, ... ) == 0x0
 00049   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   412   NtClose  (28, ... ) == 0x0
 00052   412   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   412   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 404, 412, 1504, 0} "\10\240\30\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 404, 412, 1504, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 404, 412, 1504, 0} "\10\240\30\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   412   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 8, ) == 0x0
 00057   412   NtProtectVirtualMemory  (-1, (0x408000), 4096, 8, ... (0x408000), 4096, 4, ) == 0x0
 00058   412   NtFlushInstructionCache  (-1, 4227072, 4096, ... ) == 0x0
 00059   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00061   412   NtClose  (28, ... ) == 0x0
 00062   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   412   NtClose  (28, ... ) == 0x0
 00065   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00067   412   NtClose  (28, ... ) == 0x0
 00068   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   412   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00070   412   NtClose  (28, ... ) == 0x0
 00071   412   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 4, ) == 0x0
 00072   412   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 4, ) == 0x0
 00073   412   NtFlushInstructionCache  (-1, 4227072, 4096, ... ) == 0x0
 00074   412   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00075   412   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00076   412   NtClose  (28, ... ) == 0x0
 00077   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00078   412   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00079   412   NtClose  (28, ... ) == 0x0
 00080   412   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00081   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00082   412   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00083   412   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00084   412   NtClose  (28, ... ) == 0x0
 00085   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00086   412   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087   412   NtClose  (28, ... ) == 0x0
 00088   412   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00089   412   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00090   412   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00092   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 404, 412, 1507, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 404, 412, 1507, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 404, 412, 1507, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00093   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094   412   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00095   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00096   412   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00097   412   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482032, ) == 0x0
 00098   412   NtQueryInformationToken  (-2147482032, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00099   412   NtQueryInformationToken  (-2147482032, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00100   412   NtClose  (-2147482032, ... ) == 0x0
 00101   412   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00102   412   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00103   412   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00104   412   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00105   412   NtQueryValueKey  (-2147482032,  (-2147482032, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00106   412   NtClose  (-2147482032, ... ) == 0x0
 00107   412   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00108   412   NtQueryValueKey  (-2147482032,  (-2147482032, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00109   412   NtClose  (-2147482032, ... ) == 0x0
 00110   412   NtQueryDefaultLocale  (0, -131102196, ... ) == 0x0
 00111   412   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00112   412   NtUserCallNoParam  (24, ... ) == 0x0
 00113   412   NtGdiCreateCompatibleDC  (0, ...
 00114   412   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00113   412   NtGdiCreateCompatibleDC  ... ) == 0x12010328
 00115   412   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00116   412   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00117   412   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x13050402
 00118   412   NtGdiCreateSolidBrush  (0, 0, ...
 00119   412   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8519680, 4096, ) == 0x0
 00118   412   NtGdiCreateSolidBrush  ... ) == 0xe100408
 00120   412   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00121   412   NtGdiCreateCompatibleDC  (0, ... ) == 0x39010412
 00122   412   NtGdiSelectBitmap  (956367890, 319095810, ... ) == 0x185000f
 00123   412   NtUserGetThreadDesktop  (412, 0, ... ) == 0x2c
 00124   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00125   412   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00126   412   NtClose  (52, ... ) == 0x0
 00127   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00128   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017
 00129   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00130   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c
 00131   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00132   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e
 00133   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00134   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002
 00135   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00136   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018
 00137   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00138   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a
 00139   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00140   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d
 00141   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00143   412   NtAllocateVirtualMemory  (-1, 5468160, 0, 4096, 4096, 32, ... 5468160, 4096, ) == 0x0
 00142   412   NtUserRegisterClassExWOW  ... ) == 0x810dc026
 00144   412   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00145   412   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019
 00146   412   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020
 00147   412   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022
 00148   412   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023
 00149   412   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024
 00150   412   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc025
 00151   412   NtCallbackReturn  (0, 0, 0, ...
 00152   412   NtGdiInit  (... ) == 0x1
 00153   412   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00154   412   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00155   412   NtTestAlert  (... ) == 0x0
 00156   412   NtContinue  (1244464, 1, ...
 00157   412   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x407250,}, 4, ... ) == 0x0
 00158   412   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00159   412   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00160   412   NtClose  (52, ... ) == 0x0
 00161   412   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0
 00162   412   NtProtectVirtualMemory  (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0
 00163   412   NtOpenProcessToken  (-1, 0x20, ... 52, ) == 0x0
 00164   412   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00165   412   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00166   412   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 56, ) }, ... 56, ) == 0x0
 00167   412   NtQueryValueKey  (56,  (56, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00168   412   NtClose  (56, ... ) == 0x0
 00169   412   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00170   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 56, ) == 0x0
 00171   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00172   412   NtQuerySystemTime  (... {-271477526, 29873130}, ) == 0x0
 00173   412   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00174   412   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00175   412   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00176   412   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00177   412   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00178   412   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00179   412   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00180   412   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00181   412   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 76, ) }, ... 76, ) == 0x0
 00182   412   NtOpenKey  (0x20019, {24, 76, 0x40, 0, 0,  (0x20019, {24, 76, 0x40, 0, 0, "ActiveComputerName"}, ... 80, ) }, ... 80, ) == 0x0
 00183   412   NtQueryValueKey  (80,  (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00184   412   NtClose  (80, ... ) == 0x0
 00185   412   NtClose  (76, ... ) == 0x0
 00186   412   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 76, ) == 0x0
 00187   412   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 80, ) == 0x0
 00188   412   NtDuplicateObject  (-1, 76, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00189   412   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00190   412   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 88, ) == 0x0
 00191   412   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00192   412   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00193   412   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00194   412   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242964,  (0xc0100080, {24, 0, 0x40, 0, 1242964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 92, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 92, {status=0x0, info=1}, ) == 0x0
 00195   412   NtSetInformationFile  (92, 1243020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00196   412   NtSetInformationFile  (92, 1243012, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00197   412   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00198   412   NtWriteFile  (92, 69, 0, 0,  (92, 69, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00199   412   NtReadFile  (92, 69, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (92, 69, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20y!\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00200   412   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20y!\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20y!\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00201   412   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0Q\337\5)\336?\334\21\261\310\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0Q\337\5)\336?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 88, 1024, ... {status=0x103, info=48},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0Q\337\5)\336?\334\21\261\310\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0Q\337\5)\336?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 00202   412   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0Q\337\5)\336?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , 44, 1024, ... {status=0x103, info=36},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0Q\337\5)\336?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , ) == 0x103
 00203   412   NtClose  (88, ... ) == 0x0
 00204   412   NtClose  (92, ... ) == 0x0
 00205   412   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "psapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00206   412   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00207   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\psapi.dll"}, 1237820, ... ) }, 1237820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00208   412   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "psapi.dll"}, 1237820, ... ) }, 1237820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00209   412   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 1237820, ... ) }, 1237820, ... ) == 0x0
 00210   412   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00211   412   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00212   412   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00213   412   NtOpenProcessToken  (-1, 0x8, ... 96, ) == 0x0
 00214   412   NtQueryInformationToken  (96, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00215   412   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00216   412   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 100, ) }, ... 100, ) == 0x0
 00217   412   NtQueryValueKey  (100,  (100, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (100, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00218   412   NtClose  (100, ... ) == 0x0
 00219   412   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00220   412   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00221   412   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00222   412   NtClose  (100, ... ) == 0x0
 00223   412   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224   412   NtClose  (96, ... ) == 0x0
 00225   412   NtClose  (92, ... ) == 0x0
 00226   412   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bf0000), 0x0, 45056, ) == 0x0
 00227   412   NtClose  (88, ... ) == 0x0
 00228   412   NtAllocateVirtualMemory  (-1, 1335296, 0, 36864, 4096, 4, ... 1335296, 36864, ) == 0x0
 00229   412   NtQuerySystemInformation  (ProcessesAndThreads, 32768, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00230   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {4, 0}, ... 88, ) == 0x0
 00231   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x0,AffinityMask=0x1,BasePriority=8,Pid=4,ParentPid=0,}, 0x0, ) == 0x0
 00232   412   NtReadVirtualMemory  (88, 0xc, 4, ...
 00233   412   NtContinue  (-131105636, 0, ...
 00232   412   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00234   412   NtClose  (88, ... ) == 0x0
 00235   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {356, 0}, ... 88, ) == 0x0
 00236   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00237   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00238   412   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00239   412   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00240   412   NtReadVirtualMemory  (88, 0x261f18, 76, ...  (88, 0x261f18, 76, ... "\234\36&\0\300\36&\0\244\36&\0\310\36&\0\254\36&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00241   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00242   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00243   412   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00244   412   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00245   412   NtReadVirtualMemory  (88, 0x1106a0, 60, ...  (88, 0x1106a0, 60, ... "\\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0m\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00246   412   NtClose  (88, ... ) == 0x0
 00247   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {584, 0}, ... 88, ) == 0x0
 00248   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=584,ParentPid=356,}, 0x0, ) == 0x0
 00249   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00250   412   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00251   412   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00252   412   NtReadVirtualMemory  (88, 0x261f18, 76, ...  (88, 0x261f18, 76, ... "\270\37&\0\300\36&\0\300\37&\0\310\36&\0\310\37&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\4\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00253   412   NtReadVirtualMemory  (88, 0x261fb8, 76, ...  (88, 0x261fb8, 76, ... "X &\0\30\37&\0` &\0 \37&\0h &\0(\37&\0\0\0\264u\0\0\0\0\0\240\0\0<\0>\0p\37&\0\24\0\26\0\230\37&\0\6@\0\0\377\377\0\0pZ\374w\374\36&\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00254   412   NtReadVirtualMemory  (88, 0x262058, 76, ...  (88, 0x262058, 76, ... "\370 &\0\270\37&\0\0!&\0\300\37&\0P"&\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) &\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) == 0x0
 00255   412   NtReadVirtualMemory  (88, 0x2620f8, 76, ...  (88, 0x2620f8, 76, ... "\230!&\0X &\0\240!&\0` &\0\320$&\0\250!&\0\0\0\266u\0\0\0\0\0`\4\0<\0>\0\260 &\0\24\0\26\0\330 &\0\4@\0\0\2\0\0\0\20[\374w\20[\374w\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00256   412   NtReadVirtualMemory  (88, 0x262198, 76, ...  (88, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\370 &\0H (88, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00257   412   NtReadVirtualMemory  (88, 0x262240, 76, ...  (88, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\230!&\0\350 (88, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00258   412   NtReadVirtualMemory  (88, 0x2622e0, 76, ...  (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\220#&\0H (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\22\0\24\0\300 (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00259   412   NtReadVirtualMemory  (88, 0x262388, 76, ...  (88, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\00$&\0\350 (88, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00260   412   NtReadVirtualMemory  (88, 0x262428, 76, ...  (88, 0x262428, 76, ... "\300$&\0\210#&\0\310$&\0\220#&\0\230#&\0P"&\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00261   412   NtReadVirtualMemory  (88, 0x2624c0, 76, ...  (88, 0x2624c0, 76, ... "\234\36&\0($&\0\244\36&\00$&\0\254\36&\0\10!&\0\0\0\351u\212\23\351u\0\20\12\06\08\0\200$&\0\16\0\20\0\250$&\0\4@\10\0\1\0\0\0\360Z\374w\360Z\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00262   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=584,ParentPid=356,}, 0x0, ) == 0x0
 00263   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00264   412   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00265   412   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00266   412   NtReadVirtualMemory  (88, 0x110534, 68, ...  (88, 0x110534, 68, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0s\0r\0s\0s\0.\0e\0x\0e\0\0\0", 68, ) , 68, ) == 0x0
 00267   412   NtClose  (88, ... ) == 0x0
 00268   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {608, 0}, ... 88, ) == 0x0
 00269   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=608,ParentPid=356,}, 0x0, ) == 0x0
 00270   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00271   412   NtReadVirtualMemory  (88, 0x171ea4, 4, ...  (88, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00272   412   NtReadVirtualMemory  (88, 0x171ec0, 76, ...  (88, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00273   412   NtReadVirtualMemory  (88, 0x171f18, 76, ...  (88, 0x171f18, 76, ... "\300\37\27\0\300\36\27\0\310\37\27\0\310\36\27\0\320\37\27\0\254\36\27\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\244%\27\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00274   412   NtReadVirtualMemory  (88, 0x171fc0, 76, ...  (88, 0x171fc0, 76, ... "h \27\0\30\37\27\0p \27\0 \37\27\0\30!\27\0(\37\27\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\27\0\30\0\32\0\230\37\27\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00275   412   NtReadVirtualMemory  (88, 0x172068, 76, ...  (88, 0x172068, 76, ... "\10!\27\0\300\37\27\0\20!\27\0\310\37\27\0X"\27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) \27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00276   412   NtReadVirtualMemory  (88, 0x172108, 76, ...  (88, 0x172108, 76, ... "\250!\27\0h \27\0\260!\27\0p \27\0x \27\0\320\37\27\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \27\0\24\0\26\0\350 \27\0\6@\10\0\377\377\0\0\314(\27\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00277   412   NtReadVirtualMemory  (88, 0x1721a8, 76, ...  (88, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\10!\27\0P (88, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) == 0x0
 00278   412   NtReadVirtualMemory  (88, 0x172248, 76, ...  (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\250!\27\0\360 (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\24\0\26\0( (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00279   412   NtReadVirtualMemory  (88, 0x1722e8, 76, ...  (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\220#\27\0P (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\26\0\30\0\310 (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00280   412   NtReadVirtualMemory  (88, 0x172388, 76, ...  (88, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) \27\00$\27\0\360 (88, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00281   412   NtReadVirtualMemory  (88, 0x172428, 76, ...  (88, 0x172428, 76, ... "\310$\27\0\210#\27\0\320$\27\0\220#\27\0\230#\27\0\270!\27\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\27\0\22\0\24\0\10$\27\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00282   412   NtReadVirtualMemory  (88, 0x1724c8, 76, ...  (88, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) \27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204 (88, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00283   412   NtReadVirtualMemory  (88, 0x172568, 76, ...  (88, 0x172568, 76, ... "\10&\27\0\310$\27\0\20&\27\0\320$\27\0\300&\27\0\370"\27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) \27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) == 0x0
