Summary:


NtCallbackReturn(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtRequestWaitReplyPort(>) 
 5 

NtCreateFile(>) 
 1 
NtResumeThread(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtCreateEvent(>) 
 6 

NtCreateThread(>) 
 1 
NtSecureConnectPort(>) 
 1 
NtQuerySection(>) 
 2 
NtProtectVirtualMemory(>) 
 7 

NtGdiCreateBitmap(>) 
 1 
NtTestAlert(>) 
 1 
NtQueryVirtualMemory(>) 
 2 
NtQuerySystemInformation(>) 
 9 

NtGdiInit(>) 
 1 
NtUnmapViewOfSection(>) 
 1 
NtSetInformationFile(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserCallNoParam(>) 
 1 
NtSetInformationObject(>) 
 2 
NtOpenSection(>) 
 12 

NtGdiSelectBitmap(>) 
 1 
NtUserGetThreadDesktop(>) 
 1 
NtTerminateProcess(>) 
 2 
NtQueryValueKey(>) 
 12 

NtOpenDirectoryObject(>) 
 1 
NtWriteFile(>) 
 1 
NtCreateSection(>) 
 3 
NtMapViewOfSection(>) 
 13 

NtOpenKeyedEvent(>) 
 1 
NtContinue(>) 
 2 
NtDuplicateObject(>) 
 3 
NtOpenProcess(>) 
 15 

NtOpenMutant(>) 
 1 
NtCreateIoCompletion(>) 
 2 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserRegisterClassExWOW(>) 
 15 

NtOpenSymbolicLinkObject(>) 
 1 
NtFlushInstructionCache(>) 
 2 
NtOpenProcessToken(>) 
 3 
NtAllocateVirtualMemory(>) 
 18 

NtQueryObject(>) 
 1 
NtFreeVirtualMemory(>) 
 2 
NtSetInformationThread(>) 
 3 
NtOpenKey(>) 
 21 

NtQuerySymbolicLinkObject(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFsControlFile(>) 
 4 
NtQueryInformationProcess(>) 
 29 

NtQuerySystemTime(>) 
 1 
NtOpenFile(>) 
 2 
NtQueryAttributesFile(>) 
 4 
NtClose(>) 
 48 

NtQueryVolumeInformationFile(>) 
 1 
NtOpenProcessTokenEx(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtReadVirtualMemory(>) 
 689 

NtReadFile(>) 
 1 
NtOpenThreadToken(>) 
 2 
NtQueryInformationToken(>) 
 5 

Trace:
 00001   396   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   396   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   396   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   396   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   396   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   396   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   396   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   396   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   396   NtClose  (12, ... ) == 0x0
 00014   396   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   396   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   396   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   396   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   396   NtClose  (16, ... ) == 0x0
 00021   396   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   396   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   396   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   396   NtClose  (16, ... ) == 0x0
 00026   396   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   396   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   396   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   396   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 392, 396, 1482, 0} "0\3\30\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 392, 396, 1482, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 392, 396, 1482, 0} "0\3\30\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   396   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   396   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   396   NtClose  (16, ... ) == 0x0
 00036   396   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   396   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   396   NtClose  (28, ... ) == 0x0
 00041   396   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   396   NtClose  (28, ... ) == 0x0
 00045   396   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   396   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   396   NtClose  (28, ... ) == 0x0
 00049   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   396   NtClose  (28, ... ) == 0x0
 00052   396   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 392, 396, 1486, 0} "\200\324\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 392, 396, 1486, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 392, 396, 1486, 0} "\200\324\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   396   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 8, ) == 0x0
 00057   396   NtProtectVirtualMemory  (-1, (0x408000), 4096, 8, ... (0x408000), 4096, 4, ) == 0x0
 00058   396   NtFlushInstructionCache  (-1, 4227072, 4096, ... ) == 0x0
 00059   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00061   396   NtClose  (28, ... ) == 0x0
 00062   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   396   NtClose  (28, ... ) == 0x0
 00065   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00067   396   NtClose  (28, ... ) == 0x0
 00068   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00070   396   NtClose  (28, ... ) == 0x0
 00071   396   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 4, ) == 0x0
 00072   396   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 4, ) == 0x0
 00073   396   NtFlushInstructionCache  (-1, 4227072, 4096, ... ) == 0x0
 00074   396   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00075   396   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00076   396   NtClose  (28, ... ) == 0x0
 00077   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00078   396   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00079   396   NtClose  (28, ... ) == 0x0
 00080   396   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00081   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00082   396   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00083   396   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00084   396   NtClose  (28, ... ) == 0x0
 00085   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00086   396   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087   396   NtClose  (28, ... ) == 0x0
 00088   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00089   396   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00090   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00092   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 392, 396, 1488, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 392, 396, 1488, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 392, 396, 1488, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00093   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094   396   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00095   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00096   396   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00097   396   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482040, ) == 0x0
 00098   396   NtQueryInformationToken  (-2147482040, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00099   396   NtQueryInformationToken  (-2147482040, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00100   396   NtClose  (-2147482040, ... ) == 0x0
 00101   396   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00102   396   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00103   396   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00104   396   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482040, ) }, ... -2147482040, ) == 0x0
 00105   396   NtQueryValueKey  (-2147482040,  (-2147482040, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00106   396   NtClose  (-2147482040, ... ) == 0x0
 00107   396   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482040, ) }, ... -2147482040, ) == 0x0
 00108   396   NtQueryValueKey  (-2147482040,  (-2147482040, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00109   396   NtClose  (-2147482040, ... ) == 0x0
 00110   396   NtQueryDefaultLocale  (0, -104158708, ... ) == 0x0
 00111   396   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00112   396   NtUserCallNoParam  (24, ... ) == 0x0
 00113   396   NtGdiCreateCompatibleDC  (0, ...
 00114   396   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00113   396   NtGdiCreateCompatibleDC  ... ) == 0x1201032a
 00115   396   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00116   396   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00117   396   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x13050404
 00118   396   NtGdiCreateSolidBrush  (0, 0, ...
 00119   396   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8519680, 4096, ) == 0x0
 00118   396   NtGdiCreateSolidBrush  ... ) == 0xe10040a
 00120   396   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00121   396   NtGdiCreateCompatibleDC  (0, ... ) == 0x70010383
 00122   396   NtGdiSelectBitmap  (1879114627, 319095812, ... ) == 0x185000f
 00123   396   NtUserGetThreadDesktop  (396, 0, ... ) == 0x2c
 00124   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00125   396   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00126   396   NtClose  (52, ... ) == 0x0
 00127   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00128   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810ec017
 00129   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00130   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810ec01c
 00131   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00132   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810ec01e
 00133   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00134   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810e8002
 00135   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00136   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810ec018
 00137   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00138   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810ec01a
 00139   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00140   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810ec01d
 00141   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00143   396   NtAllocateVirtualMemory  (-1, 5468160, 0, 4096, 4096, 32, ... 5468160, 4096, ) == 0x0
 00142   396   NtUserRegisterClassExWOW  ... ) == 0x810ec026
 00144   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00145   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810ec019
 00146   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec020
 00147   396   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810ec022
 00148   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec023
 00149   396   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810ec024
 00150   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec025
 00151   396   NtCallbackReturn  (0, 0, 0, ...
 00152   396   NtGdiInit  (... ) == 0x1
 00153   396   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00154   396   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00155   396   NtTestAlert  (... ) == 0x0
 00156   396   NtContinue  (1244464, 1, ...
 00157   396   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x407210,}, 4, ... ) == 0x0
 00158   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00159   396   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00160   396   NtClose  (52, ... ) == 0x0
 00161   396   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0
 00162   396   NtProtectVirtualMemory  (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0
 00163   396   NtOpenProcessToken  (-1, 0x20, ... 52, ) == 0x0
 00164   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00165   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00166   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 56, ) }, ... 56, ) == 0x0
 00167   396   NtQueryValueKey  (56,  (56, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00168   396   NtClose  (56, ... ) == 0x0
 00169   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00170   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 56, ) == 0x0
 00171   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00172   396   NtQuerySystemTime  (... {-139069492, 29873151}, ) == 0x0
 00173   396   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00174   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00175   396   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00176   396   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00177   396   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00178   396   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00179   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00180   396   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00181   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 76, ) }, ... 76, ) == 0x0
 00182   396   NtOpenKey  (0x20019, {24, 76, 0x40, 0, 0,  (0x20019, {24, 76, 0x40, 0, 0, "ActiveComputerName"}, ... 80, ) }, ... 80, ) == 0x0
 00183   396   NtQueryValueKey  (80,  (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00184   396   NtClose  (80, ... ) == 0x0
 00185   396   NtClose  (76, ... ) == 0x0
 00186   396   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 76, ) == 0x0
 00187   396   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 80, ) == 0x0
 00188   396   NtDuplicateObject  (-1, 76, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00189   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00190   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 88, ) == 0x0
 00191   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00192   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00193   396   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00194   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242964,  (0xc0100080, {24, 0, 0x40, 0, 1242964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 92, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 92, {status=0x0, info=1}, ) == 0x0
 00195   396   NtSetInformationFile  (92, 1243020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00196   396   NtSetInformationFile  (92, 1243012, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00197   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00198   396   NtWriteFile  (92, 69, 0, 0,  (92, 69, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00199   396   NtReadFile  (92, 69, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (92, 69, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\373\33\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00200   396   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\373\33\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\373\33\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00201   396   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0\265\204`2\363?\334\21\261\310\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\265\204`2\363?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 88, 1024, ... {status=0x103, info=48},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0\265\204`2\363?\334\21\261\310\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\265\204`2\363?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 00202   396   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\265\204`2\363?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , 44, 1024, ... {status=0x103, info=36},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\265\204`2\363?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , ) == 0x103
 00203   396   NtClose  (88, ... ) == 0x0
 00204   396   NtClose  (92, ... ) == 0x0
 00205   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "psapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00206   396   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00207   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\psapi.dll"}, 1237828, ... ) }, 1237828, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00208   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "psapi.dll"}, 1237828, ... ) }, 1237828, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00209   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 1237828, ... ) }, 1237828, ... ) == 0x0
 00210   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00211   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00212   396   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00213   396   NtOpenProcessToken  (-1, 0x8, ... 96, ) == 0x0
 00214   396   NtQueryInformationToken  (96, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00215   396   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00216   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 100, ) }, ... 100, ) == 0x0
 00217   396   NtQueryValueKey  (100,  (100, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (100, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00218   396   NtClose  (100, ... ) == 0x0
 00219   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00220   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00221   396   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00222   396   NtClose  (100, ... ) == 0x0
 00223   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224   396   NtClose  (96, ... ) == 0x0
 00225   396   NtClose  (92, ... ) == 0x0
 00226   396   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bf0000), 0x0, 45056, ) == 0x0
 00227   396   NtClose  (88, ... ) == 0x0
 00228   396   NtAllocateVirtualMemory  (-1, 1335296, 0, 36864, 4096, 4, ... 1335296, 36864, ) == 0x0
 00229   396   NtQuerySystemInformation  (ProcessesAndThreads, 32768, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00230   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {4, 0}, ... 88, ) == 0x0
 00231   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x0,AffinityMask=0x1,BasePriority=8,Pid=4,ParentPid=0,}, 0x0, ) == 0x0
 00232   396   NtReadVirtualMemory  (88, 0xc, 4, ...
 00233   396   NtContinue  (-104162148, 0, ...
 00232   396   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00234   396   NtClose  (88, ... ) == 0x0
 00235   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {356, 0}, ... 88, ) == 0x0
 00236   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00237   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00238   396   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00239   396   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00240   396   NtReadVirtualMemory  (88, 0x261f18, 76, ...  (88, 0x261f18, 76, ... "\234\36&\0\300\36&\0\244\36&\0\310\36&\0\254\36&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00241   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00242   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00243   396   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00244   396   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00245   396   NtReadVirtualMemory  (88, 0x1106a0, 60, ...  (88, 0x1106a0, 60, ... "\\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0m\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00246   396   NtClose  (88, ... ) == 0x0
 00247   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {592, 0}, ... 88, ) == 0x0
 00248   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 00249   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00250   396   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00251   396   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00252   396   NtReadVirtualMemory  (88, 0x261f18, 76, ...  (88, 0x261f18, 76, ... "\270\37&\0\300\36&\0\300\37&\0\310\36&\0\310\37&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\4\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00253   396   NtReadVirtualMemory  (88, 0x261fb8, 76, ...  (88, 0x261fb8, 76, ... "X &\0\30\37&\0` &\0 \37&\0h &\0(\37&\0\0\0\264u\0\0\0\0\0\240\0\0<\0>\0p\37&\0\24\0\26\0\230\37&\0\6@\0\0\377\377\0\0pZ\374w\374\36&\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00254   396   NtReadVirtualMemory  (88, 0x262058, 76, ...  (88, 0x262058, 76, ... "\370 &\0\270\37&\0\0!&\0\300\37&\0P"&\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) &\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) == 0x0