 00284   412   NtReadVirtualMemory  (88, 0x172608, 76, ...  (88, 0x172608, 76, ... "\260&\27\0h%\27\0\270&\27\0p%\27\0\0(\27\0`'\27\0\0\0\223u \22\223u\0\240\0\0>\0@\0\300%\27\0\26\0\30\0\350%\27\0\6@\10\0\377\377\0\0,(\27\0\330Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00285   412   NtReadVirtualMemory  (88, 0x1726b0, 76, ...  (88, 0x1726b0, 76, ... "P'\27\0\10&\27\0X'\27\0\20&\27\0`'\27\0x%\27\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0`&\27\0\30\0\32\0\210&\27\0\6@\14\0\377\377\0\0\344>\27\0\244%\27\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00286   412   NtReadVirtualMemory  (88, 0x172750, 76, ...  (88, 0x172750, 76, ... "\360'\27\0\260&\27\0\370'\27\0\270&\27\0\30&\27\0\300&\27\0\0\0\247uM\31\247u\00\12\0>\0@\0\10'\27\0\26\0\30\00'\27\0\6@\14\0\377\377\0\0\3747\27\0\304#\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00287   412   NtReadVirtualMemory  (88, 0x1727f0, 76, ...  (88, 0x1727f0, 76, ... "\220(\27\0P'\27\0\230(\27\0X'\27\0\240(\27\0\30&\27\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\250'\27\0\22\0\24\0\320'\27\0\6@\14\0\377\377\0\0\330Z\374wD&\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00288   412   NtReadVirtualMemory  (88, 0x172890, 76, ...  (88, 0x172890, 76, ... "0)\27\0\360'\27\08)\27\0\370'\27\0@)\27\0\0(\27\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0H(\27\0\24\0\26\0p(\27\0\6@\10\0\377\377\0\0\274;\27\0D!\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00289   412   NtReadVirtualMemory  (88, 0x172930, 76, ...  (88, 0x172930, 76, ... "\330)\27\0\220(\27\0\340)\27\0\230(\27\0\350)\27\0\240(\27\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\350(\27\0\26\0\30\0\20)\27\0\6@\14\0\377\377\0\0\24*\27\0\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00290   412   NtReadVirtualMemory  (88, 0x1729d8, 76, ...  (88, 0x1729d8, 76, ... "x*\27\00)\27\0\200*\27\08)\27\0\320+\27\0@)\27\0\0\0gv8\25gv\0@\16\0@\0B\0\210)\27\0\30\0\32\0\260)\27\0\6@\10\0\377\377\0\0\264*\27\0l)\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00291   412   NtReadVirtualMemory  (88, 0x172a78, 76, ...  (88, 0x172a78, 76, ... " +\27\0\330)\27\0(+\27\0\340)\27\0\30-\27\00+\27\0\0\0\306v\355\346\306v\0\220\2\0<\0>\00*\27\0\24\0\26\0X*\27\0\6@\14\0\377\377\0\0d0\27\0\24*\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00292   412   NtReadVirtualMemory  (88, 0x172b20, 76, ...  (88, 0x172b20, 76, ... "\300+\27\0x*\27\0\310+\27\0\200*\27\0\210*\27\0x,\27\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320*\27\0\30\0\32\0\370*\27\0\6@\14\0\377\377\0\0\344-\27\0\374\36\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00293   412   NtReadVirtualMemory  (88, 0x172bc0, 76, ...  (88, 0x172bc0, 76, ... "h,\27\0 +\27\0p,\27\0(+\27\0x,\27\0\350)\27\0\0\0\33wp\10\34w\0\240\21\0:\0<\0x+\27\0\22\0\24\0\240+\27\0\6@\10\0\377\377\0\0L2\27\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00294   412   NtReadVirtualMemory  (88, 0x172c68, 76, ...  (88, 0x172c68, 76, ... "\10-\27\0\300+\27\0\20-\27\0\310+\27\00+\27\0\320+\27\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\30,\27\0\30\0\32\0@,\27\0\6@\14\0\377\377\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00295   412   NtReadVirtualMemory  (88, 0x172d08, 76, ...  (88, 0x172d08, 76, ... "\250-\27\0h,\27\0\260-\27\0p,\27\0\270-\27\0\210*\27\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\300,\27\0\26\0\30\0\350,\27\0\6@\10\0\377\377\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00296   412   NtReadVirtualMemory  (88, 0x172da8, 76, ...  (88, 0x172da8, 76, ... "H.\27\0\10-\27\0P.\27\0\20-\27\0\370.\27\0\30-\27\0\0\06v\240\206v\0\360\0\0<\0>\0`-\27\0\24\0\26\0\210-\27\0\6@\10\0\377\377\0\0\204.\27\0\+\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00297   412   NtReadVirtualMemory  (88, 0x172e48, 76, ...  (88, 0x172e48, 76, ... "\350.\27\0\250-\27\0\360.\27\0\260-\27\0\3300\27\0\370.\27\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\0.\27\0\24\0\26\0(.\27\0\6@\10\0\377\377\0\0$/\27\0\344-\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00298   412   NtReadVirtualMemory  (88, 0x172ee8, 76, ...  (88, 0x172ee8, 76, ... "\210/\27\0H.\27\0\220/\27\0P.\27\0X.\27\0\270-\27\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\240.\27\0\26\0\30\0\310.\27\0\6@\14\0\377\377\0\0\2546\27\0\204.\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00299   412   NtReadVirtualMemory  (88, 0x172f88, 76, ...  (88, 0x172f88, 76, ... "(0\27\0\350.\27\000\27\0\360.\27\0\04\27\0 2\27\0\0\0\227u\31\32\227u\0\20\17\0<\0>\0@/\27\0\24\0\26\0h/\27\0\4@\14\0\2\0\0\0\34;\27\0\4%\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00300   412   NtReadVirtualMemory  (88, 0x173028, 76, ...  (88, 0x173028, 76, ... "\3100\27\0\210/\27\0\3200\27\0\220/\27\0\2001\27\0\3300\27\0\0\0=w\24 ?w\0@\177\0>\0@\0\340/\27\0\26\0\30\0\100\27\0\6@\10\0\21\0\0\0\41\27\0\264*\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00301   412   NtReadVirtualMemory  (88, 0x1730c8, 76, ...  (88, 0x1730c8, 76, ... "p1\27\0(0\27\0x1\27\000\27\080\27\0X.\27\0\0\0-w\306@-w\00\6\0>\0@\0\2000\27\0\26\0\30\0\2500\27\0\6@\14\0\35\0\0\0l5\27\0d0\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00302   412   NtReadVirtualMemory  (88, 0x173170, 76, ...  (88, 0x173170, 76, ... "\202\27\0\3100\27\0\302\27\0\3200\27\0\3102\27\080\27\0\0\04wY\324w\0\260\10\0@\0B\0 1\27\0\30\0\32\0H1\27\0\6@\14\0\10\0\0\0\3642\27\0$#\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00303   412   NtReadVirtualMemory  (88, 0x173210, 76, ...  (88, 0x173210, 76, ... "\2702\27\0p1\27\0\3002\27\0x1\27\0\230/\27\0\3102\27\0\0\0{\37\200F{\37\0\20\3\0<\0>\0\3101\27\0\24\0\26\0\3601\27\0\6@\14\0\2\0\0\0\3144\27\0\374+\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00304   412   NtReadVirtualMemory  (88, 0x1732b8, 76, ...  (88, 0x1732b8, 76, ... "\3603\27\0\202\27\0\3703\27\0\302\27\0 2\27\0\2001\27\0\0\0;v\0\26;v\0P\4\0@\0B\0h2\27\0\30\0\32\0\2202\27\0\6@\14\0\3\0\0\0,4\27\0\2541\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00305   412   NtReadVirtualMemory  (88, 0x1733f0, 76, ...  (88, 0x1733f0, 76, ... "\2204\27\0\2702\27\0\2304\27\0\3002\27\0\2404\27\0\230/\27\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\203\27\0\30\0\32\0\3163\27\0\4@\14\20\3\0\0\0\2049\27\0\3642\27\02\376};\370\254\7\0", 76, ) , 76, ) == 0x0
 00306   412   NtReadVirtualMemory  (88, 0x173490, 76, ...  (88, 0x173490, 76, ... "05\27\0\3603\27\085\27\0\3703\27\0@5\27\0\04\27\0\0\0\205\37\0\0\0\0\0`\1\0>\0@\0H4\27\0\26\0\30\0p4\27\0\4@\0\0\1\0\0\0\374F\27\0L2\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00307   412   NtReadVirtualMemory  (88, 0x173530, 76, ...  (88, 0x173530, 76, ... "\3105\27\0\2204\27\0\3205\27\0\2304\27\0\3305\27\0\2404\27\0\0\0\275vG"\276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) == 0x0
 00308   412   NtReadVirtualMemory  (88, 0x1735c8, 76, ...  (88, 0x1735c8, 76, ... "p6\27\005\27\0x6\27\085\27\0(7\27\0@5\27\0\0\0\273v\0\0\0\0\0@\0\06\08\0\2105\27\0\16\0\20\0\2605\27\0\4@\0\0\2\0\0\0\374<\27\0l5\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00309   412   NtReadVirtualMemory  (88, 0x173670, 76, ...  (88, 0x173670, 76, ... "\307\27\0\3105\27\0 7\27\0\3205\27\0\3207\27\0(7\27\0\0\0=r\240\22=r\0\240\1\0@\0B\0 6\27\0\30\0\32\0H6\27\0\4@\10\0\7\0\0\0T7\27\0$/\27\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00310   412   NtReadVirtualMemory  (88, 0x173718, 76, ...  (88, 0x173718, 76, ... "\3007\27\0p6\27\0\3107\27\0x6\27\0\2006\27\0\3305\27\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\3106\27\0\30\0\32\0\3606\27\0\6@\0\0\7\0\0\0\3448\27\0\2546\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00311   412   NtReadVirtualMemory  (88, 0x1737c0, 76, ...  (88, 0x1737c0, 76, ... "\2508\27\0\307\27\0\2608\27\0 7\27\0\2708\27\0\2006\27\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\308\27\0\26\0\30\0@8\27\0\4@\10\0\5\0\0\0\0[\374w\214'\27\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00312   412   NtReadVirtualMemory  (88, 0x1738a8, 76, ...  (88, 0x1738a8, 76, ... "H9\27\0\3007\27\0P9\27\0\3107\27\0X9\27\0\3207\27\0\0\0\264vA\34\264v\0\300\2\0:\0<\0`8\27\0\22\0\24\0\2108\27\0\4@\14\0\7\0\0\0\3349\27\0T7\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00313   412   NtReadVirtualMemory  (88, 0x173948, 76, ...  (88, 0x173948, 76, ... "\2409\27\0\2508\27\0\2509\27\0\2608\27\0X:\27\0\2708\27\0\0\0`v\20\22`v\0\260\1\0<\0>\0\09\27\0\24\0\26\0(9\27\0\4@\10\0\3\0\0\0\234=\27\0,4\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00314   412   NtReadVirtualMemory  (88, 0x1739a0, 76, ...  (88, 0x1739a0, 76, ... "H:\27\0H9\27\0P:\27\0P9\27\0\220;\27\0\360:\27\0\0\0\225um\25\225u\0\220\1\0@\0B\0p7\27\0\30\0\32\0\2307\27\0\4@\14\0\6\0\0\0\204:\27\0\3448\27\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00315   412   NtReadVirtualMemory  (88, 0x173a48, 76, ...  (88, 0x173a48, 76, ... "\340:\27\0\2409\27\0\350:\27\0\2509\27\0\360:\27\0X9\27\0\0\0\0s\372\26\0s\00\2\0@\0B\0\3709\27\0\30\0\32\0 :\27\0\6@\14\0\6\0\0\0\34E\27\0\3349\27\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00316   412   NtReadVirtualMemory  (88, 0x173ae0, 76, ...  (88, 0x173ae0, 76, ... "\200;\27\0H:\27\0\210;\27\0P:\27\0\2609\27\0X:\27\0\0\0\262q\234\21\262q\0\20\1\06\08\0\240:\27\0\16\0\20\0\310:\27\0\6@\14\0\12\0\0\0\<\27\0\304/\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00317   412   NtReadVirtualMemory  (88, 0x173b80, 76, ...  (88, 0x173b80, 76, ... " <\27\0\340:\27\0(<\27\0\350:\27\00<\27\0\2609\27\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\08;\27\0\24\0\26\0`;\27\0\4@\14\0\1\0\0\0\350Z\374w\314(\27\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00318   412   NtReadVirtualMemory  (88, 0x173c20, 76, ...  (88, 0x173c20, 76, ... "\300<\27\0\200;\27\0\310<\27\0\210;\27\0\320<\27\0\220;\27\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0\330;\27\0\24\0\26\0\0<\27\0\4@\0\0\1\0\0\0\244B\27\0\34;\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00319   412   NtReadVirtualMemory  (88, 0x173cc0, 76, ...  (88, 0x173cc0, 76, ... "`=\27\0 <\27\0h=\27\0(<\27\0p=\27\00<\27\0\0\0\277qp\21\277q\0\20\1\0<\0>\0x<\27\0\24\0\26\0\240<\27\0\4@\10\0\5\0\0\0|D\27\0\46\27\01\376};0c\10\0", 76, ) , 76, ) == 0x0
 00320   412   NtReadVirtualMemory  (88, 0x173d60, 76, ...  (88, 0x173d60, 76, ... "\10>\27\0\300<\27\0\20>\27\0\310<\27\0\30>\27\0\320<\27\0\0\0bv\316\26bv\0\340\4\0:\0<\0\30=\27\0\22\0\24\0@=\27\0\4@\14\0\1\0\0\0TF\27\0\2049\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00321   412   NtReadVirtualMemory  (88, 0x173e08, 76, ...  (88, 0x173e08, 76, ... "\250>\27\0`=\27\0\260>\27\0h=\27\0X?\27\0p=\27\0\0\0\366ux\20\366u\0`\0\0<\0>\0`>\27\0\24\0\26\0\210>\27\0\4@\14\0\1\0\0\0dA\27\0xZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00322   412   NtReadVirtualMemory  (88, 0x173ea8, 76, ...  (88, 0x173ea8, 76, ... "H?\27\0\10>\27\0P?\27\0\20>\27\08A\27\0\370?\27\0\0\0\301q\12\23\301q\0\320\0\0@\0B\0\270=\27\0\30\0\32\0\340=\27\0\4@\14\0\1\0\0\0\204?\27\0\354&\27\04\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00323   412   NtReadVirtualMemory  (88, 0x173f48, 76, ...  (88, 0x173f48, 76, ... "\350?\27\0\250>\27\0\360?\27\0\260>\27\0\230@\27\0\30>\27\0\0\0\315q\6\22\315q\0`\1\0<\0>\0\0?\27\0\24\0\26\0(?\27\0\6@\14\0\5\0\0\0$@\27\0\344>\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00324   412   NtReadVirtualMemory  (88, 0x173fe8, 76, ...  (88, 0x173fe8, 76, ... "\210@\27\0H?\27\0\220@\27\0P?\27\0\270>\27\0\230@\27\0\0\0\311qP\26\311q\0\300\3\0<\0>\0\240?\27\0\24\0\26\0\310?\27\0\6@\14\0\2\0\0\0\304@\27\0\204?\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00325   412   NtReadVirtualMemory  (88, 0x174088, 76, ...  (88, 0x174088, 76, ... "(A\27\0\350?\27\00A\27\0\360?\27\0\370?\27\0X?\27\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0@@\27\0\24\0\26\0h@\27\0\6@\0\0\2\0\0\0DC\27\0$@\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00326   412   NtReadVirtualMemory  (88, 0x174128, 76, ...  (88, 0x174128, 76, ... "\310A\27\0\210@\27\0\320A\27\0\220@\27\0\330A\27\0\270>\27\0\0\0\367uB\21\367u\0\220\0\0>\0@\0\340@\27\0\26\0\30\0\10A\27\0\4@\14\0\1\0\0\0xZ\374wD>\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00327   412   NtReadVirtualMemory  (88, 0x1741c8, 76, ...  (88, 0x1741c8, 76, ... "hB\27\0(A\27\0pB\27\00A\27\0\30C\27\08A\27\0\0\0\0\20\340t\0\20\0\0\2\0:\0<\0\200A\27\0\22\0\24\0\250A\27\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374w\340Z\332D\0\0\0\0", 76, ) , 76, ) == 0x0
 00328   412   NtReadVirtualMemory  (88, 0x174268, 76, ...  (88, 0x174268, 76, ... "\10C\27\0\310A\27\0\20C\27\0\320A\27\0\270C\27\0\30C\27\0\0\0\260q>\23\260q\0\360\0\0:\0<\0 B\27\0\22\0\24\0HB\27\0\4@\14\0\1\0\0\0\300Z\374w\<\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00329   412   NtReadVirtualMemory  (88, 0x174308, 76, ...  (88, 0x174308, 76, ... "\250C\27\0hB\27\0\260C\27\0pB\27\0xB\27\0\330A\27\0\0\0\272qp\27\272q\0\340\4\0<\0>\0\300B\27\0\24\0\26\0\350B\27\0\6@\14\0\1\0\0\0\344C\27\0\304@\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00330   412   NtReadVirtualMemory  (88, 0x1743a8, 76, ...  (88, 0x1743a8, 76, ... "@D\27\0\10C\27\0HD\27\0\20C\27\0PD\27\0xB\27\0\0\0\264q\0\0\0\0\0\300\2\0<\0>\0`C\27\0\24\0\26\0\210C\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 00331   412   NtReadVirtualMemory  (88, 0x174440, 76, ...  (88, 0x174440, 76, ... "\340D\27\0\250C\27\0\350D\27\0\260C\27\0\360D\27\0\270C\27\0\0\0\351u\212\23\351u\0\20\12\06\08\0\0D\27\0\16\0\20\0(D\27\0\4@\10\0\1\0\0\0\360Z\374w\374<\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00332   412   NtReadVirtualMemory  (88, 0x1744e0, 76, ...  (88, 0x1744e0, 76, ... "\30F\27\0@D\27\0 F\27\0HD\27\0(F\27\0PD\27\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\230D\27\0\26\0\30\0\300D\27\0\4@\10\0\2\0\0\0\20[\374w\204:\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00333   412   NtReadVirtualMemory  (88, 0x174618, 76, ...  (88, 0x174618, 76, ... "\300F\27\0\340D\27\0\310F\27\0\350D\27\0\320F\27\0\360D\27\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320E\27\0\24\0\26\0\370E\27\0\6@\14\0\2\0\0\0\234G\27\0\234=\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00334   412   NtReadVirtualMemory  (88, 0x1746c0, 76, ...  (88, 0x1746c0, 76, ... "`G\27\0\30F\27\0hG\27\0 F\27\0pG\27\0(F\27\0\0\0\22w\360+\23w\0\260\10\0@\0B\0pF\27\0\30\0\32\0\230F\27\0\6@\10\0\2\0\0\0\320Z\374w\3144\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00335   412   NtReadVirtualMemory  (88, 0x174760, 76, ...  (88, 0x174760, 76, ... "\0H\27\0\300F\27\0\10H\27\0\310F\27\0\20H\27\0\320F\27\0\0\0\375v%0\375v\0\200\7\0>\0@\0\30G\27\0\26\0\30\0@G\27\0\4@\14\0\2\0\0\0pZ\374wTF\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00336   412   NtReadVirtualMemory  (88, 0x174800, 76, ...  (88, 0x174800, 76, ... "\234\36\27\0`G\27\0\244\36\27\0hG\27\0\254\36\27\0pG\27\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\270G\27\0\26\0\30\0\340G\27\0\4@\14\0\1\0\0\0\310Z\374w\344C\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00337   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=608,ParentPid=356,}, 0x0, ) == 0x0
 00338   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00339   412   NtReadVirtualMemory  (88, 0x171ea4, 4, ...  (88, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00340   412   NtReadVirtualMemory  (88, 0x171ec0, 76, ...  (88, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00341   412   NtReadVirtualMemory  (88, 0x20534, 74, ...  (88, 0x20534, 74, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0l\0o\0g\0o\0n\0.\0e\0x\0e\0\0\0", 74, ) , 74, ) == 0x0
 00342   412   NtClose  (88, ... ) == 0x0
 00343   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {656, 0}, ... 88, ) == 0x0
 00344   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=656,ParentPid=608,}, 0x0, ) == 0x0
 00345   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00346   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00347   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00348   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00349   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00350   412   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\300Z\374w\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00351   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00352   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00353   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00354   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00355   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00356   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0 &\30\0\330$\30\0\0\0\216u\20\24\216u\0\320\4\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\377\377\377\377\224'\30\0\374\36\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00357   412   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\08$\30\0\230#\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0`Z\374wD!\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00358   412   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0\310&\30\0 &\30\0\0\0\214u\203\27\214u\0\300\1\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\0[\374w\304#\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00359   412   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\200%\30\08$\30\0\0\06v\240\206v\0\360\0\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\10\0\377\377\0\0\334(\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00360   412   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0h'\30\0\200%\30\0\0\0w_5\21w_\0\340\0\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\10\0\377\377\0\0l+\30\0T\37\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00361   412   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0P)\30\0\310&\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\20'\30\0\26\0\30\08'\30\0\4@\14\0\3\0\0\0\360Z\374wd$\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00362   412   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\230*\30\0\360)\30\0\0\0\212u\0\0\0\0\0\360\0\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\4@\0\0\1\0\0\0\200Z\374w\200Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00363   412   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "@)\30\0\0(\30\0H)\30\0\10(\30\0\360)\30\0P)\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0X(\30\0\24\0\26\0\200(\30\0\6@\10\0\1\0\0\0|)\30\0L&\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00364   412   NtReadVirtualMemory  (88, 0x182940, 76, ...  (88, 0x182940, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\260(\30\0h'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\370(\30\0\26\0\30\0 )\30\0\6@\14\0\1\0\0\0\304*\30\0\334(\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00365   412   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0\20(\30\0\260(\30\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\230)\30\0\22\0\24\0\300)\30\0\6@\14\0\1\0\0\0\330Z\374w\330Z\374w\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00366   412   NtReadVirtualMemory  (88, 0x182a88, 76, ...  (88, 0x182a88, 76, ... "0+\30\0\340)\30\08+\30\0\350)\30\0@+\30\0\20(\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08*\30\0\30\0\32\0`*\30\0\4@\0\0\1\0\0\0\20[\374w|)\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00367   412   NtReadVirtualMemory  (88, 0x182b30, 76, ...  (88, 0x182b30, 76, ... "\234\36\30\0\210*\30\0\244\36\30\0\220*\30\0\254\36\30\0\230*\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\340*\30\0\30\0\32\0\10+\30\0\4@\14\0\2\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00368   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=656,ParentPid=608,}, 0x0, ) == 0x0
 00369   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00370   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00371   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00372   412   NtReadVirtualMemory  (88, 0x20598, 66, ...  (88, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0e\0r\0v\0i\0c\0e\0s\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00373   412   NtClose  (88, ... ) == 0x0
 00374   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {668, 0}, ... 88, ) == 0x0
 00375   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=668,ParentPid=608,}, 0x0, ) == 0x0
 00376   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00377   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00378   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00379   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\324(\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00380   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\04-\30\0\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00381   412   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00382   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\3144\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00383   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00384   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00385   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) == 0x0
 00386   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00387   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00388   412   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\0(\30\0 &\30\0\0\0Dt\0\0\0\0\0\220\6\0<\0>\0\200$\30\0\24\0\26\0\250$\30\0\6@\0\0\377\377\0\0t)\30\0$#\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00389   412   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0`'\30\0\230#\30\0\0\0yv\7\30yv\0\260\0\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\14\0\377\377\0\0\274;\30\0pZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00390   412   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\260&\30\0p%\30\0\270&\30\0x%\30\0\330$\30\0\300&\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\377\377\0\0\34;\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00391   412   NtReadVirtualMemory  (88, 0x1826b0, 76, ...  (88, 0x1826b0, 76, ... "P'\30\0\20&\30\0X'\30\0\30&\30\0 &\30\0`'\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h&\30\0\24\0\26\0\220&\30\0\6@\10\0\377\377\0\0\214'\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00392   412   NtReadVirtualMemory  (88, 0x182750, 76, ...  (88, 0x182750, 76, ... "\360'\30\0\260&\30\0\370'\30\0\270&\30\0\300&\30\0\200%\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10'\30\0\26\0\30\00'\30\0\6@\14\0\377\377\0\0L+\30\0\354&\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00393   412   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\250(\30\0\330$\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\6@\14\0\377\377\0\0\14*\30\0\204"\30\0\26\376};\0\0\0\0", 76, ) \30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00394   412   NtReadVirtualMemory  (88, 0x182898, 76, ...  (88, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0H)\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\6@\14\0\377\377\0\0\254*\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00395   412   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\320)\30\0\230(\30\0\330)\30\0\240(\30\0\340)\30\0\250(\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\10\0\377\377\0\0t5\30\0\4%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00396   412   NtReadVirtualMemory  (88, 0x1829d0, 76, ...  (88, 0x1829d0, 76, ... "p*\30\08)\30\0x*\30\0@)\30\0 +\30\0H)\30\0\0\0\262q\234\21\262q\0\20\1\06\08\0\220)\30\0\16\0\20\0\270)\30\0\6@\14\0\377\377\0\0\224,\30\0,(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00397   412   NtReadVirtualMemory  (88, 0x182a70, 76, ...  (88, 0x182a70, 76, ... "\20+\30\0\320)\30\0\30+\30\0\330)\30\0\270!\30\0 +\30\0\0\0zv\32\22zv\00\1\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0\377\377\0\0\334-\30\0\324(\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00398   412   NtReadVirtualMemory  (88, 0x182b10, 76, ...  (88, 0x182b10, 76, ... "X,\30\0p*\30\0`,\30\0x*\30\0\200*\30\0\340)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\310*\30\0\26\0\30\0\360*\30\0\6@\10\0\377\377\0\0|.\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00399   412   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\370,\30\0\20+\30\0\0-\30\0\30+\30\0\10-\30\0\270!\30\0\0\0;t\0\0\0\0\0\320\0\0>\0@\0\20,\30\0\26\0\30\08,\30\0\4@\0\0\1\0\0\0\364+\30\0\14*\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00400   412   NtReadVirtualMemory  (88, 0x182cf8, 76, ...  (88, 0x182cf8, 76, ... "\270+\30\0X,\30\0\300+\30\0`,\30\0\310+\30\0h,\30\0\0\0\317q7\177\320q\0@\4\0@\0B\0h+\30\0\30\0\32\0\220+\30\0\4@\14\0\2\0\0\0\260Z\374w\374\37\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00401   412   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "\240-\30\0\370,\30\0\250-\30\0\0-\30\0\360.\30\0\10-\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\4@\0\0\4\0\0\0\34/\30\0\224,\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00402   412   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "@.\30\0\270+\30\0H.\30\0\300+\30\0\260>\30\0P.\30\0\0\0Kt\232\356Kt\00\6\0@\0B\0P-\30\0\30\0\32\0x-\30\0\4@\14\0\2\0\0\0d0\30\0\254*\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00403   412   NtReadVirtualMemory  (88, 0x182e40, 76, ...  (88, 0x182e40, 76, ... "\340.\30\0\240-\30\0\350.\30\0\250-\30\0\260-\30\0x=\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\370-\30\0\26\0\30\0 .\30\0\6@\0\0\2\0\0\0\2348\30\0L+\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00404   412   NtReadVirtualMemory  (88, 0x182ee0, 76, ...  (88, 0x182ee0, 76, ... "\210/\30\0@.\30\0\220/\30\0H.\30\0 2\30\0\310+\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0\230.\30\0\26\0\30\0\300.\30\0\6@\14\0\2\0\0\0\41\30\0\364+\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00405   412   NtReadVirtualMemory  (88, 0x182f88, 76, ...  (88, 0x182f88, 76, ... "(0\30\0\340.\30\000\30\0\350.\30\0x=\30\080\30\0\0\0\326v\326/\326v\0P\1\0@\0B\08/\30\0\30\0\32\0`/\30\0\6@\14\0\11\0\0\0\264B\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00406   412   NtReadVirtualMemory  (88, 0x183028, 76, ...  (88, 0x183028, 76, ... "\3100\30\0\210/\30\0\3200\30\0\220/\30\0\230/\30\0\2609\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\340/\30\0\24\0\26\0\100\30\0\6@\14\0\3\0\0\0\310Z\374w\334-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00407   412   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "p1\30\0(0\30\0x1\30\000\30\0\2206\30\0H5\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\2000\30\0\24\0\26\0\2500\30\0\6@\14\0\3\0\0\0DE\30\0\34/\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00408   412   NtReadVirtualMemory  (88, 0x183170, 76, ...  (88, 0x183170, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0\2404\30\0\04\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0 1\30\0\30\0\32\0H1\30\0\6@\14\0\3\0\0\0L2\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00409   412   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\2702\30\0\360.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\3101\30\0\26\0\30\0\3601\30\0\6@\10\0\3\0\0\0\3442\30\0\2541\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00410   412   NtReadVirtualMemory  (88, 0x1832a8, 76, ...  (88, 0x1832a8, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0X3\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\14\0\3\0\0\0`Z\374wL2\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00411   412   NtReadVirtualMemory  (88, 0x183348, 76, ...  (88, 0x183348, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0\04\30\0\2702\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\03\30\0\22\0\24\0(3\30\0\6@\10\0\25\0\0\0,4\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00412   412   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\2001\30\0X3\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\6@\10\0\15\0\0\0TC\30\0\2043\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00413   412   NtReadVirtualMemory  (88, 0x183490, 76, ...  (88, 0x183490, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\0H5\30\0\2001\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\14\0\12\0\0\0\346\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00414   412   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3405\30\0\2204\30\0\3505\30\0\2304\30\0\3300\30\0\2404\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3504\30\0\30\0\32\0\205\30\0\6@\10\0\4\0\0\0\3747\30\0t)\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00415   412   NtReadVirtualMemory  (88, 0x1835e0, 76, ...  (88, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\209\30\007\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\14\0\4\0\0\0\2746\30\0\3144\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00416   412   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... " 7\30\0\3405\30\0(7\30\0\3505\30\0\3207\30\0\3300\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\14\0\4\0\0\0lA\30\0\346\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00417   412   NtReadVirtualMemory  (88, 0x183720, 76, ...  (88, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3605\30\0p8\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\6@\10\0\4\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00418   412   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\0\2206\30\0\0\0-w\306@-w\00\6\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\6@\14\0\15\0\0\0<9\30\0t5\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00419   412   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\007\30\0\3207\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\308\30\0\22\0\24\0@8\30\0\6@\14\0\4\0\0\0\3349\30\0|.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00420   412   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0H:\30\0\3605\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\4\0\0\0,@\30\0\3747\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00421   412   NtReadVirtualMemory  (88, 0x1839a0, 76, ...  (88, 0x1839a0, 76, ... "8:\30\0\09\30\0@:\30\0\109\30\080\30\08<\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00422   412   NtReadVirtualMemory  (88, 0x183a38, 76, ...  (88, 0x183a38, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\360:\30\0\209\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3709\30\0\16\0\20\0 :\30\0\6@\0\0\3\0\0\0d<\30\0\3349\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00423   412   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\0\220;\30\0H:\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\3\0\0\0,G\30\0L&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00424   412   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0,vN\25,v\0\240\10\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\10\0\6\0\0\0\334>\30\0\254%\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00425   412   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0\2609\30\0\330<\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\0\0\3\0\0\0\4=\30\0t:\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00426   412   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\220;\30\0\0\06v\240\206v\0\360\0\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\10\0\6\0\0\0\314@\30\0d<\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00427   412   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\240>\30\0\310<\30\0\250>\30\0\320<\30\0P.\30\0\230/\30\0\0\0\247uM\31\247u\00\12\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\14\0\6\0\0\0\0[\374w\304#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00428   412   NtReadVirtualMemory  (88, 0x183ea0, 76, ...  (88, 0x183ea0, 76, ... "H?\30\0h=\30\0P?\30\0p=\30\0X?\30\0\260-\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300=\30\0\30\0\32\0~>\30\0\4@\14\20\2\0\0\0\204?\30\0\274;\30\02\376};\10\15\11\0", 76, ) , 76, ) == 0x0
 00429   412   NtReadVirtualMemory  (88, 0x183f48, 76, ...  (88, 0x183f48, 76, ... "\360?\30\0\240>\30\0\370?\30\0\250>\30\0\0@\30\0\260>\30\0\0\04wY\324w\0\260\10\0@\0B\0\370>\30\0\30\0\32\0 ?\30\0\4@\14\0\1\0\0\0pZ\374w\334>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00430   412   NtReadVirtualMemory  (88, 0x183ff0, 76, ...  (88, 0x183ff0, 76, ... "\220@\30\0H?\30\0\230@\30\0P?\30\0\240@\30\0X?\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\240?\30\0\30\0\32\0\310?\30\0\4@\14\0\1\0\0\0\14B\30\0<9\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00431   412   NtReadVirtualMemory  (88, 0x184090, 76, ...  (88, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0\0@\30\0\0\08t\0\0\0\0\0\360\0\0>\0@\0H@\30\0\26\0\30\0p@\30\0\4@\0\0\1\0\0\0\374C\30\0\4=\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00432   412   NtReadVirtualMemory  (88, 0x184130, 76, ...  (88, 0x184130, 76, ... "\320A\30\0\220@\30\0\330A\30\0\230@\30\0\340A\30\0\240@\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\350@\30\0\24\0\26\0\20A\30\0\4@\14\0\1\0\0\0\350Z\374w\2746\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00433   412   NtReadVirtualMemory  (88, 0x1841d0, 76, ...  (88, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\0@A\30\0\0\0At\200\23At\0\320\2\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\4@\10\0\1\0\0\0\360Z\374w,@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00434   412   NtReadVirtualMemory  (88, 0x184278, 76, ...  (88, 0x184278, 76, ... "\30C\30\0\320A\30\0 C\30\0\330A\30\0xD\30\0(C\30\0\0\0>tG\26>t\0p\2\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\240Z\374w\304/\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00435   412   NtReadVirtualMemory  (88, 0x184318, 76, ...  (88, 0x184318, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\210B\30\0\320C\30\0\0\0]t\206\25]t\0p\13\0<\0>\0\320B\30\0\24\0\26\0\370B\30\0\6@\10\0\1\0\0\0\320Z\374w,4\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00436   412   NtReadVirtualMemory  (88, 0x1843c0, 76, ...  (88, 0x1843c0, 76, ... "hD\30\0\30C\30\0pD\30\0 C\30\0(C\30\0\340A\30\0\0\07tP\207t\0\240\0\0@\0B\0pC\30\0\30\0\32\0\230C\30\0\6@\14\0\1\0\0\0\354E\30\0\314@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00437   412   NtReadVirtualMemory  (88, 0x184468, 76, ...  (88, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\210B\30\0\0\0:tP\21:t\0\220\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\14\0\1\0\0\0\214F\30\0\330Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00438   412   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0\300E\30\0xD\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\2\0\0\0\300Z\374w\41\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00439   412   NtReadVirtualMemory  (88, 0x1845b0, 76, ...  (88, 0x1845b0, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0`F\30\0\30E\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\0\20[\374w\374C\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00440   412   NtReadVirtualMemory  (88, 0x184650, 76, ...  (88, 0x184650, 76, ... "\360F\30\0\260E\30\0\370F\30\0\270E\30\0\0G\30\0\300E\30\0\0\0\0\10F\30\0\24\0\26\00F\30\0\4@\14\0\1\0\0\0\330Z\374w\244D\30\0"\376};8A\13\0", 76, ) \376};8A\13\0", 76, ) == 0x0
 00441   412   NtReadVirtualMemory  (88, 0x1846f0, 76, ...  (88, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0\254\36\30\0`F\30\0\0\0\372\17\37]\372\17\0\20\2\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\4@\14\0\1\0\0\0xZ\374w\34;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00442   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=668,ParentPid=608,}, 0x0, ) == 0x0
 00443   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00444   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00445   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00446   412   NtReadVirtualMemory  (88, 0x20598, 60, ...  (88, 0x20598, 60, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0l\0s\0a\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00447   412   NtClose  (88, ... ) == 0x0
 00448   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {840, 0}, ... 88, ) == 0x0
 00449   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=840,ParentPid=656,}, 0x0, ) == 0x0
 00450   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00451   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00452   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00453   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0t)\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00454   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00455   412   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00456   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\344!\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00457   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00458   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00459   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\310 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00460   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\0X (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00461   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0x%\30\0\330$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\04\0\0\0D&\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00462   412   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\08$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00463   412   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "\10&\30\0\310$\30\0\20&\30\0\320$\30\0\270!\30\08$\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0 %\30\0\26\0\30\0H%\30\0\6@\14\0\5\0\0\0\304/\30\0\374\36\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00464   412   NtReadVirtualMemory  (88, 0x182608, 76, ...  (88, 0x182608, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\270!\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\300%\30\0\26\0\30\0\350%\30\0\4@\14\0\1\0\0\0\0[\374wd$\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00465   412   NtReadVirtualMemory  (88, 0x1826a8, 76, ...  (88, 0x1826a8, 76, ... "P'\30\0\10&\30\0X'\30\0\20&\30\0`'\30\0\30&\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\4@\10\0\5\0\0\0\24*\30\0\204"\30\01\376};\0\0\0\0", 76, ) \30\01\376};\0\0\0\0", 76, ) == 0x0
 00466   412   NtReadVirtualMemory  (88, 0x182750, 76, ...  (88, 0x182750, 76, ... "\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0(\30\0\270&\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\0'\30\0\30\0\32\0('\30\0\4@\14\0\1\0\0\0\244,\30\0\304#\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00467   412   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\330+\30\0`'\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\4@\14\0\3\0\0\0\246\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00468   412   NtReadVirtualMemory  (88, 0x182898, 76, ...  (88, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0\2509\30\0H)\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00469   412   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\330)\30\0\230(\30\0\340)\30\0\240(\30\0\250(\30\0\2504\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\14\0\1\0\0\0\4,\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00470   412   NtReadVirtualMemory  (88, 0x1829d8, 76, ...  (88, 0x1829d8, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\2101\30\0@0\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\220)\30\0\24\0\26\0\270)\30\0\6@\14\0\1\0\0\0T7\30\0\344&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00471   412   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\330)\30\0(+\30\0\340)\30\0\370.\30\0X.\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\00*\30\0\30\0\32\0X*\30\0\6@\14\0\1\0\0\0\+\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00472   412   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\20-\30\0x,\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\330*\30\0\26\0\30\0\0+\30\0\6@\10\0\1\0\0\0<-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00473   412   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0x,\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\14\0\6\0\0\0\310Z\374wt)\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00474   412   NtReadVirtualMemory  (88, 0x182c68, 76, ...  (88, 0x182c68, 76, ... "\0-\30\0\310+\30\0\10-\30\0\320+\30\00+\30\0\330+\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\10\0\2\0\0\0\2243\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00475   412   NtReadVirtualMemory  (88, 0x182d00, 76, ...  (88, 0x182d00, 76, ... "\240-\30\0h,\30\0\250-\30\0p,\30\0\260-\30\00+\30\0\0\0\262v<-\262v\0P\1\06\08\0\300,\30\0\16\0\20\0\350,\30\0\6@\14\0\1\0\0\0`Z\374w\+\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00476   412   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0X.\30\0\20-\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0X-\30\0\22\0\24\0\200-\30\0\6@\10\0\13\0\0\0\204.\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00477   412   NtReadVirtualMemory  (88, 0x182e48, 76, ...  (88, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\220*\30\0\260-\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\10\0\6\0\0\0\320Z\374w\334-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00478   412   NtReadVirtualMemory  (88, 0x182ee8, 76, ...  (88, 0x182ee8, 76, ... "\210/\30\0H.\30\0\220/\30\0P.\30\0\230/\30\0\220*\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\14\0\4\0\0\0\241\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00479   412   NtReadVirtualMemory  (88, 0x182f88, 76, ...  (88, 0x182f88, 76, ... "00\30\0\350.\30\080\30\0\360.\30\0@0\30\0\370.\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0@/\30\0\24\0\26\0h/\30\0\6@\10\0\1\0\0\0l0\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00480   412   NtReadVirtualMemory  (88, 0x183030, 76, ...  (88, 0x183030, 76, ... "\3300\30\0\210/\30\0\3400\30\0\220/\30\0\350)\30\0\230/\30\0\0\0gv8\25gv\0@\16\0@\0B\0\340/\30\0\30\0\32\0\100\30\0\6@\10\0\1\0\0\0\3642\30\0\304/\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00481   412   NtReadVirtualMemory  (88, 0x1830d8, 76, ...  (88, 0x1830d8, 76, ... "x1\30\000\30\0\2001\30\080\30\0\104\30\0(2\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2100\30\0\30\0\32\0\2600\30\0\6@\14\0\2\0\0\0\2641\30\0$/\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00482   412   NtReadVirtualMemory  (88, 0x183178, 76, ...  (88, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0\3102\30\0\350)\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\001\30\0\24\0\26\0X1\30\0\6@\14\0\2\0\0\0\304;\30\0\241\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00483   412   NtReadVirtualMemory  (88, 0x183218, 76, ...  (88, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0\3500\30\0h3\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3201\30\0\24\0\26\0\3701\30\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00484   412   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\302\30\0`3\30\0 2\30\0h3\30\0\2101\30\0\0\0-w\306@-w\00\6\0>\0@\0p2\30\0\26\0\30\0\2302\30\0\6@\14\0\6\0\0\044\30\0l0\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00485   412   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0(2\30\0\3102\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\203\30\0\22\0\24\083\30\0\6@\14\0\2\0\0\0\3244\30\0\244,\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00486   412   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0@5\30\0\3500\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2603\30\0\26\0\30\0\3303\30\0\6@\10\0\1\0\0\0\360Z\374w\3642\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00487   412   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "05\30\0\3703\30\085\30\0\04\30\0H)\30\0\3207\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00488   412   NtReadVirtualMemory  (88, 0x183530, 76, ...  (88, 0x183530, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\3505\30\0\104\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3604\30\0\16\0\20\0\305\30\0\6@\0\0\1\0\0\0\3747\30\0\3244\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00489   412   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0(7\30\0@5\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\14\0\1\0\0\0xZ\374w,(\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00490   412   NtReadVirtualMemory  (88, 0x183678, 76, ...  (88, 0x183678, 76, ... "\307\30\0\3305\30\0 7\30\0\3405\30\0p8\30\0(7\30\0\0\0,vN\25,v\0\240\10\0>\0@\006\30\0\26\0\30\0X6\30\0\6@\10\0\1\0\0\0\3249\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00491   412   NtReadVirtualMemory  (88, 0x183718, 76, ...  (88, 0x183718, 76, ... "\3007\30\0x6\30\0\3107\30\0\2006\30\0\2106\30\0\3505\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\300Z\374w\24*\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00492   412   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\2504\30\0p8\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0p7\30\0\30\0\32\0\2307\30\0\6@\0\0\1\0\0\0\2348\30\0l5\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00493   412   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\2309\30\0\3007\30\0\2409\30\0\3107\30\0\3207\30\0\2106\30\0\0\06v\240\206v\0\360\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\6@\10\0\2\0\0\0\34;\30\0\3747\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00494   412   NtReadVirtualMemory  (88, 0x183998, 76, ...  (88, 0x183998, 76, ... "@:\30\0`8\30\0H:\30\0h8\30\0P:\30\0\250(\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\2708\30\0\30\0\32\0v9\30\0\4@\14\20\2\0\0\0|:\30\0\2646\30\02\376};\20g\12\0", 76, ) , 76, ) == 0x0