 00255   396   NtReadVirtualMemory  (88, 0x2620f8, 76, ...  (88, 0x2620f8, 76, ... "\230!&\0X &\0\240!&\0` &\0\320$&\0\250!&\0\0\0\266u\0\0\0\0\0`\4\0<\0>\0\260 &\0\24\0\26\0\330 &\0\4@\0\0\2\0\0\0\20[\374w\20[\374w\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00256   396   NtReadVirtualMemory  (88, 0x262198, 76, ...  (88, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\370 &\0H (88, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00257   396   NtReadVirtualMemory  (88, 0x262240, 76, ...  (88, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\230!&\0\350 (88, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00258   396   NtReadVirtualMemory  (88, 0x2622e0, 76, ...  (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\220#&\0H (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\22\0\24\0\300 (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00259   396   NtReadVirtualMemory  (88, 0x262388, 76, ...  (88, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\00$&\0\350 (88, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00260   396   NtReadVirtualMemory  (88, 0x262428, 76, ...  (88, 0x262428, 76, ... "\300$&\0\210#&\0\310$&\0\220#&\0\230#&\0P"&\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00261   396   NtReadVirtualMemory  (88, 0x2624c0, 76, ...  (88, 0x2624c0, 76, ... "\234\36&\0($&\0\244\36&\00$&\0\254\36&\0\10!&\0\0\0\351u\212\23\351u\0\20\12\06\08\0\200$&\0\16\0\20\0\250$&\0\4@\10\0\1\0\0\0\360Z\374w\360Z\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00262   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 00263   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00264   396   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00265   396   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00266   396   NtReadVirtualMemory  (88, 0x110534, 68, ...  (88, 0x110534, 68, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0s\0r\0s\0s\0.\0e\0x\0e\0\0\0", 68, ) , 68, ) == 0x0
 00267   396   NtClose  (88, ... ) == 0x0
 00268   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {616, 0}, ... 88, ) == 0x0
 00269   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 00270   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00271   396   NtReadVirtualMemory  (88, 0x171ea4, 4, ...  (88, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00272   396   NtReadVirtualMemory  (88, 0x171ec0, 76, ...  (88, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00273   396   NtReadVirtualMemory  (88, 0x171f18, 76, ...  (88, 0x171f18, 76, ... "\300\37\27\0\300\36\27\0\310\37\27\0\310\36\27\0\320\37\27\0\254\36\27\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\244%\27\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00274   396   NtReadVirtualMemory  (88, 0x171fc0, 76, ...  (88, 0x171fc0, 76, ... "h \27\0\30\37\27\0p \27\0 \37\27\0\30!\27\0(\37\27\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\27\0\30\0\32\0\230\37\27\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00275   396   NtReadVirtualMemory  (88, 0x172068, 76, ...  (88, 0x172068, 76, ... "\10!\27\0\300\37\27\0\20!\27\0\310\37\27\0X"\27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) \27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00276   396   NtReadVirtualMemory  (88, 0x172108, 76, ...  (88, 0x172108, 76, ... "\250!\27\0h \27\0\260!\27\0p \27\0x \27\0\320\37\27\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \27\0\24\0\26\0\350 \27\0\6@\10\0\377\377\0\0\314(\27\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00277   396   NtReadVirtualMemory  (88, 0x1721a8, 76, ...  (88, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\10!\27\0P (88, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) == 0x0
 00278   396   NtReadVirtualMemory  (88, 0x172248, 76, ...  (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\250!\27\0\360 (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\24\0\26\0( (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00279   396   NtReadVirtualMemory  (88, 0x1722e8, 76, ...  (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\220#\27\0P (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\26\0\30\0\310 (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00280   396   NtReadVirtualMemory  (88, 0x172388, 76, ...  (88, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) \27\00$\27\0\360 (88, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00281   396   NtReadVirtualMemory  (88, 0x172428, 76, ...  (88, 0x172428, 76, ... "\310$\27\0\210#\27\0\320$\27\0\220#\27\0\230#\27\0\270!\27\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\27\0\22\0\24\0\10$\27\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00282   396   NtReadVirtualMemory  (88, 0x1724c8, 76, ...  (88, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) \27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204 (88, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00283   396   NtReadVirtualMemory  (88, 0x172568, 76, ...  (88, 0x172568, 76, ... "\10&\27\0\310$\27\0\20&\27\0\320$\27\0\300&\27\0\370"\27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) \27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) == 0x0
 00284   396   NtReadVirtualMemory  (88, 0x172608, 76, ...  (88, 0x172608, 76, ... "\260&\27\0h%\27\0\270&\27\0p%\27\0\0(\27\0`'\27\0\0\0\223u \22\223u\0\240\0\0>\0@\0\300%\27\0\26\0\30\0\350%\27\0\6@\10\0\377\377\0\0,(\27\0\330Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00285   396   NtReadVirtualMemory  (88, 0x1726b0, 76, ...  (88, 0x1726b0, 76, ... "P'\27\0\10&\27\0X'\27\0\20&\27\0`'\27\0x%\27\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0`&\27\0\30\0\32\0\210&\27\0\6@\14\0\377\377\0\0|?\27\0\244%\27\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00286   396   NtReadVirtualMemory  (88, 0x172750, 76, ...  (88, 0x172750, 76, ... "\360'\27\0\260&\27\0\370'\27\0\270&\27\0\30&\27\0\300&\27\0\0\0\247uM\31\247u\00\12\0>\0@\0\10'\27\0\26\0\30\00'\27\0\6@\14\0\377\377\0\0\3348\27\0\304#\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00287   396   NtReadVirtualMemory  (88, 0x1727f0, 76, ...  (88, 0x1727f0, 76, ... "\220(\27\0P'\27\0\230(\27\0X'\27\0\240(\27\0\30&\27\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\250'\27\0\22\0\24\0\320'\27\0\6@\14\0\377\377\0\0\330Z\374wD&\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00288   396   NtReadVirtualMemory  (88, 0x172890, 76, ...  (88, 0x172890, 76, ... "0)\27\0\360'\27\08)\27\0\370'\27\0@)\27\0\0(\27\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0H(\27\0\24\0\26\0p(\27\0\6@\10\0\377\377\0\0T<\27\0D!\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00289   396   NtReadVirtualMemory  (88, 0x172930, 76, ...  (88, 0x172930, 76, ... "\330)\27\0\220(\27\0\340)\27\0\230(\27\0\350)\27\0\240(\27\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\350(\27\0\26\0\30\0\20)\27\0\6@\14\0\377\377\0\0\24*\27\0\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00290   396   NtReadVirtualMemory  (88, 0x1729d8, 76, ...  (88, 0x1729d8, 76, ... "x*\27\00)\27\0\200*\27\08)\27\0\320+\27\0@)\27\0\0\0gv8\25gv\0@\16\0@\0B\0\210)\27\0\30\0\32\0\260)\27\0\6@\10\0\377\377\0\0\264*\27\0l)\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00291   396   NtReadVirtualMemory  (88, 0x172a78, 76, ...  (88, 0x172a78, 76, ... " +\27\0\330)\27\0(+\27\0\340)\27\0\30-\27\00+\27\0\0\0\306v\355\346\306v\0\220\2\0<\0>\00*\27\0\24\0\26\0X*\27\0\6@\14\0\377\377\0\0d0\27\0\24*\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00292   396   NtReadVirtualMemory  (88, 0x172b20, 76, ...  (88, 0x172b20, 76, ... "\300+\27\0x*\27\0\310+\27\0\200*\27\0\210*\27\0x,\27\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320*\27\0\30\0\32\0\370*\27\0\6@\14\0\377\377\0\0\344-\27\0\374\36\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00293   396   NtReadVirtualMemory  (88, 0x172bc0, 76, ...  (88, 0x172bc0, 76, ... "h,\27\0 +\27\0p,\27\0(+\27\0x,\27\0\350)\27\0\0\0\33wp\10\34w\0\240\21\0:\0<\0x+\27\0\22\0\24\0\240+\27\0\6@\10\0\377\377\0\0L2\27\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00294   396   NtReadVirtualMemory  (88, 0x172c68, 76, ...  (88, 0x172c68, 76, ... "\10-\27\0\300+\27\0\20-\27\0\310+\27\00+\27\0\320+\27\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\30,\27\0\30\0\32\0@,\27\0\6@\14\0\377\377\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00295   396   NtReadVirtualMemory  (88, 0x172d08, 76, ...  (88, 0x172d08, 76, ... "\250-\27\0h,\27\0\260-\27\0p,\27\0\270-\27\0\210*\27\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\300,\27\0\26\0\30\0\350,\27\0\6@\10\0\377\377\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00296   396   NtReadVirtualMemory  (88, 0x172da8, 76, ...  (88, 0x172da8, 76, ... "H.\27\0\10-\27\0P.\27\0\20-\27\0\370.\27\0\30-\27\0\0\06v\240\206v\0\360\0\0<\0>\0`-\27\0\24\0\26\0\210-\27\0\6@\10\0\377\377\0\0\204.\27\0\+\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00297   396   NtReadVirtualMemory  (88, 0x172e48, 76, ...  (88, 0x172e48, 76, ... "\350.\27\0\250-\27\0\360.\27\0\260-\27\0\3300\27\0\370.\27\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\0.\27\0\24\0\26\0(.\27\0\6@\10\0\377\377\0\0$/\27\0\344-\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00298   396   NtReadVirtualMemory  (88, 0x172ee8, 76, ...  (88, 0x172ee8, 76, ... "\210/\27\0H.\27\0\220/\27\0P.\27\0X.\27\0\270-\27\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\240.\27\0\26\0\30\0\310.\27\0\6@\14\0\377\377\0\0\2546\27\0\204.\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00299   396   NtReadVirtualMemory  (88, 0x172f88, 76, ...  (88, 0x172f88, 76, ... "(0\27\0\350.\27\000\27\0\360.\27\0\04\27\0 2\27\0\0\0\227u\31\32\227u\0\20\17\0<\0>\0@/\27\0\24\0\26\0h/\27\0\4@\14\0\2\0\0\0\264;\27\0\4%\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00300   396   NtReadVirtualMemory  (88, 0x173028, 76, ...  (88, 0x173028, 76, ... "\3100\27\0\210/\27\0\3200\27\0\220/\27\0\2001\27\0\3300\27\0\0\0=w\24 ?w\0@\177\0>\0@\0\340/\27\0\26\0\30\0\100\27\0\6@\10\0\21\0\0\0\41\27\0\264*\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00301   396   NtReadVirtualMemory  (88, 0x1730c8, 76, ...  (88, 0x1730c8, 76, ... "p1\27\0(0\27\0x1\27\000\27\080\27\0X.\27\0\0\0-w\306@-w\00\6\0>\0@\0\2000\27\0\26\0\30\0\2500\27\0\6@\14\0\35\0\0\0l5\27\0d0\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00302   396   NtReadVirtualMemory  (88, 0x173170, 76, ...  (88, 0x173170, 76, ... "\202\27\0\3100\27\0\302\27\0\3200\27\0\3102\27\080\27\0\0\04wY\324w\0\260\10\0@\0B\0 1\27\0\30\0\32\0H1\27\0\6@\14\0\10\0\0\0\3642\27\0$#\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00303   396   NtReadVirtualMemory  (88, 0x173210, 76, ...  (88, 0x173210, 76, ... "\2702\27\0p1\27\0\3002\27\0x1\27\0\230/\27\0\3102\27\0\0\0{\37\200F{\37\0\20\3\0<\0>\0\3101\27\0\24\0\26\0\3601\27\0\6@\14\0\2\0\0\0\3144\27\0\374+\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00304   396   NtReadVirtualMemory  (88, 0x1732b8, 76, ...  (88, 0x1732b8, 76, ... "\3603\27\0\202\27\0\3703\27\0\302\27\0 2\27\0\2001\27\0\0\0;v\0\26;v\0P\4\0@\0B\0h2\27\0\30\0\32\0\2202\27\0\6@\14\0\3\0\0\0,4\27\0\2541\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00305   396   NtReadVirtualMemory  (88, 0x1733f0, 76, ...  (88, 0x1733f0, 76, ... "\2204\27\0\2702\27\0\2304\27\0\3002\27\0\2404\27\0\230/\27\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\203\27\0\30\0\32\0\3163\27\0\4@\14\20\3\0\0\0\34:\27\0\3642\27\02\376};\370\254\7\0", 76, ) , 76, ) == 0x0
 00306   396   NtReadVirtualMemory  (88, 0x173490, 76, ...  (88, 0x173490, 76, ... "05\27\0\3603\27\085\27\0\3703\27\0@5\27\0\04\27\0\0\0\205\37\0\0\0\0\0`\1\0>\0@\0H4\27\0\26\0\30\0p4\27\0\4@\0\0\1\0\0\0\374F\27\0L2\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00307   396   NtReadVirtualMemory  (88, 0x173530, 76, ...  (88, 0x173530, 76, ... "\3105\27\0\2204\27\0\3205\27\0\2304\27\0\3305\27\0\2404\27\0\0\0\275vG"\276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) == 0x0
 00308   396   NtReadVirtualMemory  (88, 0x1735c8, 76, ...  (88, 0x1735c8, 76, ... "p6\27\005\27\0x6\27\085\27\0(7\27\0@5\27\0\0\0\273v\0\0\0\0\0@\0\06\08\0\2105\27\0\16\0\20\0\2605\27\0\4@\0\0\2\0\0\0\3747\27\0l5\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00309   396   NtReadVirtualMemory  (88, 0x173670, 76, ...  (88, 0x173670, 76, ... "\307\27\0\3105\27\0 7\27\0\3205\27\0\3207\27\0(7\27\0\0\0=r\240\22=r\0\240\1\0@\0B\0 6\27\0\30\0\32\0H6\27\0\4@\10\0\7\0\0\0T7\27\0$/\27\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00310   396   NtReadVirtualMemory  (88, 0x173718, 76, ...  (88, 0x173718, 76, ... "\3007\27\0p6\27\0\3107\27\0x6\27\0\2006\27\0\3305\27\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\3106\27\0\30\0\32\0\3606\27\0\6@\0\0\7\0\0\0|9\27\0\2546\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00311   396   NtReadVirtualMemory  (88, 0x1737c0, 76, ...  (88, 0x1737c0, 76, ... "\2408\27\0\307\27\0\2508\27\0 7\27\0\2608\27\0\2006\27\0\0\0\351u\212\23\351u\0\20\12\06\08\0\308\27\0\16\0\20\0@8\27\0\4@\10\0\1\0\0\0\224=\27\0\46\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00312   396   NtReadVirtualMemory  (88, 0x1738a0, 76, ...  (88, 0x1738a0, 76, ... "@9\27\0\3007\27\0H9\27\0\3107\27\0P9\27\0\3207\27\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0X8\27\0\26\0\30\0\2008\27\0\4@\10\0\5\0\0\0\0[\374w\214'\27\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00313   396   NtReadVirtualMemory  (88, 0x173940, 76, ...  (88, 0x173940, 76, ... "\3409\27\0\2408\27\0\3509\27\0\2508\27\0\3609\27\0\2608\27\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\3708\27\0\22\0\24\0 9\27\0\4@\14\0\7\0\0\0t:\27\0T7\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00314   396   NtReadVirtualMemory  (88, 0x1739e0, 76, ...  (88, 0x1739e0, 76, ... "8:\27\0@9\27\0@:\27\0H9\27\0\360:\27\0P9\27\0\0\0`v\20\22`v\0\260\1\0<\0>\0\2309\27\0\24\0\26\0\3009\27\0\4@\10\0\3\0\0\04>\27\0,4\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00315   396   NtReadVirtualMemory  (88, 0x173a38, 76, ...  (88, 0x173a38, 76, ... "\340:\27\0\3409\27\0\350:\27\0\3509\27\0(<\27\0\210;\27\0\0\0\225um\25\225u\0\220\1\0@\0B\0p7\27\0\30\0\32\0\2307\27\0\4@\14\0\6\0\0\0\34;\27\0|9\27\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00316   396   NtReadVirtualMemory  (88, 0x173ae0, 76, ...  (88, 0x173ae0, 76, ... "x;\27\08:\27\0\200;\27\0@:\27\0\210;\27\0\3609\27\0\0\0\0s\372\26\0s\00\2\0@\0B\0\220:\27\0\30\0\32\0\270:\27\0\6@\14\0\6\0\0\0\34E\27\0t:\27\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00317   396   NtReadVirtualMemory  (88, 0x173b78, 76, ...  (88, 0x173b78, 76, ... "\30<\27\0\340:\27\0 <\27\0\350:\27\0H:\27\0\360:\27\0\0\0\262q\234\21\262q\0\20\1\06\08\08;\27\0\16\0\20\0`;\27\0\6@\14\0\12\0\0\0\364<\27\0\304/\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00318   396   NtReadVirtualMemory  (88, 0x173c18, 76, ...  (88, 0x173c18, 76, ... "\270<\27\0x;\27\0\300<\27\0\200;\27\0\310<\27\0H:\27\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\320;\27\0\24\0\26\0\370;\27\0\4@\14\0\1\0\0\0\350Z\374w\314(\27\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00319   396   NtReadVirtualMemory  (88, 0x173cb8, 76, ...  (88, 0x173cb8, 76, ... "X=\27\0\30<\27\0`=\27\0 <\27\0h=\27\0(<\27\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0p<\27\0\24\0\26\0\230<\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 00320   396   NtReadVirtualMemory  (88, 0x173d58, 76, ...  (88, 0x173d58, 76, ... "\370=\27\0\270<\27\0\0>\27\0\300<\27\0\10>\27\0\310<\27\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\20=\27\0\24\0\26\08=\27\0\4@\10\0\5\0\0\0\360Z\374w\3747\27\01\376};\200`\10\0", 76, ) , 76, ) == 0x0
 00321   396   NtReadVirtualMemory  (88, 0x173df8, 76, ...  (88, 0x173df8, 76, ... "\240>\27\0X=\27\0\250>\27\0`=\27\0\260>\27\0h=\27\0\0\0bv\316\26bv\0\340\4\0:\0<\0\260=\27\0\22\0\24\0\330=\27\0\4@\14\0\1\0\0\0TF\27\0\34:\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00322   396   NtReadVirtualMemory  (88, 0x173ea0, 76, ...  (88, 0x173ea0, 76, ... "@?\27\0\370=\27\0H?\27\0\0>\27\0\360?\27\0\10>\27\0\0\0\366ux\20\366u\0`\0\0<\0>\0\370>\27\0\24\0\26\0 ?\27\0\4@\14\0\1\0\0\0\374A\27\0xZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00323   396   NtReadVirtualMemory  (88, 0x173f40, 76, ...  (88, 0x173f40, 76, ... "\340?\27\0\240>\27\0\350?\27\0\250>\27\0\320A\27\0\220@\27\0\0\0\301q\12\23\301q\0\320\0\0@\0B\0P>\27\0\30\0\32\0x>\27\0\4@\14\0\1\0\0\0\34@\27\0\354&\27\04\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00324   396   NtReadVirtualMemory  (88, 0x173fe0, 76, ...  (88, 0x173fe0, 76, ... "\200@\27\0@?\27\0\210@\27\0H?\27\00A\27\0\260>\27\0\0\0\315q\6\22\315q\0`\1\0<\0>\0\230?\27\0\24\0\26\0\300?\27\0\6@\14\0\5\0\0\0\274@\27\0|?\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00325   396   NtReadVirtualMemory  (88, 0x174080, 76, ...  (88, 0x174080, 76, ... " A\27\0\340?\27\0(A\27\0\350?\27\0P?\27\00A\27\0\0\0\311qP\26\311q\0\300\3\0<\0>\08@\27\0\24\0\26\0`@\27\0\6@\14\0\2\0\0\0\A\27\0\34@\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00326   396   NtReadVirtualMemory  (88, 0x174120, 76, ...  (88, 0x174120, 76, ... "\300A\27\0\200@\27\0\310A\27\0\210@\27\0\220@\27\0\360?\27\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\330@\27\0\24\0\26\0\0A\27\0\6@\0\0\2\0\0\0\334C\27\0\274@\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00327   396   NtReadVirtualMemory  (88, 0x1741c0, 76, ...  (88, 0x1741c0, 76, ... "`B\27\0 A\27\0hB\27\0(A\27\0pB\27\0P?\27\0\0\0\367uB\21\367u\0\220\0\0>\0@\0xA\27\0\26\0\30\0\240A\27\0\4@\14\0\1\0\0\0xZ\374w\334>\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00328   396   NtReadVirtualMemory  (88, 0x174260, 76, ...  (88, 0x174260, 76, ... "\0C\27\0\300A\27\0\10C\27\0\310A\27\0\260C\27\0\320A\27\0\0\0\0\20\340t\0\20\0\0\2\0:\0<\0\30B\27\0\22\0\24\0@B\27\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374w\340Z\332D\0\0\0\0", 76, ) , 76, ) == 0x0
 00329   396   NtReadVirtualMemory  (88, 0x174300, 76, ...  (88, 0x174300, 76, ... "\240C\27\0`B\27\0\250C\27\0hB\27\0PD\27\0\260C\27\0\0\0\260q>\23\260q\0\360\0\0:\0<\0\270B\27\0\22\0\24\0\340B\27\0\4@\14\0\1\0\0\0\300Z\374w\364<\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00330   396   NtReadVirtualMemory  (88, 0x1743a0, 76, ...  (88, 0x1743a0, 76, ... "@D\27\0\0C\27\0HD\27\0\10C\27\0\20C\27\0pB\27\0\0\0\272qp\27\272q\0\340\4\0<\0>\0XC\27\0\24\0\26\0\200C\27\0\6@\14\0\1\0\0\0|D\27\0\A\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00331   396   NtReadVirtualMemory  (88, 0x174440, 76, ...  (88, 0x174440, 76, ... "\340D\27\0\240C\27\0\350D\27\0\250C\27\0\360D\27\0\20C\27\0\0\0\264q\0\0\0\0\0\300\2\0<\0>\0\370C\27\0\24\0\26\0 D\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 00332   396   NtReadVirtualMemory  (88, 0x1744e0, 76, ...  (88, 0x1744e0, 76, ... "\30F\27\0@D\27\0 F\27\0HD\27\0(F\27\0PD\27\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\230D\27\0\26\0\30\0\300D\27\0\4@\10\0\2\0\0\0\20[\374w\34;\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00333   396   NtReadVirtualMemory  (88, 0x174618, 76, ...  (88, 0x174618, 76, ... "\300F\27\0\340D\27\0\310F\27\0\350D\27\0\320F\27\0\360D\27\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320E\27\0\24\0\26\0\370E\27\0\6@\14\0\2\0\0\0\234G\27\04>\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00334   396   NtReadVirtualMemory  (88, 0x1746c0, 76, ...  (88, 0x1746c0, 76, ... "`G\27\0\30F\27\0hG\27\0 F\27\0pG\27\0(F\27\0\0\0\22w\360+\23w\0\260\10\0@\0B\0pF\27\0\30\0\32\0\230F\27\0\6@\10\0\2\0\0\0\320Z\374w\3144\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00335   396   NtReadVirtualMemory  (88, 0x174760, 76, ...  (88, 0x174760, 76, ... "\0H\27\0\300F\27\0\10H\27\0\310F\27\0\20H\27\0\320F\27\0\0\0\375v%0\375v\0\200\7\0>\0@\0\30G\27\0\26\0\30\0@G\27\0\4@\14\0\2\0\0\0pZ\374wTF\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00336   396   NtReadVirtualMemory  (88, 0x174800, 76, ...  (88, 0x174800, 76, ... "\234\36\27\0`G\27\0\244\36\27\0hG\27\0\254\36\27\0pG\27\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\270G\27\0\26\0\30\0\340G\27\0\4@\14\0\1\0\0\0\310Z\374w|D\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00337   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 00338   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00339   396   NtReadVirtualMemory  (88, 0x171ea4, 4, ...  (88, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00340   396   NtReadVirtualMemory  (88, 0x171ec0, 76, ...  (88, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00341   396   NtReadVirtualMemory  (88, 0x20534, 74, ...  (88, 0x20534, 74, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0l\0o\0g\0o\0n\0.\0e\0x\0e\0\0\0", 74, ) , 74, ) == 0x0