 00495   412   NtReadVirtualMemory  (88, 0x183a40, 76, ...  (88, 0x183a40, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\360:\30\0\2509\30\0\0\04wY\324w\0\260\10\0@\0B\0\3609\30\0\30\0\32\0\30:\30\0\4@\14\0\1\0\0\0d<\30\0\3249\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00496   412   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\230;\30\0P:\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\230:\30\0\24\0\26\0\300:\30\0\4@\14\0\1\0\0\0\20[\374w\2348\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00497   412   NtReadVirtualMemory  (88, 0x183b88, 76, ...  (88, 0x183b88, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0\374v!\21\374v\0P\0\0@\0B\08;\30\0\30\0\32\0`;\30\0\4@\14\0\1\0\0\0\350Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00498   412   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\254\36\30\0x=\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\340;\30\0\26\0\30\0\10<\30\0\4@\14\0\2\0\0\0\4=\30\0|:\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00499   412   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0\230;\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\14\0\2\0\0\0pZ\374wd<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00500   412   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\234\36\30\0\310<\30\0\244\36\30\0\320<\30\08<\30\0\330<\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\10\0\2\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00501   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=840,ParentPid=656,}, 0x0, ) == 0x0
 00502   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00503   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00504   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00505   412   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00506   412   NtClose  (88, ... ) == 0x0
 00507   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {960, 0}, ... 88, ) == 0x0
 00508   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=960,ParentPid=656,}, 0x0, ) == 0x0
 00509   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00510   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00511   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00512   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364+\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00513   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00514   412   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00515   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\41\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00516   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00517   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00518   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00519   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) == 0x0
 00520   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0(\2\0\0\224,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00521   412   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\0\230#\30\08$\30\0\0\0-w\306@-w\00\6\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0@\0\0\0\244%\30\0\304#\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00522   412   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "\240&\30\0\310$\30\0\250&\30\0\320$\30\0\260&\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0 %\30\0\26\0\30\0H%\30\0\4@\10\0\24\0\0\0\2441\30\0\4%\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00523   412   NtReadVirtualMemory  (88, 0x1826a0, 76, ...  (88, 0x1826a0, 76, ... "H'\30\0h%\30\0P'\30\0p%\30\0X'\30\0x%\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300%\30\0\30\0\32\0~&\30\0\4@\14\20\10\0\0\0\204'\30\0pZ\374w2\376};H\315\10\0", 76, ) , 76, ) == 0x0
 00524   412   NtReadVirtualMemory  (88, 0x182748, 76, ...  (88, 0x182748, 76, ... "\350'\30\0\240&\30\0\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0\04wY\324w\0\260\10\0@\0B\0\370&\30\0\30\0\32\0 '\30\0\4@\14\0\1\0\0\0L7\30\0\334&\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00525   412   NtReadVirtualMemory  (88, 0x1827e8, 76, ...  (88, 0x1827e8, 76, ... "\220(\30\0H'\30\0\230(\30\0P'\30\0\200*\30\0X'\30\0\0\06v\240\206v\0\360\0\0<\0>\0\240'\30\0\24\0\26\0\310'\30\0\4@\10\0#\0\0\0\14*\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00526   412   NtReadVirtualMemory  (88, 0x182890, 76, ...  (88, 0x182890, 76, ... "0)\30\0\350'\30\08)\30\0\360'\30\0\109\30\0(+\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0@(\30\0\30\0\32\0h(\30\0\4@\14\0\17\0\0\0l)\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00527   412   NtReadVirtualMemory  (88, 0x182930, 76, ...  (88, 0x182930, 76, ... "\320)\30\0\220(\30\0\330)\30\0\230(\30\0X.\30\0\340)\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350(\30\0\24\0\26\0\20)\30\0\6@\14\0\21\0\0\0lS\30\0\314(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00528   412   NtReadVirtualMemory  (88, 0x1829d0, 76, ...  (88, 0x1829d0, 76, ... "p*\30\00)\30\0x*\30\08)\30\0@)\30\0\200*\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210)\30\0\24\0\26\0\260)\30\0\6@\10\0e\0\0\0\254*\30\0$(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00529   412   NtReadVirtualMemory  (88, 0x182a70, 76, ...  (88, 0x182a70, 76, ... "\30+\30\0\320)\30\0 +\30\0\330)\30\0\340)\30\0\370'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0-\0\0\0$/\30\0\14*\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00530   412   NtReadVirtualMemory  (88, 0x182b18, 76, ...  (88, 0x182b18, 76, ... "\270+\30\0p*\30\0\300+\30\0x*\30\0\240(\30\0\310+\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310*\30\0\30\0\32\0\360*\30\0\6@\14\0!\0\0\0\C\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00531   412   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0(+\30\0\3505\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p+\30\0\24\0\26\0\230+\30\0\6@\14\0\15\0\0\0\204.\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00532   412   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\0-\30\0\270+\30\0\10-\30\0\300+\30\0h3\30\0 2\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20,\30\0\24\0\26\08,\30\0\6@\14\0\16\0\0\0\3547\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00533   412   NtReadVirtualMemory  (88, 0x182d00, 76, ...  (88, 0x182d00, 76, ... "\240-\30\0X,\30\0\250-\30\0`,\30\0\3300\30\080\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260,\30\0\30\0\32\0\330,\30\0\6@\14\0\17\0\0\0\334-\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00534   412   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0\220/\30\0\370.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X-\30\0\26\0\30\0\200-\30\0\6@\10\0\17\0\0\0\274/\30\0<-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00535   412   NtReadVirtualMemory  (88, 0x182e48, 76, ...  (88, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\370.\30\0@)\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\14\0_\0\0\0\214?\30\0\364+\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00536   412   NtReadVirtualMemory  (88, 0x182ee8, 76, ...  (88, 0x182ee8, 76, ... "\200/\30\0H.\30\0\210/\30\0P.\30\0\260-\30\0X.\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\10\0\26\0\0\0\3244\30\0\254*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00537   412   NtReadVirtualMemory  (88, 0x182f80, 76, ...  (88, 0x182f80, 76, ... "(0\30\0\350.\30\000\30\0\360.\30\080\30\0\260-\30\0\0\0\262v<-\262v\0P\1\06\08\0@/\30\0\16\0\20\0h/\30\0\6@\14\0\22\0\0\0\244D\30\0\334-\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00538   412   NtReadVirtualMemory  (88, 0x183028, 76, ...  (88, 0x183028, 76, ... "\3100\30\0\200/\30\0\3200\30\0\210/\30\0\20-\30\0\220/\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\330/\30\0\30\0\32\0\00\30\0\6@\10\0r\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00539   412   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "h1\30\0(0\30\0p1\30\000\30\0x1\30\0\20-\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\2000\30\0\26\0\30\0\2500\30\0\6@\14\0*\0\0\0\3642\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00540   412   NtReadVirtualMemory  (88, 0x183168, 76, ...  (88, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\6@\10\0\20\0\0\0L2\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00541   412   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0h,\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\6@\10\0\23\0\0\0t5\30\0\2441\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00542   412   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0H5\30\0\104\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\6@\14\0\17\0\0\0\2243\30\0\41\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00543   412   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\2504\30\0h,\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\203\30\0\24\0\26\083\30\0\6@\14\0\17\0\0\0\3249\30\0\3642\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00544   412   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0\3102\30\0\2504\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\2603\30\0\24\0\26\0\3303\30\0\6@\10\0\16\0\0\0TO\30\0\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00545   412   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\104\30\0h3\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0P4\30\0\22\0\24\0x4\30\0\6@\14\0\16\0\0\0\246\30\0$/\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00546   412   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2006\30\0\3102\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\14\08\0\0\0\34;\30\0L2\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00547   412   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "p6\30\085\30\0x6\30\0@5\30\0\310+\30\0h8\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00548   412   NtReadVirtualMemory  (88, 0x183670, 76, ...  (88, 0x183670, 76, ... "\207\30\0\3305\30\0\307\30\0\3405\30\0\3007\30\0H5\30\0\0\0\323v\0\0\0\0\0@\0\06\08\006\30\0\16\0\20\0X6\30\0\6@\0\0\14\0\0\0\2248\30\0\246\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00549   412   NtReadVirtualMemory  (88, 0x183710, 76, ...  (88, 0x183710, 76, ... "\2607\30\0p6\30\0\2707\30\0x6\30\0h8\30\0\3007\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3106\30\0\26\0\30\0\3606\30\0\6@\10\0\31\0\0\0,@\30\0\204'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00550   412   NtReadVirtualMemory  (88, 0x1837b0, 76, ...  (88, 0x1837b0, 76, ... "X8\30\0\207\30\0`8\30\0\307\30\0 7\30\0\2006\30\0\0\0*v\\20*v\0\360\0\0<\0>\0h7\30\0\24\0\26\0\2207\30\0\6@\14\0\23\0\0\0\244=\30\0\224,\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00551   412   NtReadVirtualMemory  (88, 0x183858, 76, ...  (88, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\3505\30\0 7\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\108\30\0\30\0\32\008\30\0\6@\0\0\21\0\0\0d<\30\0\2546\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00552   412   NtReadVirtualMemory  (88, 0x1838f8, 76, ...  (88, 0x1838f8, 76, ... "\2309\30\0X8\30\0\2409\30\0`8\30\0\2509\30\0\240(\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\3\0\0\0\274;\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00553   412   NtReadVirtualMemory  (88, 0x183998, 76, ...  (88, 0x183998, 76, ... "8:\30\0\3708\30\0@:\30\0\09\30\0\220;\30\0\109\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0P9\30\0\24\0\26\0x9\30\0\4@\14\0\1\0\0\0t:\30\0\2243\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00554   412   NtReadVirtualMemory  (88, 0x183a38, 76, ...  (88, 0x183a38, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\330<\30\08<\30\0\0\0\361t\1\225\361t\0\0\1\0<\0>\0\3609\30\0\24\0\26\0\30:\30\0\4@\14\0\1\0\0\0\4=\30\0\3249\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00555   412   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\08<\30\0\220;\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\1\0\0\0\24B\30\0t5\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00556   412   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\360:\30\0\2509\30\0\0\0\247uM\31\247u\00\12\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\14\0\14\0\0\0\274c\30\049\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00557   412   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0H:\30\0\360:\30\0\0\0=r\240\22=r\0\240\1\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\10\0\1\0\0\0\354>\30\0\2248\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00558   412   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0H:\30\0\0\0\363t\0\0\0\0\0\300\0\0>\0@\0\200<\30\0\26\0\30\0\250<\30\0\4@\0\0\1\0\0\0\344Z\30\0t:\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00559   412   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\10>\30\0\310<\30\0\20>\30\0\320<\30\0\30>\30\0\330<\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0 =\30\0\24\0\26\0H=\30\0\4@\0\0\1\0\0\0D>\30\0\3547\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00560   412   NtReadVirtualMemory  (88, 0x183e08, 76, ...  (88, 0x183e08, 76, ... "\260>\30\0h=\30\0\270>\30\0p=\30\0\300>\30\0x=\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\6\0\0\0\374C\30\0\244=\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00561   412   NtReadVirtualMemory  (88, 0x183eb0, 76, ...  (88, 0x183eb0, 76, ... "P?\30\0\10>\30\0X?\30\0\20>\30\0`?\30\0\30>\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`>\30\0\30\0\32\0\210>\30\0\4@\14\0\1\0\0\0DE\30\0d<\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00562   412   NtReadVirtualMemory  (88, 0x183f50, 76, ...  (88, 0x183f50, 76, ... "\360?\30\0\260>\30\0\370?\30\0\270>\30\0\240@\30\0\300>\30\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\10?\30\0\26\0\30\00?\30\0\4@\14\0\1\0\0\0\264B\30\0\204.\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00563   412   NtReadVirtualMemory  (88, 0x183ff0, 76, ...  (88, 0x183ff0, 76, ... "\220@\30\0P?\30\0\230@\30\0X?\30\0\210B\30\0@A\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\250?\30\0\26\0\30\0\320?\30\0\4@\14\0\4\0\0\0\314@\30\0L7\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00564   412   NtReadVirtualMemory  (88, 0x184090, 76, ...  (88, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0`?\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0H@\30\0\24\0\26\0p@\30\0\6@\14\0\15\0\0\0\354E\30\0,@\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00565   412   NtReadVirtualMemory  (88, 0x184130, 76, ...  (88, 0x184130, 76, ... "\330A\30\0\220@\30\0\340A\30\0\230@\30\0\0@\30\0\240@\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\350@\30\0\26\0\30\0\20A\30\0\6@\10\0\20\0\0\0\254L\30\0\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00566   412   NtReadVirtualMemory  (88, 0x1841d8, 76, ...  (88, 0x1841d8, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\00C\30\0\0\0\35u\335\243\35u\0\220\2\0@\0B\0\210A\30\0\30\0\32\0\260A\30\0\4@\14\0\1\0\0\0\364O\30\0\34;\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00567   412   NtReadVirtualMemory  (88, 0x184278, 76, ...  (88, 0x184278, 76, ... " C\30\0\330A\30\0(C\30\0\340A\30\00C\30\0\0@\30\0\0\0zv\32\22zv\00\1\0>\0@\00B\30\0\26\0\30\0XB\30\0\6@\14\0\2\0\0\0|b\30\0\214?\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00568   412   NtReadVirtualMemory  (88, 0x184320, 76, ...  (88, 0x184320, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\350A\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\6@\14\0\3\0\0\0\354_\30\0T+\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00569   412   NtReadVirtualMemory  (88, 0x1843c0, 76, ...  (88, 0x1843c0, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\0xD\30\0\350A\30\0\0\0\365t\10\21\365t\0P\0\0<\0>\0xC\30\0\24\0\26\0\240C\30\0\4@\14\0\1\0\0\0dJ\30\0D>\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00570   412   NtReadVirtualMemory  (88, 0x184468, 76, ...  (88, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\320C\30\0\0\0\213p\275#\213p\0\300\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\10\0\1\0\0\0\254T\30\0\274/\30\0>\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00571   412   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0hF\30\0xD\30\0\0\0\27u\0\0\0\0\0\0\2\0<\0>\0\300D\30\0\24\0\26\0\350D\30\0\4@\0\0\1\0\0\0\224F\30\0\354>\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00572   412   NtReadVirtualMemory  (88, 0x1845b0, 76, ...  (88, 0x1845b0, 76, ... "XF\30\0\10E\30\0`F\30\0\20E\30\0\220I\30\0\350H\30\0\0\0\372t~\23\372t\0\0\1\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\04G\30\0\314@\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00573   412   NtReadVirtualMemory  (88, 0x184658, 76, ...  (88, 0x184658, 76, ... "\370F\30\0\260E\30\0\0G\30\0\270E\30\0HH\30\0\30E\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\10F\30\0\30\0\32\00F\30\0\6@\14\0\3\0\0\0tH\30\0DE\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00574   412   NtReadVirtualMemory  (88, 0x1846f8, 76, ...  (88, 0x1846f8, 76, ... "\230G\30\0XF\30\0\240G\30\0`F\30\0\350H\30\0\250G\30\0\0\05u\240\245u\0\0\3\0>\0@\0\260F\30\0\26\0\30\0\330F\30\0\6@\14\0\1\0\0\0\324G\30\0\354E\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00575   412   NtReadVirtualMemory  (88, 0x184798, 76, ...  (88, 0x184798, 76, ... "8H\30\0\370F\30\0@H\30\0\0G\30\0\10G\30\0HH\30\0\0\0Mu$\25Mu\0`\7\0>\0@\0PG\30\0\26\0\30\0xG\30\0\6@\14\0\1\0\0\0\274W\30\04G\30\0\33\376};\320`\12\0", 76, ) , 76, ) == 0x0
 00576   412   NtReadVirtualMemory  (88, 0x184838, 76, ...  (88, 0x184838, 76, ... "\330H\30\0\230G\30\0\340H\30\0\240G\30\0\250G\30\0hF\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\360G\30\0\26\0\30\0\30H\30\0\6@\10\0\4\0\0\0\274I\30\0\224F\30\0\26\376};\320`\12\0", 76, ) , 76, ) == 0x0
 00577   412   NtReadVirtualMemory  (88, 0x1848d8, 76, ...  (88, 0x1848d8, 76, ... "\200I\30\08H\30\0\210I\30\0@H\30\0\300E\30\0\10G\30\0\0\0qi\320\22qi\0\320\17\0:\0<\0\220H\30\0\22\0\24\0\270H\30\0\6@\10\0\1\0\0\0$R\30\0\200Z\374w\210\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00578   412   NtReadVirtualMemory  (88, 0x184980, 76, ...  (88, 0x184980, 76, ... "(J\30\0\330H\30\00J\30\0\340H\30\08J\30\0\300E\30\0\0\0\354t\0\0\0\0\0P\0\0@\0B\00I\30\0\30\0\32\0XI\30\0\4@\0\0\1\0\0\0\14K\30\0tH\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00579   412   NtReadVirtualMemory  (88, 0x184a28, 76, ...  (88, 0x184a28, 76, ... "\320J\30\0\200I\30\0\330J\30\0\210I\30\0\340K\30\0\220I\30\0\0\0Lr\3662Lr\0\360\0\0@\0B\0\330I\30\0\30\0\32\0\0J\30\0\4@\10\0\1\0\0\0\354M\30\0\374C\30\0,\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00580   412   NtReadVirtualMemory  (88, 0x184ad0, 76, ...  (88, 0x184ad0, 76, ... "\320K\30\0(J\30\0\330K\30\00J\30\0\300M\30\0\200L\30\0\0\0zY7\255zY\0\300\1\0F\0H\0\200J\30\0\24\0\26\0\262J\30\0\4@\14\0\1\0\0\0\14L\30\0\274I\30\0\325\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00581   412   NtReadVirtualMemory  (88, 0x184bd0, 76, ...  (88, 0x184bd0, 76, ... "pL\30\0\320J\30\0xL\30\0\330J\30\0\200L\30\08J\30\0\0\0)u\222\217)u\0\200\3\0J\0L\0xK\30\0\30\0\32\0\252K\30\0\6@\14\0\20\0\0\0LM\30\0\14K\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00582   412   NtReadVirtualMemory  (88, 0x184c70, 76, ...  (88, 0x184c70, 76, ... "\20M\30\0\320K\30\0\30M\30\0\330K\30\0\340J\30\0\340K\30\0\0\0>u\231s@u\0\200\6\0<\0>\0(L\30\0\24\0\26\0PL\30\0\6@\10\0\1\0\0\0\10[\374wlA\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00583   412   NtReadVirtualMemory  (88, 0x184d10, 76, ...  (88, 0x184d10, 76, ... "\260M\30\0pL\30\0\270M\30\0xL\30\0\210N\30\0\300M\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\310L\30\0\26\0\30\0\360L\30\0\4@\0\0\3\0\0\0\14T\30\0\14L\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00584   412   NtReadVirtualMemory  (88, 0x184db0, 76, ...  (88, 0x184db0, 76, ... "xN\30\0\20M\30\0\200N\30\0\30M\30\0 M\30\0\340J\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0hM\30\0\26\0\30\0\220M\30\0\6@\14\0\3\0\0\0\354P\30\0dJ\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00585   412   NtReadVirtualMemory  (88, 0x184e78, 76, ...  (88, 0x184e78, 76, ... "\30O\30\0\260M\30\0 O\30\0\270M\30\0(O\30\0 M\30\0\0\0\364t\354!\364t\0\240\0\0^\0b\0\10N\30\0\24\0\30\0RN\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00586   412   NtReadVirtualMemory  (88, 0x184f18, 76, ...  (88, 0x184f18, 76, ... "\270O\30\0xN\30\0\300O\30\0\200N\30\0\310O\30\0\210N\30\0\0\0\7u\24\31\7u\0`\1\0<\0>\0\320N\30\0\24\0\26\0\370N\30\0\4@\14\0\1\0\0\0L_\30\044\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00587   412   NtReadVirtualMemory  (88, 0x184fb8, 76, ...  (88, 0x184fb8, 76, ... "\20P\30\0\30O\30\0\30P\30\0 O\30\0 P\30\0(O\30\0\0\0\32uh\342\32u\0\240\2\0:\0<\0pO\30\0\22\0\24\0\230O\30\0\4@\14\0\1\0\0\0LP\30\0\24B\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00588   412   NtReadVirtualMemory  (88, 0x185010, 76, ...  (88, 0x185010, 76, ... "\260P\30\0\270O\30\0\270P\30\0\300O\30\0\300P\30\0\310O\30\0\0\0\322s\0\0\0\0\0\220\0\0@\0B\0(K\30\0\30\0\32\0PK\30\0\4@\0\0\1\0\0\0\214Q\30\0\364O\30\0$\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00589   412   NtReadVirtualMemory  (88, 0x1850b0, 76, ...  (88, 0x1850b0, 76, ... "PQ\30\0\20P\30\0XQ\30\0\30P\30\0`Q\30\0 P\30\0\0\0\366t\0\0\0\0\0\260\0\0<\0>\0hP\30\0\24\0\26\0\220P\30\0\4@\0\0\1\0\0\0\X\30\0\354M\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00590   412   NtReadVirtualMemory  (88, 0x185150, 76, ...  (88, 0x185150, 76, ... "\350Q\30\0\260P\30\0\360Q\30\0\270P\30\0\370Q\30\0\300P\30\0\0\0\11u\0\0\0\0\0p\1\0<\0>\0\10Q\30\0\24\0\26\00Q\30\0\4@\0\0\1\0\0\0DU\30\0LP\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00591   412   NtReadVirtualMemory  (88, 0x1851e8, 76, ...  (88, 0x1851e8, 76, ... "\210R\30\0PQ\30\0\220R\30\0XQ\30\0\230R\30\0`Q\30\0\0\0\267v!\226\271v\0\320\3\04\06\0\250Q\30\0\14\0\16\0\320Q\30\0\4@\14\0\3\0\0\0\304R\30\0\24I\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00592   412   NtReadVirtualMemory  (88, 0x185288, 76, ...  (88, 0x185288, 76, ... "0S\30\0\350Q\30\08S\30\0\360Q\30\0@S\30\0\370Q\30\0\0\0\370tg0\370t\0\200\0\0:\0<\0@R\30\0\22\0\24\0hR\30\0\4@\14\0\1\0\0\0Lg\30\0$R\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00593   412   NtReadVirtualMemory  (88, 0x185330, 76, ...  (88, 0x185330, 76, ... "\320S\30\0\210R\30\0\330S\30\0\220R\30\0\200T\30\0\230R\30\0\0\0\371t\0\21\371t\0\220\0\0@\0B\0\340R\30\0\30\0\32\0\10S\30\0\4@\10\0\1\0\0\0xZ\374wl)\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00594   412   NtReadVirtualMemory  (88, 0x1853d0, 76, ...  (88, 0x1853d0, 76, ... "pT\30\00S\30\0xT\30\08S\30\0XV\30\0\30U\30\0\0\0\0u\31\222\0u\0\260\1\0>\0@\0\210S\30\0\26\0\30\0\260S\30\0\4@\14\0\1\0\0\0\374X\30\0LM\30\0\35\376};\20\221\14\0", 76, ) , 76, ) == 0x0
 00595   412   NtReadVirtualMemory  (88, 0x185470, 76, ...  (88, 0x185470, 76, ... "\10U\30\0\320S\30\0\20U\30\0\330S\30\0\270U\30\0@S\30\0\0\0&u\305H&u\0p\2\0>\0@\0(T\30\0\26\0\30\0PT\30\0\6@\10\0\1\0\0\0\254]\30\0\244D\30\0\34\376};\20\221\14\0", 76, ) , 76, ) == 0x0
 00596   412   NtReadVirtualMemory  (88, 0x185508, 76, ...  (88, 0x185508, 76, ... "\250U\30\0pT\30\0\260U\30\0xT\30\0\340S\30\0\270U\30\0\0\0\273v\0\0\0\0\0@\0\06\08\0\310T\30\0\16\0\20\0\360T\30\0\6@\0\0\1\0\0\0\344U\30\0\214Q\30\0\23\376};\20\221\14\0", 76, ) , 76, ) == 0x0
 00597   412   NtReadVirtualMemory  (88, 0x1855a8, 76, ...  (88, 0x1855a8, 76, ... "HV\30\0\10U\30\0PV\30\0\20U\30\0\30U\30\0\200T\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0`U\30\0\24\0\26\0\210U\30\0\6@\14\0\2\0\0\0\204V\30\0DU\30\0\22\376};\20\221\14\0", 76, ) , 76, ) == 0x0
 00598   412   NtReadVirtualMemory  (88, 0x185648, 76, ...  (88, 0x185648, 76, ... "\340V\30\0\250U\30\0\350V\30\0\260U\30\0\360V\30\0\340S\30\0\0\0-r\201\22-r\0\300\0\08\0:\0\0V\30\0\20\0\22\0(V\30\0\4@\14\0\1\0\0\0\34W\30\0\344U\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00599   412   NtReadVirtualMemory  (88, 0x1856e0, 76, ...  (88, 0x1856e0, 76, ... "\200W\30\0HV\30\0\210W\30\0PV\30\0\320X\30\0XV\30\0\0\0\351u\212\23\351u\0\20\12\06\08\0\240V\30\0\16\0\20\0\310V\30\0\4@\10\0\1\0\0\0\d\30\0\204V\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00600   412   NtReadVirtualMemory  (88, 0x185780, 76, ...  (88, 0x185780, 76, ... " X\30\0\340V\30\0(X\30\0\350V\30\0\20Z\30\0pY\30\0\0\0suh"su\0\320\21\0>\0@\08W\30\0\26\0\30\0`W\30\0\4@\14\0\2\0\0\0\234Y\30\0\324G\30\0\31\376};\0\0\0\0", 76, ) su\0\320\21\0>\0@\08W\30\0\26\0\30\0`W\30\0\4@\14\0\2\0\0\0\234Y\30\0\324G\30\0\31\376};\0\0\0\0", 76, ) == 0x0
 00601   412   NtReadVirtualMemory  (88, 0x185820, 76, ...  (88, 0x185820, 76, ... "\300X\30\0\200W\30\0\310X\30\0\210W\30\0pY\30\0\320X\30\0\0\0\17u@\22\17u\0 \1\0<\0>\0\330W\30\0\24\0\26\0\0X\30\0\6@\14\0\2\0\0\0\204[\30\0\354P\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00602   412   NtReadVirtualMemory  (88, 0x1858c0, 76, ...  (88, 0x1858c0, 76, ... "`Y\30\0 X\30\0hY\30\0(X\30\00X\30\0\360V\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\0xX\30\0\26\0\30\0\240X\30\0\6@\0\0\2\0\0\0d\\30\0\14T\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00603   412   NtReadVirtualMemory  (88, 0x185960, 76, ...  (88, 0x185960, 76, ... "\0Z\30\0\300X\30\0\10Z\30\0\310X\30\0\220W\30\00X\30\0\0\0\23u*\24\23u\00\1\0>\0@\0\30Y\30\0\26\0\30\0@Y\30\0\6@\14\0\2\0\0\0, 76, ) , 76, ) == 0x0
 00604   412   NtReadVirtualMemory  (88, 0x185a00, 76, ...  (88, 0x185a00, 76, ... "\250Z\30\0`Y\30\0\260Z\30\0hY\30\0\270Z\30\0\220W\30\0\0\0\374t\0\0\0\0\0\0\1\0>\0@\0\270Y\30\0\26\0\30\0\340Y\30\0\4@\0\0\3\0\0\0\34c\30\0\234Y\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00605   412   NtReadVirtualMemory  (88, 0x185aa8, 76, ...  (88, 0x185aa8, 76, ... "H[\30\0\0Z\30\0P[\30\0\10Z\30\0X[\30\0\20Z\30\0\0\0\13u\320\21\13u\0\20\1\0@\0B\0XZ\30\0\30\0\32\0\200Z\30\0\4@\14\0\1\0\0\0T^\30\0\4=\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00606   412   NtReadVirtualMemory  (88, 0x185b48, 76, ...  (88, 0x185b48, 76, ... "(\\30\0\250Z\30\00\\30\0\260Z\30\08\\30\0\270Z\30\0\0\0\15uP\21\15u\0p\1\0<\0>\0\0[\30\0\24\0\26\0([\30\0\4@\10\0\1\0\0\0\254^\30\0\X\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00607   412   NtReadVirtualMemory  (88, 0x185c28, 76, ...  (88, 0x185c28, 76, ... "\310\\30\0H[\30\0\320\\30\0P[\30\0\330\\30\0X[\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\340[\30\0\24\0\26\0\10\\30\0\4@\14\0\1\0\0\0\254e\30\0\374X\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00608   412   NtReadVirtualMemory  (88, 0x185cc8, 76, ...  (88, 0x185cc8, 76, ... "p]\30\0(\\30\0x]\30\00\\30\0\200]\30\08\\30\0\0\0\376t\0\0\0\0\0\360\0\0>\0@\0\200\\30\0\26\0\30\0\250\\30\0\4@\0\0\1\0\0\0hZ\374whZ\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00609   412   NtReadVirtualMemory  (88, 0x185d70, 76, ...  (88, 0x185d70, 76, ... "\30^\30\0\310\\30\0 ^\30\0\320\\30\0(^\30\0\330\\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0 ]\30\0\30\0\32\0H]\30\0\4@\14\0\1\0\0\0\214`\30\0\254T\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00610   412   NtReadVirtualMemory  (88, 0x185e18, 76, ...  (88, 0x185e18, 76, ... "p^\30\0p]\30\0x^\30\0x]\30\0\200^\30\0\200]\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\310]\30\0\30\0\32\0\360]\30\0\4@\14\0\1\0\0\0\324a\30\0\344Z\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00611   412   NtReadVirtualMemory  (88, 0x185e70, 76, ...  (88, 0x185e70, 76, ... "\20_\30\0\30^\30\0\30_\30\0 ^\30\0\300_\30\0(^\30\0\0\0@v:\222@v\0\260\37\06\08\0\240[\30\0\16\0\20\0\310[\30\0\4@\14\0\1\0\0\04a\30\0\204[\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00612   412   NtReadVirtualMemory  (88, 0x185f10, 76, ...  (88, 0x185f10, 76, ... "\260_\30\0p^\30\0\270_\30\0x^\30\0\250a\30\0\10a\30\0\0\0-u\230`-u\0\240\3\0>\0@\0\310^\30\0\26\0\30\0\360^\30\0\4@\14\0\1\0\0\0\370Z\374wTO\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00613   412   NtReadVirtualMemory  (88, 0x185fb0, 76, ...  (88, 0x185fb0, 76, ... "P`\30\0\20_\30\0X`\30\0\30_\30\0``\30\0\200^\30\0\0\0\367t\0\0\0\0\0P\0\0<\0>\0h_\30\0\24\0\26\0\220_\30\0\6@\0\0\1\0\0\0\240Z\374w\C\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00614   412   NtReadVirtualMemory  (88, 0x186050, 76, ...  (88, 0x186050, 76, ... "\370`\30\0\260_\30\0\0a\30\0\270_\30\0\10a\30\0\300_\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\10`\30\0\22\0\24\00`\30\0\6@\10\0\1\0\0\0`Z\374w\254]\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00615   412   NtReadVirtualMemory  (88, 0x1860f8, 76, ...  (88, 0x1860f8, 76, ... "\230a\30\0P`\30\0\240a\30\0X`\30\0 _\30\0``\30\0\0\0\21u\260Q\21u\0\300\1\0@\0B\0\250`\30\0\30\0\32\0\320`\30\0\6@\14\0\1\0\0\0\300Z\374w\254^\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00616   412   NtReadVirtualMemory  (88, 0x186198, 76, ...  (88, 0x186198, 76, ... "@b\30\0\370`\30\0Hb\30\0\0a\30\0\360b\30\0 _\30\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0Pa\30\0\24\0\26\0xa\30\0\4@\10\0\1\0\0\0\j\30\0T^\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00617   412   NtReadVirtualMemory  (88, 0x186240, 76, ...  (88, 0x186240, 76, ... "\340b\30\0\230a\30\0\350b\30\0\240a\30\00d\30\0\360b\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\360a\30\0\30\0\32\0\30b\30\0\4@\14\0\2\0\0\0dk\30\0\264B\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00618   412   NtReadVirtualMemory  (88, 0x1862e0, 76, ...  (88, 0x1862e0, 76, ... "\200c\30\0@b\30\0\210c\30\0Hb\30\0Pb\30\0\250a\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\230b\30\0\24\0\26\0\300b\30\0\6@\14\0\2\0\0\0pZ\374w, 76, ) , 76, ) == 0x0
 00619   412   NtReadVirtualMemory  (88, 0x186380, 76, ...  (88, 0x186380, 76, ... " d\30\0\340b\30\0(d\30\0\350b\30\0\320d\30\00d\30\0\0\0\4u\300\276\4u\0\360\1\08\0:\08c\30\0\20\0\22\0`c\30\0\4@\14\0\1\0\0\0\0[\374w\274;\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00620   412   NtReadVirtualMemory  (88, 0x186420, 76, ...  (88, 0x186420, 76, ... "\300d\30\0\200c\30\0\310d\30\0\210c\30\0\220c\30\0Pb\30\0\0\0\360t\222E\360t\0\240\0\0>\0@\0\330c\30\0\26\0\30\0\0d\30\0\6@\14\0\1\0\0\0\360Z\374w\34W\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00621   412   NtReadVirtualMemory  (88, 0x1864c0, 76, ...  (88, 0x1864c0, 76, ... "pe\30\0 d\30\0xe\30\0(d\30\0\200e\30\0\220c\30\0\0\0\210hw:\212h\0\360\3\0>\0@\0xd\30\0\26\0\30\0\240d\30\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374wk\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00622   412   NtReadVirtualMemory  (88, 0x186570, 76, ...  (88, 0x186570, 76, ... "pf\30\0\300d\30\0xf\30\0\310d\30\0 h\30\0\320d\30\0\0\0\357t\14\22\357t\0\240\0\0J\0L\0\30e\30\0\30\0\32\0Je\30\0\4@\14\0\1\0\0\0\254f\30\0d\\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00623   412   NtReadVirtualMemory  (88, 0x186670, 76, ...  (88, 0x186670, 76, ... "\20g\30\0pe\30\0\30g\30\0xe\30\0\320h\30\0 g\30\0\0\0Eu\26\0Ju\0p\7\0J\0L\0\30f\30\0\30\0\32\0Jf\30\0\4@\14\0\1\0\0\0\374h\30\0\254e\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00624   412   NtReadVirtualMemory  (88, 0x186710, 76, ...  (88, 0x186710, 76, ... "\20h\30\0pf\30\0\30h\30\0xf\30\0\200f\30\0 h\30\0\0\01u\0\2713u\0\300\3\0F\0H\0\310e\30\0\24\0\26\0\372e\30\0\6@\14\0\4\0\0\0\200Z\374w\304R\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00625   412   NtReadVirtualMemory  (88, 0x186810, 76, ...  (88, 0x186810, 76, ... "\300h\30\0\20g\30\0\310h\30\0\30g\30\0 g\30\0\200e\30\0\0\0iu\317\254mu\0 \11\0J\0L\0\270g\30\0\30\0\32\0\352g\30\0\6@\14\0\10\0\0\0\210Z\374w\210Z\374w\32\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00626   412   NtReadVirtualMemory  (88, 0x1868c0, 76, ...  (88, 0x1868c0, 76, ... "pi\30\0\20h\30\0xi\30\0\30h\30\0\200i\30\0\200f\30\0\0\0\355t\16\246\355t\0\360\0\0H\0J\0hh\30\0\26\0\30\0\232h\30\0\4@\10\0\1\0\0\0\254i\30\0\254f\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00627   412   NtReadVirtualMemory  (88, 0x186970, 76, ...  (88, 0x186970, 76, ... " j\30\0\300h\30\0(j\30\0\310h\30\00j\30\0\320h\30\0\0\0\2u\254\365\2u\0\260\1\0J\0L\0\30i\30\0\30\0\32\0Ji\30\0\4@\14\0\1\0\0\0\14k\30\0\374h\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00628   412   NtReadVirtualMemory  (88, 0x186a20, 76, ...  (88, 0x186a20, 76, ... "\320j\30\0pi\30\0\330j\30\0xi\30\08k\30\0\200i\30\0\0\0 uh\251!u\0@\2\0J\0L\0\310i\30\0\30\0\32\0\372i\30\0\4@\14\0\1\0\0\0\350Z\374w\324a\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00629   412   NtReadVirtualMemory  (88, 0x186ad0, 76, ...  (88, 0x186ad0, 76, ... "(k\30\0 j\30\00k\30\0(j\30\0\350k\30\08k\30\0\0\0\177Yy\17\204Y\0p\6\0J\0L\0xj\30\0\30\0\32\0\252j\30\0\4@\14\0\1\0\0\0\24l\30\0\254i\30\0\322\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00630   412   NtReadVirtualMemory  (88, 0x186b28, 76, ...  (88, 0x186b28, 76, ... "\330k\30\0\320j\30\0\340k\30\0\330j\30\0\340j\30\00j\30\0\0\0w_5\21w_\0\340\0\0@\0B\0hg\30\0\30\0\32\0\220g\30\0\6@\10\0\2\0\0\0ll\30\0|b\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00631   412   NtReadVirtualMemory  (88, 0x186bd8, 76, ...  (88, 0x186bd8, 76, ... "0l\30\0(k\30\08l\30\00k\30\0@l\30\0\340j\30\0\0\09u\36\315;u\0 \4\0H\0J\0\200k\30\0\26\0\30\0\262k\30\0\4@\14\0\1\0\0\0\20[\374w\14k\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00632   412   NtReadVirtualMemory  (88, 0x186c30, 76, ...  (88, 0x186c30, 76, ... "\234\36\30\0\330k\30\0\244\36\30\0\340k\30\0\254\36\30\0\350k\30\0\0\0_u\261\245bu\0\20\11\0>\0@\0\310f\30\0\26\0\30\0\360f\30\0\4@\14\0\1\0\0\0\310Z\374wdk\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00633   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=960,ParentPid=656,}, 0x0, ) == 0x0
 00634   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00635   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00636   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00637   412   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00638   412   NtClose  (88, ... ) == 0x0
 00639   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1052, 0}, ... 88, ) == 0x0
 00640   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1052,ParentPid=656,}, 0x0, ) == 0x0
 00641   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00642   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00643   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00644   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00645   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00646   412   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0`"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00647   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\260!\30\0h \30\0\270!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\244,\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00648   412   NtReadVirtualMemory  (88, 0x1821b0, 76, ...  (88, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) \30\0\10!\30\0X (88, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00649   412   NtReadVirtualMemory  (88, 0x182250, 76, ...  (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\260!\30\0\370 (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\00 (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00650   412   NtReadVirtualMemory  (88, 0x1822f0, 76, ...  (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\230#\30\0X (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\320 (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00651   412   NtReadVirtualMemory  (88, 0x182390, 76, ...  (88, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\08$\30\0\370 (88, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00652   412   NtReadVirtualMemory  (88, 0x182430, 76, ...  (88, 0x182430, 76, ... "\320$\30\0\220#\30\0\330$\30\0\230#\30\0X)\30\0\340$\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350#\30\0\24\0\26\0\20$\30\0\6@\14\0\3\0\0\044\30\0\354!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00653   412   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\00$\30\0x%\30\08$\30\0@$\30\0\200%\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210$\30\0\24\0\26\0\260$\30\0\6@\10\0\16\0\0\0\254%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00654   412   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0\340$\30\0\0#\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(%\30\0\26\0\30\0P%\30\0\6@\14\0\10\0\0\0$*\30\0\14%\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00655   412   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\300!\30\0\310&\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00656   412   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0(&\30\0\3102\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p&\30\0\24\0\26\0\230&\30\0\6@\14\0\2\0\0\0\204)\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00657   412   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0\10/\30\0\300-\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20'\30\0\24\0\26\08'\30\0\6@\14\0\2\0\0\0t5\30\0\214"\30\0\22\376};\0\0\0\0", 76, ) \30\0\22\376};\0\0\0\0", 76, ) == 0x0
 00658   412   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0x,\30\0\330+\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\2\0\0\0\334(\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00659   412   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "H)\30\0\0(\30\0P)\30\0\10(\30\0\220*\30\0\370)\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\274*\30\0<(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00660   412   NtReadVirtualMemory  (88, 0x182948, 76, ...  (88, 0x182948, 76, ... "\350)\30\0\240(\30\0\360)\30\0\250(\30\0\370)\30\0@$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370(\30\0\30\0\32\0 )\30\0\6@\14\0\13\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00661   412   NtReadVirtualMemory  (88, 0x1829e8, 76, ...  (88, 0x1829e8, 76, ... "\200*\30\0H)\30\0\210*\30\0P)\30\0\260(\30\0X)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240)\30\0\26\0\30\0\310)\30\0\6@\10\0\2\0\0\0\241\30\0\254%\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00662   412   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\350)\30\0(+\30\0\360)\30\00+\30\0\260(\30\0\0\0\262v<-\262v\0P\1\06\08\0@*\30\0\16\0\20\0h*\30\0\6@\14\0\2\0\0\0`Z\374w\334(\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00663   412   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\330*\30\0\22\0\24\0\0+\30\0\6@\10\0\15\0\0\0\4,\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00664   412   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0\20(\30\00+\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\10\0\0\0\320Z\374w\+\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00665   412   NtReadVirtualMemory  (88, 0x182c68, 76, ...  (88, 0x182c68, 76, ... "\10-\30\0\310+\30\0\20-\30\0\320+\30\0\30-\30\0\20(\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\14\0\7\0\0\0\224.\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00666   412   NtReadVirtualMemory  (88, 0x182d08, 76, ...  (88, 0x182d08, 76, ... "\260-\30\0h,\30\0\270-\30\0p,\30\0\300-\30\0x,\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\300,\30\0\24\0\26\0\350,\30\0\6@\10\0\2\0\0\0\354-\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00667   412   NtReadVirtualMemory  (88, 0x182db0, 76, ...  (88, 0x182db0, 76, ... "X.\30\0\10-\30\0`.\30\0\20-\30\0h'\30\0\30-\30\0\0\0gv8\25gv\0@\16\0@\0B\0`-\30\0\30\0\32\0\210-\30\0\6@\10\0\2\0\0\0t0\30\0D-\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00668   412   NtReadVirtualMemory  (88, 0x182e58, 76, ...  (88, 0x182e58, 76, ... "\370.\30\0\260-\30\0\0/\30\0\270-\30\0\2101\30\0\250/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\10.\30\0\30\0\32\00.\30\0\6@\14\0\3\0\0\04/\30\0\244,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00669   412   NtReadVirtualMemory  (88, 0x182ef8, 76, ...  (88, 0x182ef8, 76, ... "\230/\30\0X.\30\0\240/\30\0`.\30\0H0\30\0h'\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\260.\30\0\24\0\26\0\330.\30\0\6@\14\0\3\0\0\0\350Z\374w\224.\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00670   412   NtReadVirtualMemory  (88, 0x182f98, 76, ...  (88, 0x182f98, 76, ... "80\30\0\370.\30\0@0\30\0\0/\30\0h.\30\0\3500\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0P/\30\0\24\0\26\0x/\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00671   412   NtReadVirtualMemory  (88, 0x183038, 76, ...  (88, 0x183038, 76, ... "\3300\30\0\230/\30\0\3400\30\0\240/\30\0\3500\30\0\10/\30\0\0\0-w\306@-w\00\6\0>\0@\0\360/\30\0\26\0\30\0\300\30\0\6@\14\0\11\0\0\0\2641\30\0\354-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00672   412   NtReadVirtualMemory  (88, 0x1830d8, 76, ...  (88, 0x1830d8, 76, ... "x1\30\080\30\0\2001\30\0@0\30\0\250/\30\0H0\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2200\30\0\22\0\24\0\2700\30\0\6@\14\0\3\0\0\0\3642\30\0$*\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00673   412   NtReadVirtualMemory  (88, 0x183178, 76, ...  (88, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0(2\30\0h.\30\0\0\0=w\24 ?w\0@\177\0>\0@\001\30\0\26\0\30\0X1\30\0\6@\10\0\2\0\0\0T2\30\0t0\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00674   412   NtReadVirtualMemory  (88, 0x183218, 76, ...  (88, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0`3\30\0\2101\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3201\30\0\26\0\30\0\3701\30\0\6@\14\0\6\0\0\0\360Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00675   412   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "P3\30\0\302\30\0X3\30\0 2\30\0\310&\30\0\3605\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00676   412   NtReadVirtualMemory  (88, 0x183350, 76, ...  (88, 0x183350, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\104\30\0(2\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\203\30\0\16\0\20\083\30\0\6@\0\0\2\0\0\0\346\30\0\3642\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00677   412   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0P3\30\0\2404\30\0X3\30\0H5\30\0`3\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2503\30\0\30\0\32\0\3203\30\0\6@\14\0\2\0\0\0xZ\374wl$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00678   412   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\2206\30\0H5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0P4\30\0\26\0\30\0x4\30\0\6@\10\0\2\0\0\0\3647\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00679   412   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3405\30\0\2304\30\0\3505\30\0\2404\30\0\2504\30\0\104\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3604\30\0\24\0\26\0\305\30\0\6@\14\0\2\0\0\0<9\30\0\224'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00680   412   NtReadVirtualMemory  (88, 0x1835e0, 76, ...  (88, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\3102\30\0\2206\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\0\0\2\0\0\0\2746\30\0\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00681   412   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... "\2707\30\0\3405\30\0\3007\30\0\3505\30\0\3605\30\0\2504\30\0\0\06v\240\206v\0\360\0\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\10\0\4\0\0\0\3449\30\0\346\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00682   412   NtReadVirtualMemory  (88, 0x1837b8, 76, ...  (88, 0x1837b8, 76, ... "`8\30\0\2006\30\0h8\30\0\2106\30\0p8\30\0\300!\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3306\30\0\30\0\32\0\2267\30\0\4@\14\20\2\0\0\0\2348\30\0\3244\30\02\376};\200x\10\0", 76, ) , 76, ) == 0x0