 00342   396   NtClose  (88, ... ) == 0x0
 00343   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {660, 0}, ... 88, ) == 0x0
 00344   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 00345   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00346   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00347   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00348   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00349   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00350   396   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\300Z\374w\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00351   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00352   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00353   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00354   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00355   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00356   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0 &\30\0\330$\30\0\0\0\216u\20\24\216u\0\320\4\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\377\377\377\377\224'\30\0\374\36\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00357   396   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\08$\30\0\230#\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0`Z\374wD!\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00358   396   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0\310&\30\0 &\30\0\0\0\214u\203\27\214u\0\300\1\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\0[\374w\304#\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00359   396   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\200%\30\08$\30\0\0\06v\240\206v\0\360\0\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\10\0\377\377\0\0\334(\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00360   396   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0h'\30\0\200%\30\0\0\0w_5\21w_\0\340\0\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\10\0\377\377\0\0l+\30\0T\37\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00361   396   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0P)\30\0\310&\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\20'\30\0\26\0\30\08'\30\0\4@\14\0\3\0\0\0\360Z\374wd$\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00362   396   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\230*\30\0\360)\30\0\0\0\212u\0\0\0\0\0\360\0\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\4@\0\0\1\0\0\0\200Z\374w\200Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00363   396   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "@)\30\0\0(\30\0H)\30\0\10(\30\0\360)\30\0P)\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0X(\30\0\24\0\26\0\200(\30\0\6@\10\0\1\0\0\0|)\30\0L&\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00364   396   NtReadVirtualMemory  (88, 0x182940, 76, ...  (88, 0x182940, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\260(\30\0h'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\370(\30\0\26\0\30\0 )\30\0\6@\14\0\1\0\0\0\304*\30\0\334(\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00365   396   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0\20(\30\0\260(\30\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\230)\30\0\22\0\24\0\300)\30\0\6@\14\0\1\0\0\0\330Z\374w\330Z\374w\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00366   396   NtReadVirtualMemory  (88, 0x182a88, 76, ...  (88, 0x182a88, 76, ... "0+\30\0\340)\30\08+\30\0\350)\30\0@+\30\0\20(\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08*\30\0\30\0\32\0`*\30\0\4@\0\0\1\0\0\0\20[\374w|)\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00367   396   NtReadVirtualMemory  (88, 0x182b30, 76, ...  (88, 0x182b30, 76, ... "\234\36\30\0\210*\30\0\244\36\30\0\220*\30\0\254\36\30\0\230*\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\340*\30\0\30\0\32\0\10+\30\0\4@\14\0\2\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00368   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 00369   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00370   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00371   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00372   396   NtReadVirtualMemory  (88, 0x20598, 66, ...  (88, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0e\0r\0v\0i\0c\0e\0s\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00373   396   NtClose  (88, ... ) == 0x0
 00374   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {672, 0}, ... 88, ) == 0x0
 00375   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 00376   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00377   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00378   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00379   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\324(\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00380   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\04-\30\0\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00381   396   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00382   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\3144\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00383   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00384   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00385   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) == 0x0
 00386   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00387   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00388   396   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\0(\30\0 &\30\0\0\0Dt\0\0\0\0\0\220\6\0<\0>\0\200$\30\0\24\0\26\0\250$\30\0\6@\0\0\377\377\0\0t)\30\0$#\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00389   396   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0`'\30\0\230#\30\0\0\0yv\7\30yv\0\260\0\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\14\0\377\377\0\0\274;\30\0pZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00390   396   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\260&\30\0p%\30\0\270&\30\0x%\30\0\330$\30\0\300&\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\377\377\0\0\34;\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00391   396   NtReadVirtualMemory  (88, 0x1826b0, 76, ...  (88, 0x1826b0, 76, ... "P'\30\0\20&\30\0X'\30\0\30&\30\0 &\30\0`'\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h&\30\0\24\0\26\0\220&\30\0\6@\10\0\377\377\0\0\214'\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00392   396   NtReadVirtualMemory  (88, 0x182750, 76, ...  (88, 0x182750, 76, ... "\360'\30\0\260&\30\0\370'\30\0\270&\30\0\300&\30\0\200%\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10'\30\0\26\0\30\00'\30\0\6@\14\0\377\377\0\0L+\30\0\354&\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00393   396   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\250(\30\0\330$\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\6@\14\0\377\377\0\0\14*\30\0\204"\30\0\26\376};\0\0\0\0", 76, ) \30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00394   396   NtReadVirtualMemory  (88, 0x182898, 76, ...  (88, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0H)\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\6@\14\0\377\377\0\0\254*\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00395   396   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\320)\30\0\230(\30\0\330)\30\0\240(\30\0\340)\30\0\250(\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\10\0\377\377\0\0t5\30\0\4%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00396   396   NtReadVirtualMemory  (88, 0x1829d0, 76, ...  (88, 0x1829d0, 76, ... "p*\30\08)\30\0x*\30\0@)\30\0 +\30\0H)\30\0\0\0\262q\234\21\262q\0\20\1\06\08\0\220)\30\0\16\0\20\0\270)\30\0\6@\14\0\377\377\0\0\224,\30\0,(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00397   396   NtReadVirtualMemory  (88, 0x182a70, 76, ...  (88, 0x182a70, 76, ... "\20+\30\0\320)\30\0\30+\30\0\330)\30\0\270!\30\0 +\30\0\0\0zv\32\22zv\00\1\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0\377\377\0\0\334-\30\0\324(\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00398   396   NtReadVirtualMemory  (88, 0x182b10, 76, ...  (88, 0x182b10, 76, ... "X,\30\0p*\30\0`,\30\0x*\30\0\200*\30\0\340)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\310*\30\0\26\0\30\0\360*\30\0\6@\10\0\377\377\0\0|.\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00399   396   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\370,\30\0\20+\30\0\0-\30\0\30+\30\0\10-\30\0\270!\30\0\0\0;t\0\0\0\0\0\320\0\0>\0@\0\20,\30\0\26\0\30\08,\30\0\4@\0\0\1\0\0\0\364+\30\0\14*\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00400   396   NtReadVirtualMemory  (88, 0x182cf8, 76, ...  (88, 0x182cf8, 76, ... "\270+\30\0X,\30\0\300+\30\0`,\30\0\310+\30\0h,\30\0\0\0\317q7\177\320q\0@\4\0@\0B\0h+\30\0\30\0\32\0\220+\30\0\4@\14\0\2\0\0\0\260Z\374w\374\37\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00401   396   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "\240-\30\0\370,\30\0\250-\30\0\0-\30\0\360.\30\0\10-\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\4@\0\0\4\0\0\0\34/\30\0\224,\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00402   396   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "@.\30\0\270+\30\0H.\30\0\300+\30\0\260>\30\0P.\30\0\0\0Kt\232\356Kt\00\6\0@\0B\0P-\30\0\30\0\32\0x-\30\0\4@\14\0\2\0\0\0d0\30\0\254*\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00403   396   NtReadVirtualMemory  (88, 0x182e40, 76, ...  (88, 0x182e40, 76, ... "\340.\30\0\240-\30\0\350.\30\0\250-\30\0\260-\30\0x=\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\370-\30\0\26\0\30\0 .\30\0\6@\0\0\2\0\0\0\2348\30\0L+\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00404   396   NtReadVirtualMemory  (88, 0x182ee0, 76, ...  (88, 0x182ee0, 76, ... "\210/\30\0@.\30\0\220/\30\0H.\30\0 2\30\0\310+\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0\230.\30\0\26\0\30\0\300.\30\0\6@\14\0\2\0\0\0\41\30\0\364+\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00405   396   NtReadVirtualMemory  (88, 0x182f88, 76, ...  (88, 0x182f88, 76, ... "(0\30\0\340.\30\000\30\0\350.\30\0x=\30\080\30\0\0\0\326v\326/\326v\0P\1\0@\0B\08/\30\0\30\0\32\0`/\30\0\6@\14\0\11\0\0\0\264B\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00406   396   NtReadVirtualMemory  (88, 0x183028, 76, ...  (88, 0x183028, 76, ... "\3100\30\0\210/\30\0\3200\30\0\220/\30\0\230/\30\0\2609\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\340/\30\0\24\0\26\0\100\30\0\6@\14\0\3\0\0\0\310Z\374w\334-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00407   396   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "p1\30\0(0\30\0x1\30\000\30\0\2206\30\0H5\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\2000\30\0\24\0\26\0\2500\30\0\6@\14\0\3\0\0\0DE\30\0\34/\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00408   396   NtReadVirtualMemory  (88, 0x183170, 76, ...  (88, 0x183170, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0\2404\30\0\04\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0 1\30\0\30\0\32\0H1\30\0\6@\14\0\3\0\0\0L2\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00409   396   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\2702\30\0\360.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\3101\30\0\26\0\30\0\3601\30\0\6@\10\0\3\0\0\0\3442\30\0\2541\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00410   396   NtReadVirtualMemory  (88, 0x1832a8, 76, ...  (88, 0x1832a8, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0X3\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\14\0\3\0\0\0`Z\374wL2\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00411   396   NtReadVirtualMemory  (88, 0x183348, 76, ...  (88, 0x183348, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0\04\30\0\2702\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\03\30\0\22\0\24\0(3\30\0\6@\10\0\25\0\0\0,4\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00412   396   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\2001\30\0X3\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\6@\10\0\15\0\0\0TC\30\0\2043\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00413   396   NtReadVirtualMemory  (88, 0x183490, 76, ...  (88, 0x183490, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\0H5\30\0\2001\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\14\0\12\0\0\0\346\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00414   396   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3405\30\0\2204\30\0\3505\30\0\2304\30\0\3300\30\0\2404\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3504\30\0\30\0\32\0\205\30\0\6@\10\0\4\0\0\0\3747\30\0t)\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00415   396   NtReadVirtualMemory  (88, 0x1835e0, 76, ...  (88, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\209\30\007\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\14\0\4\0\0\0\2746\30\0\3144\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00416   396   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... " 7\30\0\3405\30\0(7\30\0\3505\30\0\3207\30\0\3300\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\14\0\4\0\0\0lA\30\0\346\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00417   396   NtReadVirtualMemory  (88, 0x183720, 76, ...  (88, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3605\30\0p8\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\6@\10\0\4\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00418   396   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\0\2206\30\0\0\0-w\306@-w\00\6\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\6@\14\0\15\0\0\0<9\30\0t5\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00419   396   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\007\30\0\3207\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\308\30\0\22\0\24\0@8\30\0\6@\14\0\4\0\0\0\3349\30\0|.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00420   396   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0H:\30\0\3605\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\4\0\0\0,@\30\0\3747\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00421   396   NtReadVirtualMemory  (88, 0x1839a0, 76, ...  (88, 0x1839a0, 76, ... "8:\30\0\09\30\0@:\30\0\109\30\080\30\08<\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00422   396   NtReadVirtualMemory  (88, 0x183a38, 76, ...  (88, 0x183a38, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\360:\30\0\209\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3709\30\0\16\0\20\0 :\30\0\6@\0\0\3\0\0\0d<\30\0\3349\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00423   396   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\0\220;\30\0H:\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\3\0\0\0,G\30\0L&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00424   396   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0,vN\25,v\0\240\10\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\10\0\6\0\0\0\334>\30\0\254%\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00425   396   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0\2609\30\0\330<\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\0\0\3\0\0\0\4=\30\0t:\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00426   396   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\220;\30\0\0\06v\240\206v\0\360\0\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\10\0\6\0\0\0\314@\30\0d<\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00427   396   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\240>\30\0\310<\30\0\250>\30\0\320<\30\0P.\30\0\230/\30\0\0\0\247uM\31\247u\00\12\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\14\0\6\0\0\0\0[\374w\304#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00428   396   NtReadVirtualMemory  (88, 0x183ea0, 76, ...  (88, 0x183ea0, 76, ... "H?\30\0h=\30\0P?\30\0p=\30\0X?\30\0\260-\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300=\30\0\30\0\32\0~>\30\0\4@\14\20\2\0\0\0\204?\30\0\274;\30\02\376};\20\15\11\0", 76, ) , 76, ) == 0x0
 00429   396   NtReadVirtualMemory  (88, 0x183f48, 76, ...  (88, 0x183f48, 76, ... "\360?\30\0\240>\30\0\370?\30\0\250>\30\0\0@\30\0\260>\30\0\0\04wY\324w\0\260\10\0@\0B\0\370>\30\0\30\0\32\0 ?\30\0\4@\14\0\1\0\0\0pZ\374w\334>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00430   396   NtReadVirtualMemory  (88, 0x183ff0, 76, ...  (88, 0x183ff0, 76, ... "\220@\30\0H?\30\0\230@\30\0P?\30\0\240@\30\0X?\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\240?\30\0\30\0\32\0\310?\30\0\4@\14\0\1\0\0\0\14B\30\0<9\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00431   396   NtReadVirtualMemory  (88, 0x184090, 76, ...  (88, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0\0@\30\0\0\08t\0\0\0\0\0\360\0\0>\0@\0H@\30\0\26\0\30\0p@\30\0\4@\0\0\1\0\0\0\374C\30\0\4=\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00432   396   NtReadVirtualMemory  (88, 0x184130, 76, ...  (88, 0x184130, 76, ... "\320A\30\0\220@\30\0\330A\30\0\230@\30\0\340A\30\0\240@\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\350@\30\0\24\0\26\0\20A\30\0\4@\14\0\1\0\0\0\350Z\374w\2746\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00433   396   NtReadVirtualMemory  (88, 0x1841d0, 76, ...  (88, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\0@A\30\0\0\0At\200\23At\0\320\2\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\4@\10\0\1\0\0\0\360Z\374w,@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00434   396   NtReadVirtualMemory  (88, 0x184278, 76, ...  (88, 0x184278, 76, ... "\30C\30\0\320A\30\0 C\30\0\330A\30\0xD\30\0(C\30\0\0\0>tG\26>t\0p\2\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\240Z\374w\304/\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00435   396   NtReadVirtualMemory  (88, 0x184318, 76, ...  (88, 0x184318, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\210B\30\0\320C\30\0\0\0]t\206\25]t\0p\13\0<\0>\0\320B\30\0\24\0\26\0\370B\30\0\6@\10\0\1\0\0\0\320Z\374w,4\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00436   396   NtReadVirtualMemory  (88, 0x1843c0, 76, ...  (88, 0x1843c0, 76, ... "hD\30\0\30C\30\0pD\30\0 C\30\0(C\30\0\340A\30\0\0\07tP\207t\0\240\0\0@\0B\0pC\30\0\30\0\32\0\230C\30\0\6@\14\0\1\0\0\0\354E\30\0\314@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00437   396   NtReadVirtualMemory  (88, 0x184468, 76, ...  (88, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\210B\30\0\0\0:tP\21:t\0\220\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\14\0\1\0\0\0\214F\30\0\330Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00438   396   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0\300E\30\0xD\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\2\0\0\0\300Z\374w\41\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00439   396   NtReadVirtualMemory  (88, 0x1845b0, 76, ...  (88, 0x1845b0, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0`F\30\0\30E\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\0\20[\374w\374C\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00440   396   NtReadVirtualMemory  (88, 0x184650, 76, ...  (88, 0x184650, 76, ... "\360F\30\0\260E\30\0\370F\30\0\270E\30\0\0G\30\0\300E\30\0\0\0\0\10F\30\0\24\0\26\00F\30\0\4@\14\0\1\0\0\0\330Z\374w\244D\30\0"\376};\270@\13\0", 76, ) \376};\270@\13\0", 76, ) == 0x0
 00441   396   NtReadVirtualMemory  (88, 0x1846f0, 76, ...  (88, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0\254\36\30\0`F\30\0\0\0\372\17\37]\372\17\0\20\2\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\4@\14\0\1\0\0\0xZ\374w\34;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00442   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 00443   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00444   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00445   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00446   396   NtReadVirtualMemory  (88, 0x20598, 60, ...  (88, 0x20598, 60, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0l\0s\0a\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00447   396   NtClose  (88, ... ) == 0x0
 00448   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {844, 0}, ... 88, ) == 0x0
 00449   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=844,ParentPid=660,}, 0x0, ) == 0x0
 00450   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00451   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00452   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00453   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0t)\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00454   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00455   396   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00456   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\344!\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00457   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00458   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00459   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\310 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00460   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\0X (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00461   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0x%\30\0\330$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\04\0\0\0D&\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00462   396   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\08$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00463   396   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "\10&\30\0\310$\30\0\20&\30\0\320$\30\0\270!\30\08$\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0 %\30\0\26\0\30\0H%\30\0\6@\14\0\5\0\0\0\304/\30\0\374\36\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00464   396   NtReadVirtualMemory  (88, 0x182608, 76, ...  (88, 0x182608, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\270!\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\300%\30\0\26\0\30\0\350%\30\0\4@\14\0\1\0\0\0\0[\374wd$\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00465   396   NtReadVirtualMemory  (88, 0x1826a8, 76, ...  (88, 0x1826a8, 76, ... "P'\30\0\10&\30\0X'\30\0\20&\30\0`'\30\0\30&\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\4@\10\0\5\0\0\0\24*\30\0\204"\30\01\376};\0\0\0\0", 76, ) \30\01\376};\0\0\0\0", 76, ) == 0x0
 00466   396   NtReadVirtualMemory  (88, 0x182750, 76, ...  (88, 0x182750, 76, ... "\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0(\30\0\270&\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\0'\30\0\30\0\32\0('\30\0\4@\14\0\1\0\0\0\244,\30\0\304#\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00467   396   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\330+\30\0`'\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\4@\14\0\3\0\0\0\246\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00468   396   NtReadVirtualMemory  (88, 0x182898, 76, ...  (88, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0\2509\30\0H)\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00469   396   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\330)\30\0\230(\30\0\340)\30\0\240(\30\0\250(\30\0\2504\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\14\0\1\0\0\0\4,\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00470   396   NtReadVirtualMemory  (88, 0x1829d8, 76, ...  (88, 0x1829d8, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\2101\30\0@0\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\220)\30\0\24\0\26\0\270)\30\0\6@\14\0\1\0\0\0T7\30\0\344&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00471   396   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\330)\30\0(+\30\0\340)\30\0\370.\30\0X.\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\00*\30\0\30\0\32\0X*\30\0\6@\14\0\1\0\0\0\+\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00472   396   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\20-\30\0x,\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\330*\30\0\26\0\30\0\0+\30\0\6@\10\0\1\0\0\0<-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00473   396   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0x,\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\14\0\6\0\0\0\310Z\374wt)\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00474   396   NtReadVirtualMemory  (88, 0x182c68, 76, ...  (88, 0x182c68, 76, ... "\0-\30\0\310+\30\0\10-\30\0\320+\30\00+\30\0\330+\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\10\0\2\0\0\0\2243\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00475   396   NtReadVirtualMemory  (88, 0x182d00, 76, ...  (88, 0x182d00, 76, ... "\240-\30\0h,\30\0\250-\30\0p,\30\0\260-\30\00+\30\0\0\0\262v<-\262v\0P\1\06\08\0\300,\30\0\16\0\20\0\350,\30\0\6@\14\0\1\0\0\0`Z\374w\+\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00476   396   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0X.\30\0\20-\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0X-\30\0\22\0\24\0\200-\30\0\6@\10\0\13\0\0\0\204.\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00477   396   NtReadVirtualMemory  (88, 0x182e48, 76, ...  (88, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\220*\30\0\260-\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\10\0\6\0\0\0\320Z\374w\334-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00478   396   NtReadVirtualMemory  (88, 0x182ee8, 76, ...  (88, 0x182ee8, 76, ... "\210/\30\0H.\30\0\220/\30\0P.\30\0\230/\30\0\220*\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\14\0\4\0\0\0\241\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00479   396   NtReadVirtualMemory  (88, 0x182f88, 76, ...  (88, 0x182f88, 76, ... "00\30\0\350.\30\080\30\0\360.\30\0@0\30\0\370.\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0@/\30\0\24\0\26\0h/\30\0\6@\10\0\1\0\0\0l0\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00480   396   NtReadVirtualMemory  (88, 0x183030, 76, ...  (88, 0x183030, 76, ... "\3300\30\0\210/\30\0\3400\30\0\220/\30\0\350)\30\0\230/\30\0\0\0gv8\25gv\0@\16\0@\0B\0\340/\30\0\30\0\32\0\100\30\0\6@\10\0\1\0\0\0\3642\30\0\304/\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00481   396   NtReadVirtualMemory  (88, 0x1830d8, 76, ...  (88, 0x1830d8, 76, ... "x1\30\000\30\0\2001\30\080\30\0\104\30\0(2\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2100\30\0\30\0\32\0\2600\30\0\6@\14\0\2\0\0\0\2641\30\0$/\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00482   396   NtReadVirtualMemory  (88, 0x183178, 76, ...  (88, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0\3102\30\0\350)\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\001\30\0\24\0\26\0X1\30\0\6@\14\0\2\0\0\0\304;\30\0\241\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00483   396   NtReadVirtualMemory  (88, 0x183218, 76, ...  (88, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0\3500\30\0h3\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3201\30\0\24\0\26\0\3701\30\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00484   396   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\302\30\0`3\30\0 2\30\0h3\30\0\2101\30\0\0\0-w\306@-w\00\6\0>\0@\0p2\30\0\26\0\30\0\2302\30\0\6@\14\0\6\0\0\044\30\0l0\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00485   396   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0(2\30\0\3102\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\203\30\0\22\0\24\083\30\0\6@\14\0\2\0\0\0\3244\30\0\244,\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00486   396   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0@5\30\0\3500\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2603\30\0\26\0\30\0\3303\30\0\6@\10\0\1\0\0\0\360Z\374w\3642\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00487   396   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "05\30\0\3703\30\085\30\0\04\30\0H)\30\0\3207\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00488   396   NtReadVirtualMemory  (88, 0x183530, 76, ...  (88, 0x183530, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\3505\30\0\104\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3604\30\0\16\0\20\0\305\30\0\6@\0\0\1\0\0\0\3747\30\0\3244\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00489   396   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0(7\30\0@5\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\14\0\1\0\0\0xZ\374w,(\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00490   396   NtReadVirtualMemory  (88, 0x183678, 76, ...  (88, 0x183678, 76, ... "\307\30\0\3305\30\0 7\30\0\3405\30\0p8\30\0(7\30\0\0\0,vN\25,v\0\240\10\0>\0@\006\30\0\26\0\30\0X6\30\0\6@\10\0\1\0\0\0\3249\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00491   396   NtReadVirtualMemory  (88, 0x183718, 76, ...  (88, 0x183718, 76, ... "\3007\30\0x6\30\0\3107\30\0\2006\30\0\2106\30\0\3505\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\300Z\374w\24*\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00492   396   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\2504\30\0p8\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0p7\30\0\30\0\32\0\2307\30\0\6@\0\0\1\0\0\0\2348\30\0l5\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00493   396   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\2309\30\0\3007\30\0\2409\30\0\3107\30\0\3207\30\0\2106\30\0\0\06v\240\206v\0\360\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\6@\10\0\2\0\0\0\34;\30\0\3747\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00494   396   NtReadVirtualMemory  (88, 0x183998, 76, ...  (88, 0x183998, 76, ... "@:\30\0`8\30\0H:\30\0h8\30\0P:\30\0\250(\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\2708\30\0\30\0\32\0v9\30\0\4@\14\20\2\0\0\0|:\30\0\2646\30\02\376};\20g\12\0", 76, ) , 76, ) == 0x0
 00495   396   NtReadVirtualMemory  (88, 0x183a40, 76, ...  (88, 0x183a40, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\360:\30\0\2509\30\0\0\04wY\324w\0\260\10\0@\0B\0\3609\30\0\30\0\32\0\30:\30\0\4@\14\0\1\0\0\0d<\30\0\3249\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00496   396   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\230;\30\0P:\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\230:\30\0\24\0\26\0\300:\30\0\4@\14\0\1\0\0\0\20[\374w\2348\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00497   396   NtReadVirtualMemory  (88, 0x183b88, 76, ...  (88, 0x183b88, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0\374v!\21\374v\0P\0\0@\0B\08;\30\0\30\0\32\0`;\30\0\4@\14\0\1\0\0\0\350Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00498   396   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\254\36\30\0x=\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\340;\30\0\26\0\30\0\10<\30\0\4@\14\0\2\0\0\0\4=\30\0|:\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00499   396   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0\230;\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\14\0\2\0\0\0pZ\374wd<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00500   396   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\234\36\30\0\310<\30\0\244\36\30\0\320<\30\08<\30\0\330<\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\10\0\2\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00501   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=844,ParentPid=660,}, 0x0, ) == 0x0
 00502   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00503   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00504   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00505   396   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00506   396   NtClose  (88, ... ) == 0x0
 00507   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {972, 0}, ... 88, ) == 0x0
 00508   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=972,ParentPid=660,}, 0x0, ) == 0x0
 00509   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00510   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00511   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00512   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364+\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00513   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00514   396   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00515   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\41\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00516   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00517   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00518   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00519   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) == 0x0
 00520   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0(\2\0\0\224,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00521   396   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\0\230#\30\08$\30\0\0\0-w\306@-w\00\6\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0@\0\0\0\244%\30\0\304#\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00522   396   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "\240&\30\0\310$\30\0\250&\30\0\320$\30\0\260&\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0 %\30\0\26\0\30\0H%\30\0\4@\10\0\24\0\0\0\2441\30\0\4%\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00523   396   NtReadVirtualMemory  (88, 0x1826a0, 76, ...  (88, 0x1826a0, 76, ... "H'\30\0h%\30\0P'\30\0p%\30\0X'\30\0x%\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300%\30\0\30\0\32\0~&\30\0\4@\14\20\10\0\0\0\204'\30\0pZ\374w2\376};H\315\10\0", 76, ) , 76, ) == 0x0
 00524   396   NtReadVirtualMemory  (88, 0x182748, 76, ...  (88, 0x182748, 76, ... "\350'\30\0\240&\30\0\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0\04wY\324w\0\260\10\0@\0B\0\370&\30\0\30\0\32\0 '\30\0\4@\14\0\1\0\0\0L7\30\0\334&\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00525   396   NtReadVirtualMemory  (88, 0x1827e8, 76, ...  (88, 0x1827e8, 76, ... "\220(\30\0H'\30\0\230(\30\0P'\30\0\200*\30\0X'\30\0\0\06v\240\206v\0\360\0\0<\0>\0\240'\30\0\24\0\26\0\310'\30\0\4@\10\0#\0\0\0\14*\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00526   396   NtReadVirtualMemory  (88, 0x182890, 76, ...  (88, 0x182890, 76, ... "0)\30\0\350'\30\08)\30\0\360'\30\0\109\30\0(+\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0@(\30\0\30\0\32\0h(\30\0\4@\14\0\17\0\0\0l)\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00527   396   NtReadVirtualMemory  (88, 0x182930, 76, ...  (88, 0x182930, 76, ... "\320)\30\0\220(\30\0\330)\30\0\230(\30\0X.\30\0\340)\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350(\30\0\24\0\26\0\20)\30\0\6@\14\0\21\0\0\0\344N\30\0\314(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00528   396   NtReadVirtualMemory  (88, 0x1829d0, 76, ...  (88, 0x1829d0, 76, ... "p*\30\00)\30\0x*\30\08)\30\0@)\30\0\200*\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210)\30\0\24\0\26\0\260)\30\0\6@\10\0e\0\0\0\254*\30\0$(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00529   396   NtReadVirtualMemory  (88, 0x182a70, 76, ...  (88, 0x182a70, 76, ... "\30+\30\0\320)\30\0 +\30\0\330)\30\0\340)\30\0\370'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0-\0\0\0$/\30\0\14*\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00530   396   NtReadVirtualMemory  (88, 0x182b18, 76, ...  (88, 0x182b18, 76, ... "\270+\30\0p*\30\0\300+\30\0x*\30\0\240(\30\0\310+\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310*\30\0\30\0\32\0\360*\30\0\6@\14\0!\0\0\0\C\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00531   396   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0(+\30\0\3505\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p+\30\0\24\0\26\0\230+\30\0\6@\14\0\15\0\0\0\204.\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00532   396   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\0-\30\0\270+\30\0\10-\30\0\300+\30\0h3\30\0 2\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20,\30\0\24\0\26\08,\30\0\6@\14\0\16\0\0\0\3547\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00533   396   NtReadVirtualMemory  (88, 0x182d00, 76, ...  (88, 0x182d00, 76, ... "\240-\30\0X,\30\0\250-\30\0`,\30\0\3300\30\080\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260,\30\0\30\0\32\0\330,\30\0\6@\14\0\17\0\0\0\334-\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00534   396   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0\220/\30\0\370.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X-\30\0\26\0\30\0\200-\30\0\6@\10\0\17\0\0\0\274/\30\0<-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00535   396   NtReadVirtualMemory  (88, 0x182e48, 76, ...  (88, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\370.