 00683   412   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0\209\30\0\3107\30\0\0\04wY\324w\0\260\10\0@\0B\0\208\30\0\30\0\32\088\30\0\4@\14\0\1\0\0\0pZ\374w\3647\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00684   412   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\2709\30\0p8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\4@\10\0\2\0\0\0\300Z\374wt5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00685   412   NtReadVirtualMemory  (88, 0x1839a8, 76, ...  (88, 0x1839a8, 76, ... "\234\36\30\0\09\30\0\244\36\30\0\109\30\0\254\36\30\0\209\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\4@\14\0\1\0\0\0\20[\374w\2746\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00686   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1052,ParentPid=656,}, 0x0, ) == 0x0
 00687   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00688   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00689   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00690   412   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00691   412   NtClose  (88, ... ) == 0x0
 00692   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1076, 0}, ... 88, ) == 0x0
 00693   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1076,ParentPid=656,}, 0x0, ) == 0x0
 00694   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00695   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00696   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00697   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00698   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00699   412   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00700   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\274*\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00701   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00702   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\03\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\03\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\03\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\03\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00703   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0Y\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0Y\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0Y\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0Y\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00704   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00705   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\20(\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0r\0\0\0L&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00706   412   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\230#\30\0\200%\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00707   412   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\320$\30\0\30&\30\0\330$\30\0\340$\30\0 2\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%\30\0\24\0\26\0P%\30\0\6@\14\0\2\0\0\0<(\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00708   412   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0`.\30\0\330+\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\2\0\0\0l5\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00709   412   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0\220*\30\0\360)\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\14\0\2\0\0\0\224'\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00710   412   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0H)\30\0\260(\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\2\0\0\0t)\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00711   412   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\260(\30\08$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\13\0\0\0\310Z\374w\254%\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00712   412   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "8)\30\0\0(\30\0@)\30\0\10(\30\0h'\30\0\20(\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\354-\30\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00713   412   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\360)\30\0h'\30\0\0\0\262v<-\262v\0P\1\06\08\0\370(\30\0\16\0\20\0 )\30\0\6@\14\0\2\0\0\0`Z\374w\224'\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00714   412   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\310&\30\0H)\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\220)\30\0\30\0\32\0\270)\30\0\6@\10\0\11\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00715   412   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\340)\30\0(+\30\0\350)\30\00+\30\0\310&\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\08*\30\0\26\0\30\0`*\30\0\6@\14\0\7\0\0\0\254,\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00716   412   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\330*\30\0\24\0\26\0\0+\30\0\6@\10\0\2\0\0\0\4,\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00717   412   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "p,\30\0 +\30\0x,\30\0(+\30\0 &\30\00+\30\0\0\0gv8\25gv\0@\16\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\2\0\0\0\314/\30\0\+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00718   412   NtReadVirtualMemory  (88, 0x182c70, 76, ...  (88, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\3400\30\0\0/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\3\0\0\0L-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00719   412   NtReadVirtualMemory  (88, 0x182d10, 76, ...  (88, 0x182d10, 76, ... "\260-\30\0p,\30\0\270-\30\0x,\30\0\240/\30\0\300-\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\310,\30\0\24\0\26\0\360,\30\0\6@\14\0\3\0\0\0\3349\30\0\254,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00720   412   NtReadVirtualMemory  (88, 0x182db0, 76, ...  (88, 0x182db0, 76, ... "P.\30\0\20-\30\0X.\30\0\30-\30\0 -\30\0`.\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h-\30\0\24\0\26\0\220-\30\0\6@\10\00\0\0\0\214.\30\0\334(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00721   412   NtReadVirtualMemory  (88, 0x182e50, 76, ...  (88, 0x182e50, 76, ... "\360.\30\0\260-\30\0\370.\30\0\270-\30\0\300-\30\0 &\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10.\30\0\26\0\30\00.\30\0\6@\14\0+\0\0\0l0\30\0\354-\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00722   412   NtReadVirtualMemory  (88, 0x182ef0, 76, ...  (88, 0x182ef0, 76, ... "\220/\30\0P.\30\0\230/\30\0X.\30\0\200,\30\0@0\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\250.\30\0\24\0\26\0\320.\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00723   412   NtReadVirtualMemory  (88, 0x182f90, 76, ...  (88, 0x182f90, 76, ... "00\30\0\360.\30\080\30\0\370.\30\0@0\30\0 -\30\0\0\0-w\306@-w\00\6\0>\0@\0H/\30\0\26\0\30\0p/\30\0\6@\14\0\15\0\0\0\141\30\0\4,\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00724   412   NtReadVirtualMemory  (88, 0x183030, 76, ...  (88, 0x183030, 76, ... "\3200\30\0\220/\30\0\3300\30\0\230/\30\0\0/\30\0\240/\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\350/\30\0\22\0\24\0\200\30\0\6@\14\0\3\0\0\0L2\30\0\214.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00725   412   NtReadVirtualMemory  (88, 0x1830d0, 76, ...  (88, 0x1830d0, 76, ... "p1\30\000\30\0x1\30\080\30\0\2001\30\0\200,\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2100\30\0\26\0\30\0\2600\30\0\6@\10\0\4\0\0\0\2541\30\0\314/\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00726   412   NtReadVirtualMemory  (88, 0x183170, 76, ...  (88, 0x183170, 76, ... "\202\30\0\3200\30\0\302\30\0\3300\30\0\2702\30\0\3400\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0(1\30\0\26\0\30\0P1\30\0\6@\14\0\10\0\0\0\374<\30\0\141\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00727   412   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\200%\30\0\3505\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00728   412   NtReadVirtualMemory  (88, 0x1832a8, 76, ...  (88, 0x1832a8, 76, ... "P3\30\0\202\30\0X3\30\0\302\30\0\04\30\0\2001\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\0\0\2\0\0\0\246\30\0L2\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00729   412   NtReadVirtualMemory  (88, 0x183350, 76, ...  (88, 0x183350, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0@5\30\0\04\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\03\30\0\30\0\32\0(3\30\0\6@\14\0\2\0\0\0,4\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00730   412   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2204\30\0P3\30\0\2304\30\0X3\30\0`3\30\0\2702\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\2503\30\0\24\0\26\0\3203\30\0\6@\14\0\3\0\0\0xZ\374w\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00731   412   NtReadVirtualMemory  (88, 0x183490, 76, ...  (88, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\2106\30\0@5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\10\0\3\0\0\0\3547\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00732   412   NtReadVirtualMemory  (88, 0x183530, 76, ...  (88, 0x183530, 76, ... "\3305\30\0\2204\30\0\3405\30\0\2304\30\0\2404\30\0`3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\14\0\3\0\0\049\30\0L&\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00733   412   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0 2\30\0\2106\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\0\0\2\0\0\0\2646\30\0\3442\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00734   412   NtReadVirtualMemory  (88, 0x183678, 76, ...  (88, 0x183678, 76, ... "\2607\30\0\3305\30\0\2707\30\0\3405\30\0\3505\30\0\2404\30\0\0\06v\240\206v\0\360\0\0<\0>\006\30\0\24\0\26\0X6\30\0\6@\10\0\4\0\0\0|:\30\0\246\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00735   412   NtReadVirtualMemory  (88, 0x1837b0, 76, ...  (88, 0x1837b0, 76, ... "X8\30\0x6\30\0`8\30\0\2006\30\0h8\30\0\230#\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3206\30\0\30\0\32\0\2167\30\0\4@\14\20\3\0\0\0\2248\30\0\3144\30\02\376};\330\324\10\0", 76, ) , 76, ) == 0x0
 00736   412   NtReadVirtualMemory  (88, 0x183858, 76, ...  (88, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\109\30\0\3007\30\0\0\04wY\324w\0\260\10\0@\0B\0\108\30\0\30\0\32\008\30\0\4@\14\0\1\0\0\0pZ\374w\3547\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00737   412   NtReadVirtualMemory  (88, 0x1838f8, 76, ...  (88, 0x1838f8, 76, ... "\2409\30\0X8\30\0\2509\30\0`8\30\0\2609\30\0h8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\4\0\0\0\300Z\374wl5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00738   412   NtReadVirtualMemory  (88, 0x1839a0, 76, ...  (88, 0x1839a0, 76, ... "@:\30\0\3708\30\0H:\30\0\09\30\0\360:\30\0\109\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0P9\30\0\30\0\32\0x9\30\0\4@\14\0\1\0\0\0\<\30\0L-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00739   412   NtReadVirtualMemory  (88, 0x183a40, 76, ...  (88, 0x183a40, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\220;\30\0\360:\30\0\0\0nZ\0\0\0\0\0@\1\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\4@\0\0\1\0\0\0\34;\30\0\2646\30\0\321\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00740   412   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\0@:\30\0\210;\30\0H:\30\0P:\30\0\2609\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\230:\30\0\26\0\30\0\300:\30\0\6@\10\0\1\0\0\0\274;\30\0|:\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00741   412   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... " <\30\0\340:\30\0(<\30\0\350:\30\00<\30\0P:\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\08;\30\0\26\0\30\0`;\30\0\4@\0\0\1\0\0\0\244=\30\0\34;\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00742   412   NtReadVirtualMemory  (88, 0x183c20, 76, ...  (88, 0x183c20, 76, ... "\300<\30\0\200;\30\0\310<\30\0\210;\30\0\320<\30\0\220;\30\0\0\0\302t\220\22\302t\0\0\1\0<\0>\0\330;\30\0\24\0\26\0\0<\30\0\4@\10\0\1\0\0\0\350Z\374w\3349\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00743   412   NtReadVirtualMemory  (88, 0x183cc0, 76, ...  (88, 0x183cc0, 76, ... "h=\30\0 <\30\0p=\30\0(<\30\0x=\30\00<\30\0\0\0\301t`\36\301t\0\320\0\0>\0@\0x<\30\0\26\0\30\0\240<\30\0\4@\14\0\1\0\0\0\360Z\374w\2541\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00744   412   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\10>\30\0\300<\30\0\20>\30\0\310<\30\0\30>\30\0\320<\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\30=\30\0\30\0\32\0@=\30\0\4@\14\0\1\0\0\0\20[\374w\274;\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00745   412   NtReadVirtualMemory  (88, 0x183e08, 76, ...  (88, 0x183e08, 76, ... "\234\36\30\0h=\30\0\244\36\30\0p=\30\0\254\36\30\0x=\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\2\0\0\0\0[\374w$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00746   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1076,ParentPid=656,}, 0x0, ) == 0x0
 00747   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00748   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00749   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00750   412   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00751   412   NtClose  (88, ... ) == 0x0
 00752   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1392, 0}, ... 88, ) == 0x0
 00753   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1392,ParentPid=656,}, 0x0, ) == 0x0
 00754   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00755   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00756   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00757   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\234.\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00758   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00759   412   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\4,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00760   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00761   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00762   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00763   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00764   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00765   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\330$\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\36\0\0\0\4%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00766   412   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "\10&\30\0($\30\0\20&\30\00$\30\08$\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) \30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) == 0x0
 00767   412   NtReadVirtualMemory  (88, 0x182608, 76, ...  (88, 0x182608, 76, ... "\360'\30\0\310$\30\0\370'\30\0\320$\30\0\0(\30\0\230#\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\300%\30\0\24\0\26\0\350%\30\0\4@\14\0\4\0\0\0\34B\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00768   412   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "h%\30\0\10&\30\0p%\30\0\20&\30\0X'\30\0\30&\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\240'\30\0\30\0\32\0\310'\30\0\4@\14\0\1\0\0\0,;\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00769   412   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "H'\30\0\360'\30\0P'\30\0\370'\30\0\310-\30\0 -\30\0\0\02t8Q2t\0\220\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\4\0\0\0\270Z\374w\270Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00770   412   NtReadVirtualMemory  (88, 0x182748, 76, ...  (88, 0x182748, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\0(\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0 %\30\0\22\0\24\0H%\30\0\6@\10\0\34\0\0\0\344&\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00771   412   NtReadVirtualMemory  (88, 0x1826a8, 76, ...  (88, 0x1826a8, 76, ... "\350(\30\0H'\30\0\360(\30\0P'\30\0\370(\30\0X'\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\230(\30\0\30\0\32\0\300(\30\0\6@\10\0\12\0\0\0\320Z\374w\204'\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00772   412   NtReadVirtualMemory  (88, 0x1828e8, 76, ...  (88, 0x1828e8, 76, ... "@)\30\0\250&\30\0H)\30\0\260&\30\0P)\30\0\270&\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\0'\30\0\26\0\30\0('\30\0\6@\10\0\6\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00773   412   NtReadVirtualMemory  (88, 0x182940, 76, ...  (88, 0x182940, 76, ... "\340)\30\0\350(\30\0\350)\30\0\360(\30\0\330+\30\0\370(\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\6@\14\0\7\0\0\0\34*\30\0\304#\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00774   412   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0 -\30\0\230*\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0\230)\30\0\24\0\26\0\300)\30\0\6@\14\0\4\0\0\0\314;\30\0|)\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00775   412   NtReadVirtualMemory  (88, 0x182a88, 76, ...  (88, 0x182a88, 76, ... "(+\30\0\340)\30\00+\30\0\350)\30\0\360)\30\0\200,\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\08*\30\0\30\0\32\0`*\30\0\6@\14\0\4\0\0\0\364-\30\0\4%\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00776   412   NtReadVirtualMemory  (88, 0x182b28, 76, ...  (88, 0x182b28, 76, ... "\310+\30\0\210*\30\0\320+\30\0\220*\30\0\200,\30\0\330+\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\340*\30\0\26\0\30\0\10+\30\0\6@\10\0\12\0\0\0, 76, ) , 76, ) == 0x0