\30\0@)\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\14\0_\0\0\0\214?\30\0\364+\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00536   396   NtReadVirtualMemory  (88, 0x182ee8, 76, ...  (88, 0x182ee8, 76, ... "\200/\30\0H.\30\0\210/\30\0P.\30\0\260-\30\0X.\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\10\0\26\0\0\0\3244\30\0\254*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00537   396   NtReadVirtualMemory  (88, 0x182f80, 76, ...  (88, 0x182f80, 76, ... "(0\30\0\350.\30\000\30\0\360.\30\080\30\0\260-\30\0\0\0\262v<-\262v\0P\1\06\08\0@/\30\0\16\0\20\0h/\30\0\6@\14\0\22\0\0\0\244D\30\0\334-\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00538   396   NtReadVirtualMemory  (88, 0x183028, 76, ...  (88, 0x183028, 76, ... "\3100\30\0\200/\30\0\3200\30\0\210/\30\0\20-\30\0\220/\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\330/\30\0\30\0\32\0\00\30\0\6@\10\0r\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00539   396   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "h1\30\0(0\30\0p1\30\000\30\0x1\30\0\20-\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\2000\30\0\26\0\30\0\2500\30\0\6@\14\0*\0\0\0\3642\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00540   396   NtReadVirtualMemory  (88, 0x183168, 76, ...  (88, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\6@\10\0\20\0\0\0L2\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00541   396   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0h,\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\6@\10\0\23\0\0\0t5\30\0\2441\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00542   396   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0H5\30\0\104\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\6@\14\0\17\0\0\0\2243\30\0\41\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00543   396   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\2504\30\0h,\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\203\30\0\24\0\26\083\30\0\6@\14\0\17\0\0\0\3249\30\0\3642\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00544   396   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0\3102\30\0\2504\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\2603\30\0\24\0\26\0\3303\30\0\6@\10\0\16\0\0\0\314J\30\0\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00545   396   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\104\30\0h3\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0P4\30\0\22\0\24\0x4\30\0\6@\14\0\16\0\0\0\246\30\0$/\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00546   396   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2006\30\0\3102\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\14\08\0\0\0\34;\30\0L2\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00547   396   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "p6\30\085\30\0x6\30\0@5\30\0\310+\30\0h8\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00548   396   NtReadVirtualMemory  (88, 0x183670, 76, ...  (88, 0x183670, 76, ... "\207\30\0\3305\30\0\307\30\0\3405\30\0\3007\30\0H5\30\0\0\0\323v\0\0\0\0\0@\0\06\08\006\30\0\16\0\20\0X6\30\0\6@\0\0\14\0\0\0\2248\30\0\246\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00549   396   NtReadVirtualMemory  (88, 0x183710, 76, ...  (88, 0x183710, 76, ... "\2607\30\0p6\30\0\2707\30\0x6\30\0h8\30\0\3007\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3106\30\0\26\0\30\0\3606\30\0\6@\10\0\31\0\0\0,@\30\0\204'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00550   396   NtReadVirtualMemory  (88, 0x1837b0, 76, ...  (88, 0x1837b0, 76, ... "X8\30\0\207\30\0`8\30\0\307\30\0 7\30\0\2006\30\0\0\0*v\\20*v\0\360\0\0<\0>\0h7\30\0\24\0\26\0\2207\30\0\6@\14\0\23\0\0\0\244=\30\0\224,\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00551   396   NtReadVirtualMemory  (88, 0x183858, 76, ...  (88, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\3505\30\0 7\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\108\30\0\30\0\32\008\30\0\6@\0\0\21\0\0\0d<\30\0\2546\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00552   396   NtReadVirtualMemory  (88, 0x1838f8, 76, ...  (88, 0x1838f8, 76, ... "\2309\30\0X8\30\0\2409\30\0`8\30\0\2509\30\0\240(\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\3\0\0\0\274;\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00553   396   NtReadVirtualMemory  (88, 0x183998, 76, ...  (88, 0x183998, 76, ... "8:\30\0\3708\30\0@:\30\0\09\30\0\220;\30\0\109\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0P9\30\0\24\0\26\0x9\30\0\4@\14\0\1\0\0\0t:\30\0\2243\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00554   396   NtReadVirtualMemory  (88, 0x183a38, 76, ...  (88, 0x183a38, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\330<\30\08<\30\0\0\0\361t\1\225\361t\0\0\1\0<\0>\0\3609\30\0\24\0\26\0\30:\30\0\4@\14\0\1\0\0\0\4=\30\0\3249\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00555   396   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\08<\30\0\220;\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\1\0\0\0\24B\30\0t5\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00556   396   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\360:\30\0\2509\30\0\0\0\247uM\31\247u\00\12\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\14\0\14\0\0\0\274c\30\049\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00557   396   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0H:\30\0\360:\30\0\0\0=r\240\22=r\0\240\1\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\10\0\1\0\0\0\354>\30\0\2248\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00558   396   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0H:\30\0\0\0\363t\0\0\0\0\0\300\0\0>\0@\0\200<\30\0\26\0\30\0\250<\30\0\4@\0\0\1\0\0\0\344Z\30\0t:\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00559   396   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\10>\30\0\310<\30\0\20>\30\0\320<\30\0\30>\30\0\330<\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0 =\30\0\24\0\26\0H=\30\0\4@\0\0\1\0\0\0D>\30\0\3547\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00560   396   NtReadVirtualMemory  (88, 0x183e08, 76, ...  (88, 0x183e08, 76, ... "\260>\30\0h=\30\0\270>\30\0p=\30\0\300>\30\0x=\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\6\0\0\0\374C\30\0\244=\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00561   396   NtReadVirtualMemory  (88, 0x183eb0, 76, ...  (88, 0x183eb0, 76, ... "P?\30\0\10>\30\0X?\30\0\20>\30\0`?\30\0\30>\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`>\30\0\30\0\32\0\210>\30\0\4@\14\0\1\0\0\0DE\30\0d<\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00562   396   NtReadVirtualMemory  (88, 0x183f50, 76, ...  (88, 0x183f50, 76, ... "\360?\30\0\260>\30\0\370?\30\0\270>\30\0\240@\30\0\300>\30\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\10?\30\0\26\0\30\00?\30\0\4@\14\0\1\0\0\0\264B\30\0\204.\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00563   396   NtReadVirtualMemory  (88, 0x183ff0, 76, ...  (88, 0x183ff0, 76, ... "\220@\30\0P?\30\0\230@\30\0X?\30\0\210B\30\0@A\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\250?\30\0\26\0\30\0\320?\30\0\4@\14\0\4\0\0\0\314@\30\0L7\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00564   396   NtReadVirtualMemory  (88, 0x184090, 76, ...  (88, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0`?\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0H@\30\0\24\0\26\0p@\30\0\6@\14\0\15\0\0\0\354E\30\0,@\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00565   396   NtReadVirtualMemory  (88, 0x184130, 76, ...  (88, 0x184130, 76, ... "\330A\30\0\220@\30\0\340A\30\0\230@\30\0\0@\30\0\240@\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\350@\30\0\26\0\30\0\20A\30\0\6@\10\0\20\0\0\0\T\30\0\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00566   396   NtReadVirtualMemory  (88, 0x1841d8, 76, ...  (88, 0x1841d8, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\00C\30\0\0\0\35u\335\243\35u\0\220\2\0@\0B\0\210A\30\0\30\0\32\0\260A\30\0\4@\14\0\1\0\0\0lK\30\0\34;\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00567   396   NtReadVirtualMemory  (88, 0x184278, 76, ...  (88, 0x184278, 76, ... " C\30\0\330A\30\0(C\30\0\340A\30\00C\30\0\0@\30\0\0\0zv\32\22zv\00\1\0>\0@\00B\30\0\26\0\30\0XB\30\0\6@\14\0\2\0\0\0|b\30\0\214?\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00568   396   NtReadVirtualMemory  (88, 0x184320, 76, ...  (88, 0x184320, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\350A\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\6@\14\0\3\0\0\0\354_\30\0T+\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00569   396   NtReadVirtualMemory  (88, 0x1843c0, 76, ...  (88, 0x1843c0, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\0xD\30\0\350A\30\0\0\0\365t\10\21\365t\0P\0\0<\0>\0xC\30\0\24\0\26\0\240C\30\0\4@\14\0\1\0\0\0dL\30\0D>\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00570   396   NtReadVirtualMemory  (88, 0x184468, 76, ...  (88, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\320C\30\0\0\0\213p\275#\213p\0\300\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\10\0\1\0\0\0\234U\30\0\274/\30\0>\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00571   396   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0hF\30\0xD\30\0\0\0\27u\0\0\0\0\0\0\2\0<\0>\0\300D\30\0\24\0\26\0\350D\30\0\4@\0\0\1\0\0\0\224F\30\0\354>\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00572   396   NtReadVirtualMemory  (88, 0x1845b0, 76, ...  (88, 0x1845b0, 76, ... "XF\30\0\10E\30\0`F\30\0\20E\30\0\220I\30\0\350H\30\0\0\0\372t~\23\372t\0\0\1\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\04G\30\0\314@\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00573   396   NtReadVirtualMemory  (88, 0x184658, 76, ...  (88, 0x184658, 76, ... "\370F\30\0\260E\30\0\0G\30\0\270E\30\0HH\30\0\30E\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\10F\30\0\30\0\32\00F\30\0\6@\14\0\3\0\0\0tH\30\0DE\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00574   396   NtReadVirtualMemory  (88, 0x1846f8, 76, ...  (88, 0x1846f8, 76, ... "\230G\30\0XF\30\0\240G\30\0`F\30\0\350H\30\0\250G\30\0\0\05u\240\245u\0\0\3\0>\0@\0\260F\30\0\26\0\30\0\330F\30\0\6@\14\0\1\0\0\0\324G\30\0\354E\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00575   396   NtReadVirtualMemory  (88, 0x184798, 76, ...  (88, 0x184798, 76, ... "8H\30\0\370F\30\0@H\30\0\0G\30\0\10G\30\0HH\30\0\0\0Mu$\25Mu\0`\7\0>\0@\0PG\30\0\26\0\30\0xG\30\0\6@\14\0\1\0\0\0\14X\30\04G\30\0\33\376};X\32\13\0", 76, ) , 76, ) == 0x0
 00576   396   NtReadVirtualMemory  (88, 0x184838, 76, ...  (88, 0x184838, 76, ... "\330H\30\0\230G\30\0\340H\30\0\240G\30\0\250G\30\0hF\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\360G\30\0\26\0\30\0\30H\30\0\6@\10\0\4\0\0\0\204O\30\0\224F\30\0\26\376};X\32\13\0", 76, ) , 76, ) == 0x0
 00577   396   NtReadVirtualMemory  (88, 0x1848d8, 76, ...  (88, 0x1848d8, 76, ... "\200I\30\08H\30\0\210I\30\0@H\30\0\300E\30\0\10G\30\0\0\0qi\320\22qi\0\320\17\0:\0<\0\220H\30\0\22\0\24\0\270H\30\0\6@\10\0\1\0\0\0\234M\30\0\200Z\374w\210\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00578   396   NtReadVirtualMemory  (88, 0x184980, 76, ...  (88, 0x184980, 76, ... "\220J\30\0\330H\30\0\230J\30\0\340H\30\0\240J\30\0\300E\30\0\0\0\364t\354!\364t\0\240\0\0^\0b\0\330I\30\0\24\0\30\0"J\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w\35\376};\0\0\0\0", 76, ) J\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w\35\376};\0\0\0\0", 76, ) == 0x0
 00579   396   NtReadVirtualMemory  (88, 0x184a90, 76, ...  (88, 0x184a90, 76, ... "0K\30\0\200I\30\08K\30\0\210I\30\0@K\30\0\220I\30\0\0\0\7u\24\31\7u\0`\1\0<\0>\0HJ\30\0\24\0\26\0pJ\30\0\4@\14\0\1\0\0\0L_\30\044\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00580   396   NtReadVirtualMemory  (88, 0x184b30, 76, ...  (88, 0x184b30, 76, ... "\210K\30\0\220J\30\0\220K\30\0\230J\30\0\230K\30\0\240J\30\0\0\0\32uh\342\32u\0\240\2\0:\0<\0\350J\30\0\22\0\24\0\20K\30\0\4@\14\0\1\0\0\0\304K\30\0\24B\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00581   396   NtReadVirtualMemory  (88, 0x184b88, 76, ...  (88, 0x184b88, 76, ... "(L\30\00K\30\00L\30\08K\30\08L\30\0@K\30\0\0\0\322s\0\0\0\0\0\220\0\0@\0B\00I\30\0\30\0\32\0XI\30\0\4@\0\0\1\0\0\0\4M\30\0lK\30\0$\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00582   396   NtReadVirtualMemory  (88, 0x184c28, 76, ...  (88, 0x184c28, 76, ... "\310L\30\0\210K\30\0\320L\30\0\220K\30\0\330L\30\0\230K\30\0\0\0\366t\0\0\0\0\0\260\0\0<\0>\0\340K\30\0\24\0\26\0\10L\30\0\4@\0\0\1\0\0\0$P\30\0\374C\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00583   396   NtReadVirtualMemory  (88, 0x184cc8, 76, ...  (88, 0x184cc8, 76, ... "`M\30\0(L\30\0hM\30\00L\30\0pM\30\08L\30\0\0\0\11u\0\0\0\0\0p\1\0<\0>\0\200L\30\0\24\0\26\0\250L\30\0\4@\0\0\1\0\0\0\304P\30\0\304K\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00584   396   NtReadVirtualMemory  (88, 0x184d60, 76, ...  (88, 0x184d60, 76, ... "\0N\30\0\310L\30\0\10N\30\0\320L\30\0\20N\30\0\330L\30\0\0\0\267v!\226\271v\0\320\3\04\06\0 M\30\0\14\0\16\0HM\30\0\4@\14\0\3\0\0\0, 76, ) , 76, ) == 0x0
 00585   396   NtReadVirtualMemory  (88, 0x184e00, 76, ...  (88, 0x184e00, 76, ... "\250N\30\0`M\30\0\260N\30\0hM\30\0\270N\30\0pM\30\0\0\0\370tg0\370t\0\200\0\0:\0<\0\270M\30\0\22\0\24\0\340M\30\0\4@\14\0\1\0\0\0Lg\30\0\234M\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00586   396   NtReadVirtualMemory  (88, 0x184ea8, 76, ...  (88, 0x184ea8, 76, ... "HO\30\0\0N\30\0PO\30\0\10N\30\0\370O\30\0\20N\30\0\0\0\371t\0\21\371t\0\220\0\0@\0B\0XN\30\0\30\0\32\0\200N\30\0\4@\10\0\1\0\0\0xZ\374wl)\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00587   396   NtReadVirtualMemory  (88, 0x184f48, 76, ...  (88, 0x184f48, 76, ... "\350O\30\0\250N\30\0\360O\30\0\260N\30\0\230P\30\0\370O\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\0O\30\0\26\0\30\0(O\30\0\4@\0\0\3\0\0\0lQ\30\0tH\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00588   396   NtReadVirtualMemory  (88, 0x184fe8, 76, ...  (88, 0x184fe8, 76, ... "\210P\30\0HO\30\0\220P\30\0PO\30\0XO\30\0\270N\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0\240O\30\0\26\0\30\0\310O\30\0\6@\14\0\3\0\0\0\24R\30\0dL\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00589   396   NtReadVirtualMemory  (88, 0x185088, 76, ...  (88, 0x185088, 76, ... "0Q\30\0\350O\30\08Q\30\0\360O\30\0@Q\30\0XO\30\0\0\0-r\201\22-r\0\300\0\08\0:\0@P\30\0\20\0\22\0hP\30\0\4@\14\0\1\0\0\04V\30\0\4M\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00590   396   NtReadVirtualMemory  (88, 0x185130, 76, ...  (88, 0x185130, 76, ... "\330Q\30\0\210P\30\0\340Q\30\0\220P\30\0\350Q\30\0\230P\30\0\0\0\354t\0\0\0\0\0P\0\0@\0B\0\340P\30\0\30\0\32\0\10Q\30\0\4@\0\0\1\0\0\0\274R\30\0\204O\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00591   396   NtReadVirtualMemory  (88, 0x1851d8, 76, ...  (88, 0x1851d8, 76, ... "\200R\30\00Q\30\0\210R\30\08Q\30\0\220S\30\0@Q\30\0\0\0Lr\3662Lr\0\360\0\0@\0B\0\210Q\30\0\30\0\32\0\260Q\30\0\4@\10\0\1\0\0\0\254X\30\0$P\30\0,\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00592   396   NtReadVirtualMemory  (88, 0x185280, 76, ...  (88, 0x185280, 76, ... "\200S\30\0\330Q\30\0\210S\30\0\340Q\30\0pU\30\00T\30\0\0\0zY7\255zY\0\300\1\0F\0H\00R\30\0\24\0\26\0bR\30\0\4@\14\0\1\0\0\0\274S\30\0lQ\30\0\325\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00593   396   NtReadVirtualMemory  (88, 0x185380, 76, ...  (88, 0x185380, 76, ... " T\30\0\200R\30\0(T\30\0\210R\30\00T\30\0\350Q\30\0\0\0)u\222\217)u\0\200\3\0J\0L\0(S\30\0\30\0\32\0ZS\30\0\6@\14\0\20\0\0\0\374T\30\0\274R\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00594   396   NtReadVirtualMemory  (88, 0x185420, 76, ...  (88, 0x185420, 76, ... "\300T\30\0\200S\30\0\310T\30\0\210S\30\0\220R\30\0\220S\30\0\0\0>u\231s@u\0\200\6\0<\0>\0\330S\30\0\24\0\26\0\0T\30\0\6@\10\0\1\0\0\0\10[\374wlA\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00595   396   NtReadVirtualMemory  (88, 0x1854c0, 76, ...  (88, 0x1854c0, 76, ... "`U\30\0 T\30\0hU\30\0(T\30\0@W\30\0\10V\30\0\0\0\0u\31\222\0u\0\260\1\0>\0@\0xT\30\0\26\0\30\0\240T\30\0\4@\14\0\1\0\0\0LY\30\0\274S\30\0\35\376};\3006\15\0", 76, ) , 76, ) == 0x0
 00596   396   NtReadVirtualMemory  (88, 0x185560, 76, ...  (88, 0x185560, 76, ... "\370U\30\0\300T\30\0\0V\30\0\310T\30\0\250V\30\0\220R\30\0\0\0&u\305H&u\0p\2\0>\0@\0\30U\30\0\26\0\30\0@U\30\0\6@\10\0\1\0\0\0\254]\30\0\244D\30\0\34\376};\3006\15\0", 76, ) , 76, ) == 0x0
 00597   396   NtReadVirtualMemory  (88, 0x1855f8, 76, ...  (88, 0x1855f8, 76, ... "\230V\30\0`U\30\0\240V\30\0hU\30\0\320T\30\0\250V\30\0\0\0\273v\0\0\0\0\0@\0\06\08\0\270U\30\0\16\0\20\0\340U\30\0\6@\0\0\1\0\0\0\324V\30\0\304P\30\0\23\376};\3006\15\0", 76, ) , 76, ) == 0x0
 00598   396   NtReadVirtualMemory  (88, 0x185698, 76, ...  (88, 0x185698, 76, ... "0W\30\0\370U\30\08W\30\0\0V\30\0\10V\30\0pU\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0PV\30\0\24\0\26\0xV\30\0\6@\14\0\2\0\0\0lW\30\04V\30\0\22\376};\3006\15\0", 76, ) , 76, ) == 0x0
 00599   396   NtReadVirtualMemory  (88, 0x185730, 76, ...  (88, 0x185730, 76, ... "\320W\30\0\230V\30\0\330W\30\0\240V\30\0 Y\30\0\320T\30\0\0\0\351u\212\23\351u\0\20\12\06\08\0\360V\30\0\16\0\20\0\30W\30\0\4@\10\0\1\0\0\0\d\30\0\324V\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00600   396   NtReadVirtualMemory  (88, 0x1857d0, 76, ...  (88, 0x1857d0, 76, ... "pX\30\00W\30\0xX\30\08W\30\0`Z\30\0\300Y\30\0\0\0suh"su\0\320\21\0>\0@\0\210W\30\0\26\0\30\0\260W\30\0\4@\14\0\2\0\0\0\354Y\30\0\324G\30\0\31\376};\0\0\0\0", 76, ) su\0\320\21\0>\0@\0\210W\30\0\26\0\30\0\260W\30\0\4@\14\0\2\0\0\0\354Y\30\0\324G\30\0\31\376};\0\0\0\0", 76, ) == 0x0
 00601   396   NtReadVirtualMemory  (88, 0x185870, 76, ...  (88, 0x185870, 76, ... "\20Y\30\0\320W\30\0\30Y\30\0\330W\30\0\300Y\30\0 Y\30\0\0\0\17u@\22\17u\0 \1\0<\0>\0(X\30\0\24\0\26\0PX\30\0\6@\14\0\2\0\0\0\204[\30\0\24R\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00602   396   NtReadVirtualMemory  (88, 0x185910, 76, ...  (88, 0x185910, 76, ... "\260Y\30\0pX\30\0\270Y\30\0xX\30\0\200X\30\0@W\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\0\310X\30\0\26\0\30\0\360X\30\0\6@\0\0\2\0\0\0d\\30\0\374T\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00603   396   NtReadVirtualMemory  (88, 0x1859b0, 76, ...  (88, 0x1859b0, 76, ... "PZ\30\0\20Y\30\0XZ\30\0\30Y\30\0\340W\30\0\200X\30\0\0\0\23u*\24\23u\00\1\0>\0@\0hY\30\0\26\0\30\0\220Y\30\0\6@\14\0\2\0\0\0\214Z\30\0\14X\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00604   396   NtReadVirtualMemory  (88, 0x185a50, 76, ...  (88, 0x185a50, 76, ... "\250Z\30\0\260Y\30\0\260Z\30\0\270Y\30\0\270Z\30\0\340W\30\0\0\0\374t\0\0\0\0\0\0\1\0>\0@\0\10Z\30\0\26\0\30\00Z\30\0\4@\0\0\3\0\0\0\34c\30\0\354Y\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00605   396   NtReadVirtualMemory  (88, 0x185aa8, 76, ...  (88, 0x185aa8, 76, ... "H[\30\0PZ\30\0P[\30\0XZ\30\0X[\30\0`Z\30\0\0\0\13u\320\21\13u\0\20\1\0@\0B\0\330R\30\0\30\0\32\0\0S\30\0\4@\14\0\1\0\0\0T^\30\0\4=\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00606   396   NtReadVirtualMemory  (88, 0x185b48, 76, ...  (88, 0x185b48, 76, ... "(\\30\0\250Z\30\00\\30\0\260Z\30\08\\30\0\270Z\30\0\0\0\15uP\21\15u\0p\1\0<\0>\0\0[\30\0\24\0\26\0([\30\0\4@\10\0\1\0\0\0\254^\30\0\254X\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00607   396   NtReadVirtualMemory  (88, 0x185c28, 76, ...  (88, 0x185c28, 76, ... "\310\\30\0H[\30\0\320\\30\0P[\30\0\330\\30\0X[\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\340[\30\0\24\0\26\0\10\\30\0\4@\14\0\1\0\0\0\254e\30\0LY\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00608   396   NtReadVirtualMemory  (88, 0x185cc8, 76, ...  (88, 0x185cc8, 76, ... "p]\30\0(\\30\0x]\30\00\\30\0\200]\30\08\\30\0\0\0\376t\0\0\0\0\0\360\0\0>\0@\0\200\\30\0\26\0\30\0\250\\30\0\4@\0\0\1\0\0\0hZ\374whZ\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00609   396   NtReadVirtualMemory  (88, 0x185d70, 76, ...  (88, 0x185d70, 76, ... "\30^\30\0\310\\30\0 ^\30\0\320\\30\0(^\30\0\330\\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0 ]\30\0\30\0\32\0H]\30\0\4@\14\0\1\0\0\0\214`\30\0\234U\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00610   396   NtReadVirtualMemory  (88, 0x185e18, 76, ...  (88, 0x185e18, 76, ... "p^\30\0p]\30\0x^\30\0x]\30\0\200^\30\0\200]\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\310]\30\0\30\0\32\0\360]\30\0\4@\14\0\1\0\0\0\324a\30\0\344Z\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00611   396   NtReadVirtualMemory  (88, 0x185e70, 76, ...  (88, 0x185e70, 76, ... "\20_\30\0\30^\30\0\30_\30\0 ^\30\0\300_\30\0(^\30\0\0\0@v:\222@v\0\260\37\06\08\0\240[\30\0\16\0\20\0\310[\30\0\4@\14\0\1\0\0\04a\30\0\204[\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00612   396   NtReadVirtualMemory  (88, 0x185f10, 76, ...  (88, 0x185f10, 76, ... "\260_\30\0p^\30\0\270_\30\0x^\30\0\250a\30\0\10a\30\0\0\0-u\230`-u\0\240\3\0>\0@\0\310^\30\0\26\0\30\0\360^\30\0\4@\14\0\1\0\0\0\370Z\374w\314J\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00613   396   NtReadVirtualMemory  (88, 0x185fb0, 76, ...  (88, 0x185fb0, 76, ... "P`\30\0\20_\30\0X`\30\0\30_\30\0``\30\0\200^\30\0\0\0\367t\0\0\0\0\0P\0\0<\0>\0h_\30\0\24\0\26\0\220_\30\0\6@\0\0\1\0\0\0\240Z\374w\C\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00614   396   NtReadVirtualMemory  (88, 0x186050, 76, ...  (88, 0x186050, 76, ... "\370`\30\0\260_\30\0\0a\30\0\270_\30\0\10a\30\0\300_\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\10`\30\0\22\0\24\00`\30\0\6@\10\0\1\0\0\0`Z\374w\254]\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00615   396   NtReadVirtualMemory  (88, 0x1860f8, 76, ...  (88, 0x1860f8, 76, ... "\230a\30\0P`\30\0\240a\30\0X`\30\0 _\30\0``\30\0\0\0\21u\260Q\21u\0\300\1\0@\0B\0\250`\30\0\30\0\32\0\320`\30\0\6@\14\0\1\0\0\0\300Z\374w\254^\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00616   396   NtReadVirtualMemory  (88, 0x186198, 76, ...  (88, 0x186198, 76, ... "@b\30\0\370`\30\0Hb\30\0\0a\30\0\360b\30\0 _\30\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0Pa\30\0\24\0\26\0xa\30\0\4@\10\0\1\0\0\0\j\30\0T^\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00617   396   NtReadVirtualMemory  (88, 0x186240, 76, ...  (88, 0x186240, 76, ... "\340b\30\0\230a\30\0\350b\30\0\240a\30\00d\30\0\360b\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\360a\30\0\30\0\32\0\30b\30\0\4@\14\0\2\0\0\0dk\30\0\264B\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00618   396   NtReadVirtualMemory  (88, 0x1862e0, 76, ...  (88, 0x1862e0, 76, ... "\200c\30\0@b\30\0\210c\30\0Hb\30\0Pb\30\0\250a\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\230b\30\0\24\0\26\0\300b\30\0\6@\14\0\2\0\0\0pZ\374w\214Z\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00619   396   NtReadVirtualMemory  (88, 0x186380, 76, ...  (88, 0x186380, 76, ... " d\30\0\340b\30\0(d\30\0\350b\30\0\320d\30\00d\30\0\0\0\4u\300\276\4u\0\360\1\08\0:\08c\30\0\20\0\22\0`c\30\0\4@\14\0\1\0\0\0\0[\374w\274;\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00620   396   NtReadVirtualMemory  (88, 0x186420, 76, ...  (88, 0x186420, 76, ... "\300d\30\0\200c\30\0\310d\30\0\210c\30\0\220c\30\0Pb\30\0\0\0\360t\222E\360t\0\240\0\0>\0@\0\330c\30\0\26\0\30\0\0d\30\0\6@\14\0\1\0\0\0\360Z\374wlW\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00621   396   NtReadVirtualMemory  (88, 0x1864c0, 76, ...  (88, 0x1864c0, 76, ... "pe\30\0 d\30\0xe\30\0(d\30\0\200e\30\0\220c\30\0\0\0\210hw:\212h\0\360\3\0>\0@\0xd\30\0\26\0\30\0\240d\30\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374wk\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00622   396   NtReadVirtualMemory  (88, 0x186570, 76, ...  (88, 0x186570, 76, ... "pf\30\0\300d\30\0xf\30\0\310d\30\0 h\30\0\320d\30\0\0\0\357t\14\22\357t\0\240\0\0J\0L\0\30e\30\0\30\0\32\0Je\30\0\4@\14\0\1\0\0\0\254f\30\0d\\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00623   396   NtReadVirtualMemory  (88, 0x186670, 76, ...  (88, 0x186670, 76, ... "\20g\30\0pe\30\0\30g\30\0xe\30\0\320h\30\0 g\30\0\0\0Eu\26\0Ju\0p\7\0J\0L\0\30f\30\0\30\0\32\0Jf\30\0\4@\14\0\1\0\0\0\374h\30\0\254e\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00624   396   NtReadVirtualMemory  (88, 0x186710, 76, ...  (88, 0x186710, 76, ... "\20h\30\0pf\30\0\30h\30\0xf\30\0\200f\30\0 h\30\0\0\01u\0\2713u\0\300\3\0F\0H\0\310e\30\0\24\0\26\0\372e\30\0\6@\14\0\4\0\0\0\200Z\374w, 76, ) , 76, ) == 0x0
 00625   396   NtReadVirtualMemory  (88, 0x186810, 76, ...  (88, 0x186810, 76, ... "\300h\30\0\20g\30\0\310h\30\0\30g\30\0 g\30\0\200e\30\0\0\0iu\317\254mu\0 \11\0J\0L\0\270g\30\0\30\0\32\0\352g\30\0\6@\14\0\10\0\0\0\210Z\374w\210Z\374w\32\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00626   396   NtReadVirtualMemory  (88, 0x1868c0, 76, ...  (88, 0x1868c0, 76, ... "pi\30\0\20h\30\0xi\30\0\30h\30\0\200i\30\0\200f\30\0\0\0\355t\16\246\355t\0\360\0\0H\0J\0hh\30\0\26\0\30\0\232h\30\0\4@\10\0\1\0\0\0\254i\30\0\254f\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00627   396   NtReadVirtualMemory  (88, 0x186970, 76, ...  (88, 0x186970, 76, ... " j\30\0\300h\30\0(j\30\0\310h\30\00j\30\0\320h\30\0\0\0\2u\254\365\2u\0\260\1\0J\0L\0\30i\30\0\30\0\32\0Ji\30\0\4@\14\0\1\0\0\0\14k\30\0\374h\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00628   396   NtReadVirtualMemory  (88, 0x186a20, 76, ...  (88, 0x186a20, 76, ... "\320j\30\0pi\30\0\330j\30\0xi\30\08k\30\0\200i\30\0\0\0 uh\251!u\0@\2\0J\0L\0\310i\30\0\30\0\32\0\372i\30\0\4@\14\0\1\0\0\0\350Z\374w\324a\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00629   396   NtReadVirtualMemory  (88, 0x186ad0, 76, ...  (88, 0x186ad0, 76, ... "(k\30\0 j\30\00k\30\0(j\30\0\350k\30\08k\30\0\0\0\177Yy\17\204Y\0p\6\0J\0L\0xj\30\0\30\0\32\0\252j\30\0\4@\14\0\1\0\0\0\24l\30\0\254i\30\0\322\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00630   396   NtReadVirtualMemory  (88, 0x186b28, 76, ...  (88, 0x186b28, 76, ... "\330k\30\0\320j\30\0\340k\30\0\330j\30\0\340j\30\00j\30\0\0\0w_5\21w_\0\340\0\0@\0B\0hg\30\0\30\0\32\0\220g\30\0\6@\10\0\2\0\0\0ll\30\0|b\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00631   396   NtReadVirtualMemory  (88, 0x186bd8, 76, ...  (88, 0x186bd8, 76, ... "0l\30\0(k\30\08l\30\00k\30\0@l\30\0\340j\30\0\0\09u\36\315;u\0 \4\0H\0J\0\200k\30\0\26\0\30\0\262k\30\0\4@\14\0\1\0\0\0\20[\374w\14k\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00632   396   NtReadVirtualMemory  (88, 0x186c30, 76, ...  (88, 0x186c30, 76, ... "\234\36\30\0\330k\30\0\244\36\30\0\340k\30\0\254\36\30\0\350k\30\0\0\0_u\261\245bu\0\20\11\0>\0@\0\310f\30\0\26\0\30\0\360f\30\0\4@\14\0\1\0\0\0\310Z\374wdk\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00633   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=972,ParentPid=660,}, 0x0, ) == 0x0
 00634   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00635   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00636   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00637   396   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00638   396   NtClose  (88, ... ) == 0x0
 00639   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1064, 0}, ... 88, ) == 0x0
 00640   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1064,ParentPid=660,}, 0x0, ) == 0x0
 00641   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00642   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00643   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00644   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00645   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00646   396   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0`"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00647   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\260!\30\0h \30\0\270!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\244,\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00648   396   NtReadVirtualMemory  (88, 0x1821b0, 76, ...  (88, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) \30\0\10!\30\0X (88, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00649   396   NtReadVirtualMemory  (88, 0x182250, 76, ...  (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\260!\30\0\370 (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\00 (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00650   396   NtReadVirtualMemory  (88, 0x1822f0, 76, ...  (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\230#\30\0X (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\320 (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00651   396   NtReadVirtualMemory  (88, 0x182390, 76, ...  (88, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\08$\30\0\370 (88, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00652   396   NtReadVirtualMemory  (88, 0x182430, 76, ...  (88, 0x182430, 76, ... "\320$\30\0\220#\30\0\330$\30\0\230#\30\0X)\30\0\340$\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350#\30\0\24\0\26\0\20$\30\0\6@\14\0\3\0\0\044\30\0\354!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00653   396   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\00$\30\0x%\30\08$\30\0@$\30\0\200%\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210$\30\0\24\0\26\0\260$\30\0\6@\10\0\16\0\0\0\254%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00654   396   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0\340$\30\0\0#\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(%\30\0\26\0\30\0P%\30\0\6@\14\0\10\0\0\0$*\30\0\14%\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00655   396   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\300!\30\0\310&\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00656   396   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0(&\30\0\3102\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p&\30\0\24\0\26\0\230&\30\0\6@\14\0\2\0\0\0\204)\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00657   396   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0\10/\30\0\300-\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20'\30\0\24\0\26\08'\30\0\6@\14\0\2\0\0\0t5\30\0\214"\30\0\22\376};\0\0\0\0", 76, ) \30\0\22\376};\0\0\0\0", 76, ) == 0x0
 00658   396   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0x,\30\0\330+\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\2\0\0\0\334(\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00659   396   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "H)\30\0\0(\30\0P)\30\0\10(\30\0\220*\30\0\370)\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\274*\30\0<(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00660   396   NtReadVirtualMemory  (88, 0x182948, 76, ...  (88, 0x182948, 76, ... "\350)\30\0\240(\30\0\360)\30\0\250(\30\0\370)\30\0@$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370(\30\0\30\0\32\0 )\30\0\6@\14\0\13\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00661   396   NtReadVirtualMemory  (88, 0x1829e8, 76, ...  (88, 0x1829e8, 76, ... "\200*\30\0H)\30\0\210*\30\0P)\30\0\260(\30\0X)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240)\30\0\26\0\30\0\310)\30\0\6@\10\0\2\0\0\0\241\30\0\254%\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00662   396   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\350)\30\0(+\30\0\360)\30\00+\30\0\260(\30\0\0\0\262v<-\262v\0P\1\06\08\0@*\30\0\16\0\20\0h*\30\0\6@\14\0\2\0\0\0`Z\374w\334(\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00663   396   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\330*\30\0\22\0\24\0\0+\30\0\6@\10\0\15\0\0\0\4,\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00664   396   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0\20(\30\00+\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\10\0\0\0\320Z\374w\+\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00665   396   NtReadVirtualMemory  (88, 0x182c68, 76, ...  (88, 0x182c68, 76, ... "\10-\30\0\310+\30\0\20-\30\0\320+\30\0\30-\30\0\20(\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\14\0\7\0\0\0\224.\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00666   396   NtReadVirtualMemory  (88, 0x182d08, 76, ...  (88, 0x182d08, 76, ... "\260-\30\0h,\30\0\270-\30\0p,\30\0\300-\30\0x,\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\300,\30\0\24\0\26\0\350,\30\0\6@\10\0\2\0\0\0\354-\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00667   396   NtReadVirtualMemory  (88, 0x182db0, 76, ...  (88, 0x182db0, 76, ... "X.\30\0\10-\30\0`.\30\0\20-\30\0h'\30\0\30-\30\0\0\0gv8\25gv\0@\16\0@\0B\0`-\30\0\30\0\32\0\210-\30\0\6@\10\0\2\0\0\0t0\30\0D-\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00668   396   NtReadVirtualMemory  (88, 0x182e58, 76, ...  (88, 0x182e58, 76, ... "\370.\30\0\260-\30\0\0/\30\0\270-\30\0\2101\30\0\250/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\10.\30\0\30\0\32\00.\30\0\6@\14\0\3\0\0\04/\30\0\244,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00669   396   NtReadVirtualMemory  (88, 0x182ef8, 76, ...  (88, 0x182ef8, 76, ... "\230/\30\0X.\30\0\240/\30\0`.\30\0H0\30\0h'\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\260.\30\0\24\0\26\0\330.\30\0\6@\14\0\3\0\0\0\350Z\374w\224.\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00670   396   NtReadVirtualMemory  (88, 0x182f98, 76, ...  (88, 0x182f98, 76, ... "80\30\0\370.\30\0@0\30\0\0/\30\0h.\30\0\3500\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0P/\30\0\24\0\26\0x/\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00671   396   NtReadVirtualMemory  (88, 0x183038, 76, ...  (88, 0x183038, 76, ... "\3300\30\0\230/\30\0\3400\30\0\240/\30\0\3500\30\0\10/\30\0\0\0-w\306@-w\00\6\0>\0@\0\360/\30\0\26\0\30\0\300\30\0\6@\14\0\11\0\0\0\2641\30\0\354-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00672   396   NtReadVirtualMemory  (88, 0x1830d8, 76, ...  (88, 0x1830d8, 76, ... "x1\30\080\30\0\2001\30\0@0\30\0\250/\30\0H0\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2200\30\0\22\0\24\0\2700\30\0\6@\14\0\3\0\0\0\3642\30\0$*\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00673   396   NtReadVirtualMemory  (88, 0x183178, 76, ...  (88, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0(2\30\0h.\30\0\0\0=w\24 ?w\0@\177\0>\0@\001\30\0\26\0\30\0X1\30\0\6@\10\0\2\0\0\0T2\30\0t0\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00674   396   NtReadVirtualMemory  (88, 0x183218, 76, ...  (88, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0`3\30\0\2101\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3201\30\0\26\0\30\0\3701\30\0\6@\14\0\6\0\0\0\360Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00675   396   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "P3\30\0\302\30\0X3\30\0 2\30\0\310&\30\0\3605\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00676   396   NtReadVirtualMemory  (88, 0x183350, 76, ...  (88, 0x183350, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\104\30\0(2\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\203\30\0\16\0\20\083\30\0\6@\0\0\2\0\0\0\346\30\0\3642\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00677   396   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0P3\30\0\2404\30\0X3\30\0H5\30\0`3\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2503\30\0\30\0\32\0\3203\30\0\6@\14\0\2\0\0\0xZ\374wl$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00678   396   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\2206\30\0H5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0P4\30\0\26\0\30\0x4\30\0\6@\10\0\2\0\0\0\3647\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00679   396   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3405\30\0\2304\30\0\3505\30\0\2404\30\0\2504\30\0\104\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3604\30\0\24\0\26\0\305\30\0\6@\14\0\2\0\0\0<9\30\0\224'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00680   396   NtReadVirtualMemory  (88, 0x1835e0, 76, ...  (88, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\3102\30\0\2206\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\0\0\2\0\0\0\2746\30\0\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00681   396   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... "\2707\30\0\3405\30\0\3007\30\0\3505\30\0\3605\30\0\2504\30\0\0\06v\240\206v\0\360\0\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\10\0\4\0\0\0\3449\30\0\346\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00682   396   NtReadVirtualMemory  (88, 0x1837b8, 76, ...  (88, 0x1837b8, 76, ... "`8\30\0\2006\30\0h8\30\0\2106\30\0p8\30\0\300!\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3306\30\0\30\0\32\0\2267\30\0\4@\14\20\2\0\0\0\2348\30\0\3244\30\02\376};\200x\10\0", 76, ) , 76, ) == 0x0
 00683   396   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0\209\30\0\3107\30\0\0\04wY\324w\0\260\10\0@\0B\0\208\30\0\30\0\32\088\30\0\4@\14\0\1\0\0\0pZ\374w\3647\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00684   396   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\2709\30\0p8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\4@\10\0\2\0\0\0\300Z\374wt5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00685   396   NtReadVirtualMemory  (88, 0x1839a8, 76, ...  (88, 0x1839a8, 76, ... "\234\36\30\0\09\30\0\244\36\30\0\109\30\0\254\36\30\0\209\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\4@\14\0\1\0\0\0\20[\374w\2746\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00686   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1064,ParentPid=660,}, 0x0, ) == 0x0
 00687   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00688   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00689   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00690   396   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00691   396   NtClose  (88, ... ) == 0x0
 00692   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1088, 0}, ... 88, ) == 0x0