 00777   412   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "p,\30\0(+\30\0x,\30\00+\30\08+\30\0P)\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\200+\30\0\24\0\26\0\250+\30\0\6@\14\0\11\0\0\0\3041\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00778   412   NtReadVirtualMemory  (88, 0x182c70, 76, ...  (88, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\230*\30\08+\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\4\0\0\0$6\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00779   412   NtReadVirtualMemory  (88, 0x182d10, 76, ...  (88, 0x182d10, 76, ... "\270-\30\0p,\30\0\300-\30\0x,\30\0x%\30\0\360)\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\310,\30\0\26\0\30\0\360,\30\0\6@\14\0\4\0\0\0\341\30\0$#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00780   412   NtReadVirtualMemory  (88, 0x182db8, 76, ...  (88, 0x182db8, 76, ... "`.\30\0\20-\30\0h.\30\0\30-\30\0p.\30\0x%\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0h-\30\0\30\0\32\0\220-\30\0\4@\14\0\2\0\0\0\2542\30\0\304*\30\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00781   412   NtReadVirtualMemory  (88, 0x182e60, 76, ...  (88, 0x182e60, 76, ... "\0/\30\0\270-\30\0\10/\30\0\300-\30\0\20/\30\0\310-\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\20.\30\0\30\0\32\08.\30\0\4@\14\0\12\0\0\0D4\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00782   412   NtReadVirtualMemory  (88, 0x182f00, 76, ...  (88, 0x182f00, 76, ... "\240/\30\0`.\30\0\250/\30\0h.\30\0\260/\30\0p.\30\0\0\0*t\350\24*t\0\340\0\0>\0@\0\270.\30\0\26\0\30\0\340.\30\0\4@\10\0\1\0\0\0\3444\30\0d+\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00783   412   NtReadVirtualMemory  (88, 0x182fa0, 76, ...  (88, 0x182fa0, 76, ... "@0\30\0\0/\30\0H0\30\0\10/\30\0P0\30\0\20/\30\0\0\0(t\37\22(t\0p\0\0<\0>\0X/\30\0\24\0\26\0\200/\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00784   412   NtReadVirtualMemory  (88, 0x183040, 76, ...  (88, 0x183040, 76, ... "\3400\30\0\240/\30\0\3500\30\0\250/\30\0\3600\30\0\260/\30\0\0\0@r\1\26@r\0\300\0\0<\0>\0\370/\30\0\24\0\26\0 0\30\0\4@\14\0\1\0\0\0\>\30\0\370Z\374w-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00785   412   NtReadVirtualMemory  (88, 0x1830e0, 76, ...  (88, 0x1830e0, 76, ... "\2101\30\0@0\30\0\2201\30\0H0\30\0\2301\30\0P0\30\0\0\0?r\355\23?r\0p\0\0<\0>\0\2300\30\0\24\0\26\0\3000\30\0\4@\14\0\1\0\0\0\0[\374wL-\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00786   412   NtReadVirtualMemory  (88, 0x183188, 76, ...  (88, 0x183188, 76, ... "p2\30\0\3400\30\0x2\30\0\3500\30\0 3\30\0\3600\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\3401\30\0\26\0\30\0\102\30\0\4@\10\0\2\0\0\0\2548\30\0\4,\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00787   412   NtReadVirtualMemory  (88, 0x183270, 76, ...  (88, 0x183270, 76, ... "\203\30\0\2101\30\0\303\30\0\2201\30\0\304\30\0 3\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0(2\30\0\24\0\26\0P2\30\0\4@\14\0\1\0\0\0L3\30\0\364-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00788   412   NtReadVirtualMemory  (88, 0x183310, 76, ...  (88, 0x183310, 76, ... "h3\30\0p2\30\0p3\30\0x2\30\0\2002\30\0\2301\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\3102\30\0\26\0\30\0\3602\30\0\6@\10\0\2\0\0\0\2443\30\0\2542\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00789   412   NtReadVirtualMemory  (88, 0x183368, 76, ...  (88, 0x183368, 76, ... "\104\30\0\203\30\0\204\30\0\303\30\0X5\30\0\304\30\0\0\0+t"\24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) \24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) == 0x0
 00790   412   NtReadVirtualMemory  (88, 0x183408, 76, ...  (88, 0x183408, 76, ... "\2504\30\0h3\30\0\2604\30\0p3\30\0x3\30\0\2002\30\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\3003\30\0\24\0\26\0\3503\30\0\6@\0\0\1\0\0\0\148\30\0\234.\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00791   412   NtReadVirtualMemory  (88, 0x1834a8, 76, ...  (88, 0x1834a8, 76, ... "H5\30\0\104\30\0P5\30\0\204\30\0\2306\30\0X5\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0`4\30\0\26\0\30\0\2104\30\0\4@\14\0\2\0\0\0\2045\30\0, 76, ) , 76, ) == 0x0
 00792   412   NtReadVirtualMemory  (88, 0x183548, 76, ...  (88, 0x183548, 76, ... "\3505\30\0\2504\30\0\3605\30\0\2604\30\0\2704\30\0x3\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\05\30\0\24\0\26\0(5\30\0\6@\14\0\2\0\0\0\234D\30\0\3444\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00793   412   NtReadVirtualMemory  (88, 0x1835e8, 76, ...  (88, 0x1835e8, 76, ... "\2106\30\0H5\30\0\2206\30\0P5\30\0pD\30\0@7\30\0\0\00t\11\300t\0@\1\0<\0>\0\2405\30\0\24\0\26\0\3105\30\0\4@\14\0\1\0\0\0\3046\30\0\254,\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00794   412   NtReadVirtualMemory  (88, 0x183688, 76, ...  (88, 0x183688, 76, ... "07\30\0\3505\30\087\30\0\3605\30\0\3109\30\0\2704\30\0\0\0)t\0\0\0\0\0@\0\08\0:\0@6\30\0\20\0\22\0h6\30\0\6@\0\0\1\0\0\0l7\30\0$6\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00795   412   NtReadVirtualMemory  (88, 0x183730, 76, ...  (88, 0x183730, 76, ... "\3207\30\0\2106\30\0\3307\30\0\2206\30\0\3705\30\0\3407\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\3406\30\0\30\0\32\0\107\30\0\6@\14\0\3\0\0\0\240Z\374w\3046\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00796   412   NtReadVirtualMemory  (88, 0x1837d0, 76, ...  (88, 0x1837d0, 76, ... "p8\30\007\30\0x8\30\087\30\0@7\30\0\260@\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\2107\30\0\24\0\26\0\2607\30\0\6@\14\0\1\0\0\0\310Z\374wD4\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00797   412   NtReadVirtualMemory  (88, 0x183870, 76, ...  (88, 0x183870, 76, ... "\309\30\0\3207\30\0 9\30\0\3307\30\0\220=\30\0H<\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0(8\30\0\24\0\26\0P8\30\0\6@\14\0\1\0\0\0\300Z\374w\3041\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00798   412   NtReadVirtualMemory  (88, 0x183918, 76, ...  (88, 0x183918, 76, ... "\2709\30\0p8\30\0\3009\30\0x8\30\0\0;\30\0`:\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\3108\30\0\30\0\32\0\3608\30\0\6@\14\0\1\0\0\0\3649\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00799   412   NtReadVirtualMemory  (88, 0x1839b8, 76, ...  (88, 0x1839b8, 76, ... "P:\30\0\309\30\0X:\30\0 9\30\0`:\30\0\2306\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0p9\30\0\26\0\30\0\2309\30\0\6@\10\0\1\0\0\0\214:\30\0T9\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00800   412   NtReadVirtualMemory  (88, 0x183a50, 76, ...  (88, 0x183a50, 76, ... "\360:\30\0\2709\30\0\370:\30\0\3009\30\0(9\30\0\3109\30\0\0\0\262v<-\262v\0P\1\06\08\0\20:\30\0\16\0\20\08:\30\0\6@\14\0\1\0\0\0`Z\374w\3649\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00801   412   NtReadVirtualMemory  (88, 0x183af0, 76, ...  (88, 0x183af0, 76, ... "\220;\30\0P:\30\0\230;\30\0X:\30\0\240;\30\0(9\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\250:\30\0\26\0\30\0\320:\30\0\6@\14\0\4\0\0\0\34=\30\0,(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00802   412   NtReadVirtualMemory  (88, 0x183b90, 76, ...  (88, 0x183b90, 76, ... "8<\30\0\360:\30\0@<\30\0\370:\30\0H<\30\0\0;\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\1\0\0\0t<\30\0\34*\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00803   412   NtReadVirtualMemory  (88, 0x183c38, 76, ...  (88, 0x183c38, 76, ... "\340<\30\0\220;\30\0\350<\30\0\230;\30\0\2008\30\0\240;\30\0\0\0gv8\25gv\0@\16\0@\0B\0\350;\30\0\30\0\32\0\20<\30\0\6@\10\0\1\0\0\0\374>\30\0\314;\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00804   412   NtReadVirtualMemory  (88, 0x183ce0, 76, ...  (88, 0x183ce0, 76, ... "\200=\30\08<\30\0\210=\30\0@<\30\0\20@\30\00>\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\220<\30\0\30\0\32\0\270<\30\0\6@\14\0\2\0\0\0\274=\30\0,;\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00805   412   NtReadVirtualMemory  (88, 0x183d80, 76, ...  (88, 0x183d80, 76, ... " >\30\0\340<\30\0(>\30\0\350<\30\0\320>\30\0\2008\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\08=\30\0\24\0\26\0`=\30\0\6@\14\0\2\0\0\0\350Z\374w\34=\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00806   412   NtReadVirtualMemory  (88, 0x183e20, 76, ...  (88, 0x183e20, 76, ... "\300>\30\0\200=\30\0\310>\30\0\210=\30\0\360<\30\0p?\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\330=\30\0\24\0\26\0\0>\30\0\6@\10\0\2\0\0\0\370Z\374w|0\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00807   412   NtReadVirtualMemory  (88, 0x183ec0, 76, ...  (88, 0x183ec0, 76, ... "`?\30\0 >\30\0h?\30\0(>\30\0p?\30\0\220=\30\0\0\0-w\306@-w\00\6\0>\0@\0x>\30\0\26\0\30\0\240>\30\0\6@\14\0\6\0\0\0<@\30\0t<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00808   412   NtReadVirtualMemory  (88, 0x183f60, 76, ...  (88, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\00>\30\0\320>\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\30?\30\0\22\0\24\0@?\30\0\6@\14\0\2\0\0\0\334@\30\0\2443\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00809   412   NtReadVirtualMemory  (88, 0x184000, 76, ...  (88, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0HA\30\0\360<\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0\360Z\374w\374>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00810   412   NtReadVirtualMemory  (88, 0x1840a0, 76, ...  (88, 0x1840a0, 76, ... "8A\30\0\0@\30\0@A\30\0\10@\30\0\3407\30\0\230B\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00811   412   NtReadVirtualMemory  (88, 0x184138, 76, ...  (88, 0x184138, 76, ... "\340A\30\0\240@\30\0\350A\30\0\250@\30\0\360A\30\0\20@\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\370@\30\0\16\0\20\0 A\30\0\6@\0\0\1\0\0\0\304B\30\0\334@\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00812   412   NtReadVirtualMemory  (88, 0x1841e0, 76, ...  (88, 0x1841e0, 76, ... "\210B\30\08A\30\0\220B\30\0@A\30\08C\30\0HA\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220A\30\0\30\0\32\0\270A\30\0\6@\14\0\1\0\0\0xZ\374wD&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00813   412   NtReadVirtualMemory  (88, 0x184288, 76, ...  (88, 0x184288, 76, ... "(C\30\0\340A\30\00C\30\0\350A\30\0\260@\30\08C\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08B\30\0\30\0\32\0`B\30\0\6@\0\0\1\0\0\0dC\30\0tA\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00814   412   NtReadVirtualMemory  (88, 0x184328, 76, ...  (88, 0x184328, 76, ... "`D\30\0\210B\30\0hD\30\0\220B\30\0\230B\30\0\360A\30\0\0\06v\240\206v\0\360\0\0<\0>\0\340B\30\0\24\0\26\0\10C\30\0\6@\10\0\2\0\0\0\20[\374w\304B\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00815   412   NtReadVirtualMemory  (88, 0x184460, 76, ...  (88, 0x184460, 76, ... "\10E\30\0(C\30\0\20E\30\00C\30\0\30E\30\0\3705\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\200C\30\0\30\0\32\0>D\30\0\4@\14\20\2\0\0\0DE\30\0\2045\30\02\376};\360\35\12\0", 76, ) , 76, ) == 0x0
 00816   412   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\234\36\30\0`D\30\0\244\36\30\0hD\30\0\254\36\30\0pD\30\0\0\04wY\324w\0\260\10\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\4@\14\0\1\0\0\0pZ\374w\234D\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00817   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1392,ParentPid=656,}, 0x0, ) == 0x0
 00818   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00819   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00820   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00821   412   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0p\0o\0o\0l\0s\0v\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00822   412   NtClose  (88, ... ) == 0x0
 00823   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1632, 0}, ... 88, ) == 0x0
 00824   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1632,ParentPid=656,}, 0x0, ) == 0x0
 00825   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00826   412   NtReadVirtualMemory  (88, 0x241ea4, 4, ...  (88, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00827   412   NtReadVirtualMemory  (88, 0x241ec0, 76, ...  (88, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00828   412   NtReadVirtualMemory  (88, 0x241f18, 76, ...  (88, 0x241f18, 76, ... "\300\37$\0\300\36$\0\310\37$\0\310\36$\0\320\37$\0\254\36$\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%$\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00829   412   NtReadVirtualMemory  (88, 0x241fc0, 76, ...  (88, 0x241fc0, 76, ... "` $\0\30\37$\0h $\0 \37$\0p $\0(\37$\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37$\0\30\0\32\0\230\37$\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00830   412   NtReadVirtualMemory  (88, 0x242060, 76, ...  (88, 0x242060, 76, ... "\10!$\0\300\37$\0\20!$\0\310\37$\0\270!$\0\320\37$\0\0\04|\237"4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) 4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) == 0x0
 00831   412   NtReadVirtualMemory  (88, 0x242108, 76, ...  (88, 0x242108, 76, ... "\250!$\0` $\0\260!$\0h $\0\370"$\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) $\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00832   412   NtReadVirtualMemory  (88, 0x2421a8, 76, ...  (88, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) $\0\10!$\0P (88, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00833   412   NtReadVirtualMemory  (88, 0x242248, 76, ...  (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\250!$\0\360 (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00834   412   NtReadVirtualMemory  (88, 0x2422e8, 76, ...  (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\220#$\0P (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00835   412   NtReadVirtualMemory  (88, 0x242388, 76, ...  (88, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\00$$\0\360 (88, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) == 0x0
 00836   412   NtReadVirtualMemory  (88, 0x242428, 76, ...  (88, 0x242428, 76, ... "\320$$\0\210#$\0\330$$\0\220#$\0`8$\0\200%$\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$$\0\30\0\32\0\250$$\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00837   412   NtReadVirtualMemory  (88, 0x2424d0, 76, ...  (88, 0x2424d0, 76, ... "p%$\0($$\0x%$\00$$\0\20($\0\230#$\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#$\0\24\0\26\0\10$$\0\6@\10\0"\0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) \0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) == 0x0
 00838   412   NtReadVirtualMemory  (88, 0x242570, 76, ...  (88, 0x242570, 76, ... "\20&$\0\320$$\0\30&$\0\330$$\08$$\0\3002$\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%$\0\24\0\26\0P%$\0\6@\14\0\1\0\0\0<($\0T\37$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00839   412   NtReadVirtualMemory  (88, 0x242610, 76, ...  (88, 0x242610, 76, ... "\270&$\0p%$\0\300&$\0x%$\0\0/$\0x,$\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%$\0\24\0\26\0\360%$\0\6@\14\0\1\0\0\0\146$\0\14%$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00840   412   NtReadVirtualMemory  (88, 0x2426b8, 76, ...  (88, 0x2426b8, 76, ... "X'$\0\20&$\0`'$\0\30&$\00+$\0\220*$\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&$\0\30\0\32\0\220&$\0\6@\14\0\1\0\0\0\224'$\0D!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00841   412   NtReadVirtualMemory  (88, 0x242758, 76, ...  (88, 0x242758, 76, ... "\0($\0\270&$\0\10($\0\300&$\0H)$\0\260($\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'$\0\26\0\30\08'$\0\6@\10\0\1\0\0\0t)$\0\364&$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00842   412   NtReadVirtualMemory  (88, 0x242800, 76, ...  (88, 0x242800, 76, ... "\240($\0X'$\0\250($\0`'$\0\260($\0\340$$\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'$\0\30\0\32\0\330'$\0\6@\14\0\6\0\0\0\310Z\374w\254%$\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00843   412   NtReadVirtualMemory  (88, 0x2428a0, 76, ...  (88, 0x2428a0, 76, ... "8)$\0\0($\0@)$\0\10($\0h'$\0\20($\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X($\0\26\0\30\0\200($\0\6@\10\0\1\0\0\0\214.$\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00844   412   NtReadVirtualMemory  (88, 0x242938, 76, ...  (88, 0x242938, 76, ... "\330)$\0\240($\0\340)$\0\250($\0\350)$\0h'$\0\0\0\262v<-\262v\0P\1\06\08\0\370($\0\16\0\20\0 )$\0\6@\14\0\1\0\0\0`Z\374w\224'$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00845   412   NtReadVirtualMemory  (88, 0x2429d8, 76, ...  (88, 0x2429d8, 76, ... "\200*$\08)$\0\210*$\0@)$\0\220*$\0H)$\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\220)$\0\22\0\24\0\270)$\0\6@\10\0\7\0\0\0\274*$\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00846   412   NtReadVirtualMemory  (88, 0x242a80, 76, ...  (88, 0x242a80, 76, ... " +$\0\330)$\0(+$\0\340)$\0\310&$\0\350)$\0\0\0\22w\360+\23w\0\260\10\0@\0B\00*$\0\30\0\32\0X*$\0\6@\10\0\4\0\0\0\320Z\374w\24*$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00847   412   NtReadVirtualMemory  (88, 0x242b20, 76, ...  (88, 0x242b20, 76, ... "\300+$\0\200*$\0\310+$\0\210*$\0\320+$\0\310&$\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\330*$\0\26\0\30\0\0+$\0\6@\14\0\4\0\0\0L-$\0\344!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00848   412   NtReadVirtualMemory  (88, 0x242bc0, 76, ...  (88, 0x242bc0, 76, ... "h,$\0 +$\0p,$\0(+$\0x,$\00+$\0\0\0\277qp\21\277q\0\20\1\0<\0>\0x+$\0\24\0\26\0\240+$\0\6@\10\0\1\0\0\0\244,$\0\360Z\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00849   412   NtReadVirtualMemory  (88, 0x242c68, 76, ...  (88, 0x242c68, 76, ... "\20-$\0\300+$\0\30-$\0\310+$\0 &$\0\320+$\0\0\0gv8\25gv\0@\16\0@\0B\0\30,$\0\30\0\32\0@,$\0\6@\10\0\1\0\0\0l0$\0\374+$\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00850   412   NtReadVirtualMemory  (88, 0x242d10, 76, ...  (88, 0x242d10, 76, ... "\260-$\0h,$\0\270-$\0p,$\0\2001$\0\240/$\0\0\0\356v(\25\356v\0p\3\0@\0B\0\300,$\0\30\0\32\0\350,$\0\6@\14\0\2\0\0\0\354-$\0\+$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00851   412   NtReadVirtualMemory  (88, 0x242db0, 76, ...  (88, 0x242db0, 76, ... "P.$\0\20-$\0X.$\0\30-$\0@0$\0`.$\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0h-$\0\24\0\26\0\220-$\0\6@\14\0\2\0\0\0\350Z\374wL-$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00852   412   NtReadVirtualMemory  (88, 0x242e50, 76, ...  (88, 0x242e50, 76, ... "\360.$\0\260-$\0\370.$\0\270-$\0\300-$\0\0/$\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\10.$\0\24\0\26\00.$\0\6@\10\0\6\0\0\0,/$\0\334($\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00853   412   NtReadVirtualMemory  (88, 0x242ef0, 76, ...  (88, 0x242ef0, 76, ... "\220/$\0P.$\0\230/$\0X.$\0`.$\0 &$\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\250.$\0\26\0\30\0\320.$\0\6@\14\0\2\0\0\0\141$\0\214.$\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00854   412   NtReadVirtualMemory  (88, 0x242f90, 76, ...  (88, 0x242f90, 76, ... "00$\0\360.$\080$\0\370.$\0 -$\0\3400$\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0H/$\0\24\0\26\0p/$\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00855   412   NtReadVirtualMemory  (88, 0x243030, 76, ...  (88, 0x243030, 76, ... "\3200$\0\220/$\0\3300$\0\230/$\0\3400$\0\300-$\0\0\0-w\306@-w\00\6\0>\0@\0\350/$\0\26\0\30\0\200$\0\6@\14\0\6\0\0\0\2541$\0\244,$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00856   412   NtReadVirtualMemory  (88, 0x2430d0, 76, ...  (88, 0x2430d0, 76, ... "p1$\000$\0x1$\080$\0\240/$\0@0$\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2100$\0\22\0\24\0\2600$\0\6@\14\0\2\0\0\0\3542$\0,/$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00857   412   NtReadVirtualMemory  (88, 0x243170, 76, ...  (88, 0x243170, 76, ... "\202$\0\3200$\0\302$\0\3300$\0 2$\0 -$\0\0\0=w\24 ?w\0@\177\0>\0@\0(1$\0\26\0\30\0P1$\0\6@\10\0\1\0\0\0L2$\0l0$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00858   412   NtReadVirtualMemory  (88, 0x243210, 76, ...  (88, 0x243210, 76, ... "\2602$\0p1$\0\2702$\0x1$\0X3$\0\2001$\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3101$\0\26\0\30\0\3601$\0\6@\14\0\3\0\0\0\360Z\374w\2541$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00859   412   NtReadVirtualMemory  (88, 0x2432b0, 76, ...  (88, 0x2432b0, 76, ... "H3$\0\202$\0P3$\0\302$\0\200%$\0\2106$\0\0\0\332v\33"\333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) == 0x0
 00860   412   NtReadVirtualMemory  (88, 0x243348, 76, ...  (88, 0x243348, 76, ... "\3603$\0\2602$\0\3703$\0\2702$\0\2404$\0 2$\0\0\0\323v\0\0\0\0\0@\0\06\08\0\103$\0\16\0\20\003$\0\6@\0\0\1\0\0\0\2646$\0\3542$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00861   412   NtReadVirtualMemory  (88, 0x2433f0, 76, ...  (88, 0x2433f0, 76, ... "\2204$\0H3$\0\2304$\0P3$\0\3405$\0\2404$\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2403$\0\30\0\32\0\3103$\0\6@\14\0\1\0\0\0\3144$\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00862   412   NtReadVirtualMemory  (88, 0x243490, 76, ...  (88, 0x243490, 76, ... "05$\0\3603$\085$\0\3703$\0\04$\0X3$\0\0\0\362v\317\22\362v\0P\2\0<\0>\0H4$\0\24\0\26\0p4$\0\6@\14\0\1\0\0\0xZ\374w,4$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00863   412   NtReadVirtualMemory  (88, 0x243530, 76, ...  (88, 0x243530, 76, ... "\3205$\0\2204$\0\3305$\0\2304$\0(7$\0\3405$\0\0\0,vN\25,v\0\240\10\0>\0@\0\3504$\0\26\0\30\0\205$\0\6@\10\0\1\0\0\0\2148$\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00864   412   NtReadVirtualMemory  (88, 0x2435d0, 76, ...  (88, 0x2435d0, 76, ... "x6$\005$\0\2006$\085$\0@5$\0\04$\0\0\0*v\\20*v\0\360\0\0<\0>\0\2105$\0\24\0\26\0\2605$\0\6@\14\0\1\0\0\0\300Z\374wL&$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00865   412   NtReadVirtualMemory  (88, 0x243678, 76, ...  (88, 0x243678, 76, ... "\307$\0\3205$\0 7$\0\3305$\0\3002$\0(7$\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0(6$\0\30\0\32\0P6$\0\6@\0\0\1\0\0\0T7$\0\2043$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00866   412   NtReadVirtualMemory  (88, 0x243718, 76, ...  (88, 0x243718, 76, ... "P8$\0x6$\0X8$\0\2006$\0\2106$\0@5$\0\0\06v\240\206v\0\360\0\0<\0>\0\3206$\0\24\0\26\0\3706$\0\6@\10\0\2\0\0\0\20[\374w\2646$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00867   412   NtReadVirtualMemory  (88, 0x243850, 76, ...  (88, 0x243850, 76, ... "\3708$\0\307$\0\09$\0 7$\0\109$\08$$\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0p7$\0\30\0\32\0.8$\0\4@\14\20\2\0\0\049$\0l5$\02\376};\310W\24\0", 76, ) , 76, ) == 0x0
 00868   412   NtReadVirtualMemory  (88, 0x2438f8, 76, ...  (88, 0x2438f8, 76, ... "\2309$\0P8$\0\2409$\0X8$\0\2509$\0`8$\0\0\04wY\324w\0\260\10\0@\0B\0\2508$\0\30\0\32\0\3208$\0\4@\14\0\1\0\0\0pZ\374w\2148$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00869   412   NtReadVirtualMemory  (88, 0x243998, 76, ...  (88, 0x243998, 76, ... "\234\36$\0\3708$\0\244\36$\0\09$\0\254\36$\0\109$\0\0\0\247uM\31\247u\00\12\0>\0@\0P9$\0\26\0\30\0x9$\0\4@\14\0\1\0\0\0\0[\374w\204"$\0\30\376};\0\0\0\0", 76, ) $\0\30\376};\0\0\0\0", 76, ) == 0x0
 00870   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1632,ParentPid=656,}, 0x0, ) == 0x0
 00871   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00872   412   NtReadVirtualMemory  (88, 0x241ea4, 4, ...  (88, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00873   412   NtReadVirtualMemory  (88, 0x241ec0, 76, ...  (88, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00874   412   NtReadVirtualMemory  (88, 0x205b8, 110, ...  (88, 0x205b8, 110, ... "C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0V\0M\0w\0a\0r\0e\0\\0V\0M\0w\0a\0r\0e\0 \0T\0o\0o\0l\0s\0\\0V\0M\0w\0a\0r\0e\0S\0e\0r\0v\0i\0c\0e\0.\0e\0x\0e\0\0\0", 110, ) , 110, ) == 0x0
 00875   412   NtClose  (88, ... ) == 0x0
 00876   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1872, 0}, ... 88, ) == 0x0
 00877   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1872,ParentPid=608,}, 0x0, ) == 0x0
 00878   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00879   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00880   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00881   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00882   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0X"\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00883   412   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\0!\30\0\300\37\30\0\10!\30\0\310\37\30\0\230#\30\0\20!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\14\0\377\377\0\0\254%\30\0\374\36\30\0\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00884   412   NtReadVirtualMemory  (88, 0x182100, 76, ...  (88, 0x182100, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0p \30\0\270!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\270 \30\0\22\0\24\0\340 \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00885   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00886   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00887   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\26\0\30\0\310 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00888   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00889   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\370"\30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) \30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00890   412   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\0\370"\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) \30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) == 0x0
 00891   412   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0(&\30\0\340$\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0(%\30\0\26\0\30\0P%\30\0\4@\10\0\2\0\0\0\0[\374w\234 \30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00892   412   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\4@\14\0\1\0\0\0\360Z\374w\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00893   412   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "\234\36\30\0\30&\30\0\244\36\30\0 &\30\0\254\36\30\0(&\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\4@\14\0\1\0\0\0\310Z\374wT\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00894   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1872,ParentPid=608,}, 0x0, ) == 0x0
 00895   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00896   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00897   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00898   412   NtReadVirtualMemory  (88, 0x20598, 66, ...  (88, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0s\0e\0r\0i\0n\0i\0t\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00899   412   NtClose  (88, ... ) == 0x0
 00900   412   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1924, 0}, ... 88, ) == 0x0
 00901   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1924,ParentPid=1872,}, 0x0, ) == 0x0
 00902   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00903   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00904   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00905   412   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\41\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00906   412   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00907   412   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\264/\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00908   412   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00909   412   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\7\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\7\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00910   412   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00911   412   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00912   412   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00913   412   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\340#\30\0\26\0\30\0\10$\30\0\6@\10\0\377\377\0\0\364&\30\0\304#\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00914   412   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\08$\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0\254%\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00915   412   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\310$\30\0 &\30\0\320$\30\0(&\30\0\330$\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\320Z\374w\4%\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00916   412   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\370u\265*\370u\0\300\17\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\377\377\0\0hZ\374whZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00917   412   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0h'\30\0(&\30\0\0\0\234v=\5\235v\0\220\24\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\6@\14\0\377\377\0\0\24/\30\0d$\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00918   412   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\220(\30\0\270&\30\0\230(\30\0\300&\30\0\240(\30\0\310&\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\377\377\0\0\324-\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00919   412   NtReadVirtualMemory  (88, 0x182890, 76, ...  (88, 0x182890, 76, ... "8)\30\0X'\30\0@)\30\0`'\30\0H)\30\0h'\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\260'\30\0\30\0\32\0n(\30\0\4@\14\20\14\0\0\0t)\30\0pZ\374w2\376};(=\10\0", 76, ) , 76, ) == 0x0
 00920   412   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\330)\30\0\220(\30\0\340)\30\0\230(\30\0\350)\30\0\240(\30\0\0\04wY\324w\0\260\10\0@\0B\0\350(\30\0\30\0\32\0\20)\30\0\4@\14\0\4\0\0\0\264*\30\0\314(\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00921   412   NtReadVirtualMemory  (88, 0x1829d8, 76, ...  (88, 0x1829d8, 76, ... "x*\30\08)\30\0\200*\30\0@)\30\0(+\30\0H)\30\0\0\0\364u\320\21\364u\0\320\1\0>\0@\0\220)\30\0\26\0\30\0\270)\30\0\4@\10\0\1\0\0\0\0\30\0D!\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00922   412   NtReadVirtualMemory  (88, 0x182a78, 76, ...  (88, 0x182a78, 76, ... "\30+\30\0\330)\30\0 +\30\0\340)\30\0\10-\30\0\310+\30\0\0\0\375v%0\375v\0\200\7\0>\0@\00*\30\0\26\0\30\0X*\30\0\4@\14\0\2\0\0\0T+\30\0t)\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00923   412   NtReadVirtualMemory  (88, 0x182b18, 76, ...  (88, 0x182b18, 76, ... "\270+\30\0x*\30\0\300+\30\0\200*\30\0\310+\30\0\350)\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320*\30\0\24\0\26\0\370*\30\0\6@\14\0\2\0\0\0\224,\30\0\264*\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00924   412   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0\210*\30\0(+\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0p+\30\0\26\0\30\0\230+\30\0\6@\10\0\3\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00925   412   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\370,\30\0\270+\30\0\0-\30\0\300+\30\0\350.\30\0\10-\30\0\0\0bv\316\26bv\0\340\4\0:\0<\0\20,\30\0\22\0\24\08,\30\0\4@\14\0\1\0\0\04-\30\0T+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00926   412   NtReadVirtualMemory  (88, 0x182cf8, 76, ...  (88, 0x182cf8, 76, ... "8.\30\0X,\30\0@.\30\0`,\30\0h,\30\0\210*\30\0\0\0`v\20\22`v\0\260\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\6@\10\0\1\0\0\0t5\30\0\224,\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00927   412   NtReadVirtualMemory  (88, 0x182e38, 76, ...  (88, 0x182e38, 76, ... "\330.\30\0\370,\30\0\340.\30\0\0-\30\0\250-\30\0\210/\30\0\0\0c[\237qd[\0\0\7\0>\0@\0\360-\30\0\26\0\30\0\30.\30\0\4@\14\0\1\0\0\0\304B\30\0\370Z\374w\267\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00928   412   NtReadVirtualMemory  (88, 0x182ed8, 76, ...  (88, 0x182ed8, 76, ... "x/\30\08.\30\0\200/\30\0@.\30\0\210/\30\0h,\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\220.\30\0\26\0\30\0\270.\30\0\6@\14\0\6\0\0\0\2441\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00929   412   NtReadVirtualMemory  (88, 0x182f78, 76, ...  (88, 0x182f78, 76, ... "\230-\30\0\330.\30\0\240-\30\0\340.\30\0H.\30\0\350.\30\0\0\08v4\208v\0P\0\0>\0@\00/\30\0\26\0\30\0X/\30\0\6@\14\0\1\0\0\0\246\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00930   412   NtReadVirtualMemory  (88, 0x182d98, 76, ...  (88, 0x182d98, 76, ... " 0\30\0x/\30\0(0\30\0\200/\30\000\30\0H.\30\0\0\0\247uM\31\247u\00\12\0>\0@\0P-\30\0\26\0\30\0x-\30\0\4@\14\0\4\0\0\0\0[\374w\224'\30\0\30\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00931   412   NtReadVirtualMemory  (88, 0x183020, 76, ...  (88, 0x183020, 76, ... "\3100\30\0\230-\30\0\3200\30\0\240-\30\0\3300\30\0\250-\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0\320/\30\0\30\0\32\0\370/\30\0\4@\14\0\1\0\0\0,4\30\0\24*\30\00\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00932   412   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "h1\30\0 0\30\0p1\30\0(0\30\0x1\30\000\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x0\30\0\30\0\32\0\2400\30\0\4@\14\0\13\0\0\0\2243\30\0T\37\30\03\376};(=\10\0", 76, ) , 76, ) == 0x0
 00933   412   NtReadVirtualMemory  (88, 0x183168, 76, ...  (88, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\4@\10\0\2\0\0\0L2\30\0\24/\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00934   412   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0\3102\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\4@\10\0\2\0\0\0\360Z\374w\2441\30\0\25\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00935   412   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0\04\30\0 2\30\0\0\0\230v\264\20\230v\0p\0\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\4@\14\0\1\0\0\0\270Z\374w\270Z\374w\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00936   412   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3603\30\0\2702\30\0\3703\30\0\3002\30\0\3505\30\0\04\30\0\0\0\231v\250\22\231v\0@\2\0>\0@\0\203\30\0\26\0\30\083\30\0\4@\14\0\2\0\0\0\324:\30\0\41\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00937   412   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0h3\30\0\3102\30\0\0\0\262v<-\262v\0P\1\06\08\0\2603\30\0\16\0\20\0\3303\30\0\6@\14\0\3\0\0\0\3747\30\0\0\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00938   412   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\007\30\0\2206\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0H4\30\0\30\0\32\0p4\30\0\4@\14\0\1\0\0\0<9\30\0\20[\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00939   412   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2206\30\0\3505\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\10\0\4\0\0\0\3449\30\04-\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00940   412   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0H5\30\0h3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\5\0\0\0\2348\30\0\264/\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00941   412   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... " 7\30\0\3305\30\0(7\30\0\3405\30\0\2504\30\0H5\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\006\30\0\30\0\32\0X6\30\0\6@\14\0\1\0\0\0\24=\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00942   412   NtReadVirtualMemory  (88, 0x183720, 76, ...  (88, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3207\30\0\2504\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\4@\14\0\1\0\0\0\334@\30\0\344!\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00943   412   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\007\30\0\0\0\353p\240.\353p\0p\0\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\4@\10\0\1\0\0\0\374>\30\0,4\30\0q\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00944   412   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\0\2709\30\0\3207\30\0\0\0_`(;_`\0\320\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\4@\10\0\1\0\0\0T>\30\0\246\30\0\357\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00945   412   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\0;\30\0\2709\30\0\0\0\352t\360\24\352t\0\0\1\0<\0>\0\2708\30\0\24\0\26\0\3408\30\0\4@\10\0\1\0\0\0\314;\30\0\3244\30\0\37\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00946   412   NtReadVirtualMemory  (88, 0x1839a8, 76, ...  (88, 0x1839a8, 76, ... "\230:\30\0\09\30\0\240:\30\0\109\30\0\209\30\0p8\30\0\0\0;v\0\26;v\0P\4\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\6@\14\0\1\0\0\0,;\30\0t5\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00947   412   NtReadVirtualMemory  (88, 0x183a98, 76, ...  (88, 0x183a98, 76, ... "\360:\30\0\2509\30\0\370:\30\0\2609\30\0\254\36\30\0\350<\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0H:\30\0\30\0\32\0p:\30\0\4@\14\0\1\0\0\0\264=\30\0\2243\30\0\27\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00948   412   NtReadVirtualMemory  (88, 0x183af0, 76, ...  (88, 0x183af0, 76, ... "\220;\30\0\230:\30\0\230;\30\0\240:\30\0@<\30\0\209\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\0:\30\0\24\0\26\0(:\30\0\6@\14\0\1\0\0\0pZ\374w\3449\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00949   412   NtReadVirtualMemory  (88, 0x183b90, 76, ...  (88, 0x183b90, 76, ... "0<\30\0\360:\30\08<\30\0\370:\30\0\20@\30\0@<\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\7\0\0\0l<\30\0<9\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00950   412   NtReadVirtualMemory  (88, 0x183c30, 76, ...  (88, 0x183c30, 76, ... "\330<\30\0\220;\30\0\340<\30\0\230;\30\0\240;\30\0\0;\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\350;\30\0\26\0\30\0\20<\30\0\6@\14\0\2\0\0\0<@\30\0\314;\30\02\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00951   412   NtReadVirtualMemory  (88, 0x183cd8, 76, ...  (88, 0x183cd8, 76, ... "x=\30\00<\30\0\200=\30\08<\30\0\250:\30\0\210=\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\210<\30\0\30\0\32\0\260<\30\0\6@\14\0\3\0\0\0\240Z\374w\2746\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00952   412   NtReadVirtualMemory  (88, 0x183d78, 76, ...  (88, 0x183d78, 76, ... "\30>\30\0\330<\30\0 >\30\0\340<\30\0\350<\30\0\330C\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\00=\30\0\24\0\26\0X=\30\0\6@\14\0\1\0\0\0\310Z\374w\324:\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00953   412   NtReadVirtualMemory  (88, 0x183e18, 76, ...  (88, 0x183e18, 76, ... "\300>\30\0x=\30\0\310>\30\0\200=\30\0\370A\30\0\260@\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\320=\30\0\24\0\26\0\370=\30\0\6@\14\0\1\0\0\0\300Z\374w\2348\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00954   412   NtReadVirtualMemory  (88, 0x183ec0, 76, ...  (88, 0x183ec0, 76, ... "`?\30\0\30>\30\0h?\30\0 >\30\0\260@\30\0p?\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0p>\30\0\30\0\32\0\230>\30\0\6@\14\0\1\0\0\0\234?\30\0\3747\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00955   412   NtReadVirtualMemory  (88, 0x183f60, 76, ...  (88, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\0\320>\30\0\20@\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\30?\30\0\26\0\30\0@?\30\0\6@\10\0\1\0\0\0`Z\374w\374>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00956   412   NtReadVirtualMemory  (88, 0x184000, 76, ...  (88, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0p?\30\0\240;\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0dC\30\0l<\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00957   412   NtReadVirtualMemory  (88, 0x1840a0, 76, ...  (88, 0x1840a0, 76, ... "HA\30\0\0@\30\0PA\30\0\10@\30\0(>\30\0\320>\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0X@\30\0\26\0\30\0\200@\30\0\6@\14\0\4\0\0\0\204A\30\0\7\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00958   412   NtReadVirtualMemory  (88, 0x184148, 76, ...  (88, 0x184148, 76, ... "\350A\30\0\240@\30\0\360A\30\0\250@\30\0pD\30\0\230B\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\370@\30\0\30\0\32\0 A\30\0\6@\14\0\2\0\0\0$B\30\0\334@\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00959   412   NtReadVirtualMemory  (88, 0x1841e8, 76, ...  (88, 0x1841e8, 76, ... "\210B\30\0HA\30\0\220B\30\0PA\30\08C\30\0(>\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\240A\30\0\24\0\26\0\310A\30\0\6@\14\0\2\0\0\0\350Z\374w\204A\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00960   412   NtReadVirtualMemory  (88, 0x184288, 76, ...  (88, 0x184288, 76, ... "(C\30\0\350A\30\00C\30\0\360A\30\0XA\30\08C\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0@B\30\0\24\0\26\0hB\30\0\6@\10\0\2\0\0\0\370Z\374wt.\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00961   412   NtReadVirtualMemory  (88, 0x184328, 76, ...  (88, 0x184328, 76, ... "\310C\30\0\210B\30\0\320C\30\0\220B\30\0\230B\30\0\370A\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\340B\30\0\22\0\24\0\10C\30\0\6@\14\0\2\0\0\0\4D\30\0<@\30\0\23\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00962   412   NtReadVirtualMemory  (88, 0x1843c8, 76, ...  (88, 0x1843c8, 76, ... "`D\30\0(C\30\0hD\30\00C\30\0\210=\30\0`F\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\200C\30\0\24\0\26\0\250C\30\0\6@\14\0\1\0\0\0\234D\30\0dC\30\0\21\376};\330Z\10\0", 76, ) \333v\0\0\3\0<\0>\0\200C\30\0\24\0\26\0\250C\30\0\6@\14\0\1\0\0\0\234D\30\0dC\30\0\21\376};\330Z\10\0", 76, ) == 0x0
 00963   412   NtReadVirtualMemory  (88, 0x184460, 76, ...  (88, 0x184460, 76, ... "\10E\30\0\310C\30\0\20E\30\0\320C\30\0\270E\30\0XA\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0 D\30\0\16\0\20\0HD\30\0\6@\0\0\1\0\0\0\214F\30\0\4D\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00964   412   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\250E\30\0`D\30\0\260E\30\0hD\30\0\0G\30\0\270E\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\6@\14\0\1\0\0\0\344E\30\0xZ\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00965   412   NtReadVirtualMemory  (88, 0x1845a8, 76, ...  (88, 0x1845a8, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0\30E\30\0pD\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0`E\30\0\24\0\26\0\210E\30\0\6@\14\0\1\0\0\0xZ\374wDE\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00966   412   NtReadVirtualMemory  (88, 0x184650, 76, ...  (88, 0x184650, 76, ... "\360F\30\0\250E\30\0\370F\30\0\260E\30\0\330C\30\0\0G\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\0F\30\0\30\0\32\0(F\30\0\6@\0\0\1\0\0\0,G\30\0\234D\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00967   412   NtReadVirtualMemory  (88, 0x1846f0, 76, ...  (88, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0`F\30\0\30E\30\0\0\06v\240\206v\0\360\0\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\6@\10\0\2\0\0\0\20[\374w\214F\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00968   412   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1924,ParentPid=1872,}, 0x0, ) == 0x0
 00969   412   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00970   412   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00971   412   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00972   412   NtReadVirtualMemory  (88, 0x20584, 48, ...  (88, 0x20584, 48, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0E\0x\0p\0l\0o\0r\0e\0r\0.\0E\0X\0E\0\0\0", 48, ) , 48, ) == 0x0
 00973   412   NtOpenProcess  (0x1f0fff, {24, 0, 0x0, 0, 0, 0x0}, {1924, 0}, ... 92, ) == 0x0
 00974   412   NtCreateSection  (0xf0007, 0x0, {36864, 0}, 4, 134217728, 0, ... 96, ) == 0x0
 00975   412   NtMapViewOfSection  (96, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x830000), {0, 0}, 36864, ) == 0x0
 00976   412   NtMapViewOfSection  (96, 92, (0x0), 0, 0, 0x0, 36864, 1, 0, 4, ... (0xf30000), 0x0, 36864, ) == 0x0
 00977   412   NtAllocateVirtualMemory  (92, 0, 0, 1048576, 8192, 4, ... 20578304, 1048576, ) == 0x0
 00978   412   NtAllocateVirtualMemory  (92, 21618688, 0, 8192, 4096, 4, ... 21618688, 8192, ) == 0x0
 00979   412   NtProtectVirtualMemory  (92, (0x149e000), 4096, 260, ... (0x149e000), 4096, 4, ) == 0x0
 00980   412   NtCreateThread  (0x1f03ff, 0x0, 92, 1243172, 1243888, 1, ... 100, {1924, 556}, ) == 0x0
 00981   412   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400}  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0\204\7\0\0,\2\0\0" ... {28, 56, reply, 0, 404, 412, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0\204\7\0\0,\2\0\0" )  ... {28, 56, reply, 0, 404, 412, 1517, 0}  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0\204\7\0\0,\2\0\0" ... {28, 56, reply, 0, 404, 412, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0\204\7\0\0,\2\0\0" )  ) == 0x0
 00982   412   NtResumeThread  (100, ... 1, ) == 0x0
 00983   412   NtClose  (100, ... ) == 0x0
 00984   412   NtUnmapViewOfSection  (-1, 0x830000, ... ) == 0x0
 00985   412   NtClose  (96, ... ) == 0x0
 00986   412   NtClose  (92, ... ) == 0x0
 00987   412   NtTerminateProcess  (0, 0, ... ) == 0x0
 00988   412   NtFreeVirtualMemory  (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED
 00989   412   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 404, 412, 1518, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 404, 412, 1518, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 404, 412, 1518, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00990   412   NtTerminateProcess  (-1, 0, ...
 00991   412   NtClose  (44, ... ) == 0x0