 00693   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 00694   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00695   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00696   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00697   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00698   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00699   396   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00700   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\274*\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00701   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00702   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00703   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00704   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00705   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\20(\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0r\0\0\0L&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00706   396   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\230#\30\0\200%\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00707   396   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\320$\30\0\30&\30\0\330$\30\0\340$\30\0 2\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%\30\0\24\0\26\0P%\30\0\6@\14\0\2\0\0\0<(\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00708   396   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0`.\30\0\330+\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\2\0\0\0l5\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00709   396   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0\220*\30\0\360)\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\14\0\2\0\0\0\224'\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00710   396   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0H)\30\0\260(\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\2\0\0\0t)\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00711   396   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\260(\30\08$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\13\0\0\0\310Z\374w\254%\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00712   396   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "8)\30\0\0(\30\0@)\30\0\10(\30\0h'\30\0\20(\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\354-\30\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00713   396   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\360)\30\0h'\30\0\0\0\262v<-\262v\0P\1\06\08\0\370(\30\0\16\0\20\0 )\30\0\6@\14\0\2\0\0\0`Z\374w\224'\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00714   396   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\310&\30\0H)\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\220)\30\0\30\0\32\0\270)\30\0\6@\10\0\11\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00715   396   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\340)\30\0(+\30\0\350)\30\00+\30\0\310&\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\08*\30\0\26\0\30\0`*\30\0\6@\14\0\7\0\0\0\254,\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00716   396   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\330*\30\0\24\0\26\0\0+\30\0\6@\10\0\2\0\0\0\4,\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00717   396   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "p,\30\0 +\30\0x,\30\0(+\30\0 &\30\00+\30\0\0\0gv8\25gv\0@\16\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\2\0\0\0\314/\30\0\+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00718   396   NtReadVirtualMemory  (88, 0x182c70, 76, ...  (88, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\3400\30\0\0/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\3\0\0\0L-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00719   396   NtReadVirtualMemory  (88, 0x182d10, 76, ...  (88, 0x182d10, 76, ... "\260-\30\0p,\30\0\270-\30\0x,\30\0\240/\30\0\300-\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\310,\30\0\24\0\26\0\360,\30\0\6@\14\0\3\0\0\0\3349\30\0\254,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00720   396   NtReadVirtualMemory  (88, 0x182db0, 76, ...  (88, 0x182db0, 76, ... "P.\30\0\20-\30\0X.\30\0\30-\30\0 -\30\0`.\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h-\30\0\24\0\26\0\220-\30\0\6@\10\00\0\0\0\214.\30\0\334(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00721   396   NtReadVirtualMemory  (88, 0x182e50, 76, ...  (88, 0x182e50, 76, ... "\360.\30\0\260-\30\0\370.\30\0\270-\30\0\300-\30\0 &\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10.\30\0\26\0\30\00.\30\0\6@\14\0+\0\0\0l0\30\0\354-\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00722   396   NtReadVirtualMemory  (88, 0x182ef0, 76, ...  (88, 0x182ef0, 76, ... "\220/\30\0P.\30\0\230/\30\0X.\30\0\200,\30\0@0\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\250.\30\0\24\0\26\0\320.\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00723   396   NtReadVirtualMemory  (88, 0x182f90, 76, ...  (88, 0x182f90, 76, ... "00\30\0\360.\30\080\30\0\370.\30\0@0\30\0 -\30\0\0\0-w\306@-w\00\6\0>\0@\0H/\30\0\26\0\30\0p/\30\0\6@\14\0\15\0\0\0\141\30\0\4,\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00724   396   NtReadVirtualMemory  (88, 0x183030, 76, ...  (88, 0x183030, 76, ... "\3200\30\0\220/\30\0\3300\30\0\230/\30\0\0/\30\0\240/\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\350/\30\0\22\0\24\0\200\30\0\6@\14\0\3\0\0\0L2\30\0\214.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00725   396   NtReadVirtualMemory  (88, 0x1830d0, 76, ...  (88, 0x1830d0, 76, ... "p1\30\000\30\0x1\30\080\30\0\2001\30\0\200,\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2100\30\0\26\0\30\0\2600\30\0\6@\10\0\4\0\0\0\2541\30\0\314/\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00726   396   NtReadVirtualMemory  (88, 0x183170, 76, ...  (88, 0x183170, 76, ... "\202\30\0\3200\30\0\302\30\0\3300\30\0\2702\30\0\3400\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0(1\30\0\26\0\30\0P1\30\0\6@\14\0\10\0\0\0\374<\30\0\141\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00727   396   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\200%\30\0\3505\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00728   396   NtReadVirtualMemory  (88, 0x1832a8, 76, ...  (88, 0x1832a8, 76, ... "P3\30\0\202\30\0X3\30\0\302\30\0\04\30\0\2001\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\0\0\2\0\0\0\246\30\0L2\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00729   396   NtReadVirtualMemory  (88, 0x183350, 76, ...  (88, 0x183350, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0@5\30\0\04\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\03\30\0\30\0\32\0(3\30\0\6@\14\0\2\0\0\0,4\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00730   396   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2204\30\0P3\30\0\2304\30\0X3\30\0`3\30\0\2702\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\2503\30\0\24\0\26\0\3203\30\0\6@\14\0\3\0\0\0xZ\374w\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00731   396   NtReadVirtualMemory  (88, 0x183490, 76, ...  (88, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\2106\30\0@5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\10\0\3\0\0\0\3547\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00732   396   NtReadVirtualMemory  (88, 0x183530, 76, ...  (88, 0x183530, 76, ... "\3305\30\0\2204\30\0\3405\30\0\2304\30\0\2404\30\0`3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\14\0\3\0\0\049\30\0L&\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00733   396   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0 2\30\0\2106\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\0\0\2\0\0\0\2646\30\0\3442\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00734   396   NtReadVirtualMemory  (88, 0x183678, 76, ...  (88, 0x183678, 76, ... "\2607\30\0\3305\30\0\2707\30\0\3405\30\0\3505\30\0\2404\30\0\0\06v\240\206v\0\360\0\0<\0>\006\30\0\24\0\26\0X6\30\0\6@\10\0\4\0\0\0|:\30\0\246\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00735   396   NtReadVirtualMemory  (88, 0x1837b0, 76, ...  (88, 0x1837b0, 76, ... "X8\30\0x6\30\0`8\30\0\2006\30\0h8\30\0\230#\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3206\30\0\30\0\32\0\2167\30\0\4@\14\20\3\0\0\0\2248\30\0\3144\30\02\376};\330\324\10\0", 76, ) , 76, ) == 0x0
 00736   396   NtReadVirtualMemory  (88, 0x183858, 76, ...  (88, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\109\30\0\3007\30\0\0\04wY\324w\0\260\10\0@\0B\0\108\30\0\30\0\32\008\30\0\4@\14\0\1\0\0\0pZ\374w\3547\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00737   396   NtReadVirtualMemory  (88, 0x1838f8, 76, ...  (88, 0x1838f8, 76, ... "\2409\30\0X8\30\0\2509\30\0`8\30\0\2609\30\0h8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\4\0\0\0\300Z\374wl5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00738   396   NtReadVirtualMemory  (88, 0x1839a0, 76, ...  (88, 0x1839a0, 76, ... "@:\30\0\3708\30\0H:\30\0\09\30\0\360:\30\0\109\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0P9\30\0\30\0\32\0x9\30\0\4@\14\0\1\0\0\0\<\30\0L-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00739   396   NtReadVirtualMemory  (88, 0x183a40, 76, ...  (88, 0x183a40, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\220;\30\0\360:\30\0\0\0nZ\0\0\0\0\0@\1\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\4@\0\0\1\0\0\0\34;\30\0\2646\30\0\321\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00740   396   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\0@:\30\0\210;\30\0H:\30\0P:\30\0\2609\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\230:\30\0\26\0\30\0\300:\30\0\6@\10\0\1\0\0\0\274;\30\0|:\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00741   396   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... " <\30\0\340:\30\0(<\30\0\350:\30\00<\30\0P:\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\08;\30\0\26\0\30\0`;\30\0\4@\0\0\1\0\0\0\244=\30\0\34;\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00742   396   NtReadVirtualMemory  (88, 0x183c20, 76, ...  (88, 0x183c20, 76, ... "\300<\30\0\200;\30\0\310<\30\0\210;\30\0\320<\30\0\220;\30\0\0\0\302t\220\22\302t\0\0\1\0<\0>\0\330;\30\0\24\0\26\0\0<\30\0\4@\10\0\1\0\0\0\350Z\374w\3349\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00743   396   NtReadVirtualMemory  (88, 0x183cc0, 76, ...  (88, 0x183cc0, 76, ... "h=\30\0 <\30\0p=\30\0(<\30\0x=\30\00<\30\0\0\0\301t`\36\301t\0\320\0\0>\0@\0x<\30\0\26\0\30\0\240<\30\0\4@\14\0\1\0\0\0\360Z\374w\2541\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00744   396   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\10>\30\0\300<\30\0\20>\30\0\310<\30\0\30>\30\0\320<\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\30=\30\0\30\0\32\0@=\30\0\4@\14\0\1\0\0\0\20[\374w\274;\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00745   396   NtReadVirtualMemory  (88, 0x183e08, 76, ...  (88, 0x183e08, 76, ... "\234\36\30\0h=\30\0\244\36\30\0p=\30\0\254\36\30\0x=\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\2\0\0\0\0[\374w$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00746   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 00747   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00748   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00749   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00750   396   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00751   396   NtClose  (88, ... ) == 0x0
 00752   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 88, ) == 0x0
 00753   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1408,ParentPid=660,}, 0x0, ) == 0x0
 00754   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00755   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00756   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00757   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\234.\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00758   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00759   396   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\4,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00760   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00761   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00762   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00763   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00764   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00765   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\330$\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\36\0\0\0\4%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00766   396   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "\10&\30\0($\30\0\20&\30\00$\30\08$\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) \30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) == 0x0
 00767   396   NtReadVirtualMemory  (88, 0x182608, 76, ...  (88, 0x182608, 76, ... "\360'\30\0\310$\30\0\370'\30\0\320$\30\0\0(\30\0\230#\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\300%\30\0\24\0\26\0\350%\30\0\4@\14\0\4\0\0\0\34B\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00768   396   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "h%\30\0\10&\30\0p%\30\0\20&\30\0X'\30\0\30&\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\240'\30\0\30\0\32\0\310'\30\0\4@\14\0\1\0\0\0,;\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00769   396   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "H'\30\0\360'\30\0P'\30\0\370'\30\0\310-\30\0 -\30\0\0\02t8Q2t\0\220\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\4\0\0\0\270Z\374w\270Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00770   396   NtReadVirtualMemory  (88, 0x182748, 76, ...  (88, 0x182748, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\0(\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0 %\30\0\22\0\24\0H%\30\0\6@\10\0\34\0\0\0\344&\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00771   396   NtReadVirtualMemory  (88, 0x1826a8, 76, ...  (88, 0x1826a8, 76, ... "\350(\30\0H'\30\0\360(\30\0P'\30\0\370(\30\0X'\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\230(\30\0\30\0\32\0\300(\30\0\6@\10\0\12\0\0\0\320Z\374w\204'\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00772   396   NtReadVirtualMemory  (88, 0x1828e8, 76, ...  (88, 0x1828e8, 76, ... "@)\30\0\250&\30\0H)\30\0\260&\30\0P)\30\0\270&\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\0'\30\0\26\0\30\0('\30\0\6@\10\0\6\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00773   396   NtReadVirtualMemory  (88, 0x182940, 76, ...  (88, 0x182940, 76, ... "\340)\30\0\350(\30\0\350)\30\0\360(\30\0\330+\30\0\370(\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\6@\14\0\7\0\0\0\34*\30\0\304#\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00774   396   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0 -\30\0\230*\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0\230)\30\0\24\0\26\0\300)\30\0\6@\14\0\4\0\0\0\314;\30\0|)\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00775   396   NtReadVirtualMemory  (88, 0x182a88, 76, ...  (88, 0x182a88, 76, ... "(+\30\0\340)\30\00+\30\0\350)\30\0\360)\30\0\200,\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\08*\30\0\30\0\32\0`*\30\0\6@\14\0\4\0\0\0\364-\30\0\4%\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00776   396   NtReadVirtualMemory  (88, 0x182b28, 76, ...  (88, 0x182b28, 76, ... "\310+\30\0\210*\30\0\320+\30\0\220*\30\0\200,\30\0\330+\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\340*\30\0\26\0\30\0\10+\30\0\6@\10\0\12\0\0\0, 76, ) , 76, ) == 0x0
 00777   396   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "p,\30\0(+\30\0x,\30\00+\30\08+\30\0P)\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\200+\30\0\24\0\26\0\250+\30\0\6@\14\0\11\0\0\0\3041\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00778   396   NtReadVirtualMemory  (88, 0x182c70, 76, ...  (88, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\230*\30\08+\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\4\0\0\0$6\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00779   396   NtReadVirtualMemory  (88, 0x182d10, 76, ...  (88, 0x182d10, 76, ... "\270-\30\0p,\30\0\300-\30\0x,\30\0x%\30\0\360)\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\310,\30\0\26\0\30\0\360,\30\0\6@\14\0\4\0\0\0\341\30\0$#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00780   396   NtReadVirtualMemory  (88, 0x182db8, 76, ...  (88, 0x182db8, 76, ... "`.\30\0\20-\30\0h.\30\0\30-\30\0p.\30\0x%\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0h-\30\0\30\0\32\0\220-\30\0\4@\14\0\2\0\0\0\2542\30\0\304*\30\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00781   396   NtReadVirtualMemory  (88, 0x182e60, 76, ...  (88, 0x182e60, 76, ... "\0/\30\0\270-\30\0\10/\30\0\300-\30\0\20/\30\0\310-\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\20.\30\0\30\0\32\08.\30\0\4@\14\0\12\0\0\0D4\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00782   396   NtReadVirtualMemory  (88, 0x182f00, 76, ...  (88, 0x182f00, 76, ... "\240/\30\0`.\30\0\250/\30\0h.\30\0\260/\30\0p.\30\0\0\0*t\350\24*t\0\340\0\0>\0@\0\270.\30\0\26\0\30\0\340.\30\0\4@\10\0\1\0\0\0\3444\30\0d+\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00783   396   NtReadVirtualMemory  (88, 0x182fa0, 76, ...  (88, 0x182fa0, 76, ... "@0\30\0\0/\30\0H0\30\0\10/\30\0P0\30\0\20/\30\0\0\0(t\37\22(t\0p\0\0<\0>\0X/\30\0\24\0\26\0\200/\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00784   396   NtReadVirtualMemory  (88, 0x183040, 76, ...  (88, 0x183040, 76, ... "\3400\30\0\240/\30\0\3500\30\0\250/\30\0\3600\30\0\260/\30\0\0\0@r\1\26@r\0\300\0\0<\0>\0\370/\30\0\24\0\26\0 0\30\0\4@\14\0\1\0\0\0\>\30\0\370Z\374w-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00785   396   NtReadVirtualMemory  (88, 0x1830e0, 76, ...  (88, 0x1830e0, 76, ... "\2101\30\0@0\30\0\2201\30\0H0\30\0\2301\30\0P0\30\0\0\0?r\355\23?r\0p\0\0<\0>\0\2300\30\0\24\0\26\0\3000\30\0\4@\14\0\1\0\0\0\0[\374wL-\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00786   396   NtReadVirtualMemory  (88, 0x183188, 76, ...  (88, 0x183188, 76, ... "p2\30\0\3400\30\0x2\30\0\3500\30\0 3\30\0\3600\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\3401\30\0\26\0\30\0\102\30\0\4@\10\0\2\0\0\0\2548\30\0\4,\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00787   396   NtReadVirtualMemory  (88, 0x183270, 76, ...  (88, 0x183270, 76, ... "\203\30\0\2101\30\0\303\30\0\2201\30\0\304\30\0 3\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0(2\30\0\24\0\26\0P2\30\0\4@\14\0\1\0\0\0L3\30\0\364-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00788   396   NtReadVirtualMemory  (88, 0x183310, 76, ...  (88, 0x183310, 76, ... "h3\30\0p2\30\0p3\30\0x2\30\0\2002\30\0\2301\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\3102\30\0\26\0\30\0\3602\30\0\6@\10\0\2\0\0\0\2443\30\0\2542\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00789   396   NtReadVirtualMemory  (88, 0x183368, 76, ...  (88, 0x183368, 76, ... "\104\30\0\203\30\0\204\30\0\303\30\0X5\30\0\304\30\0\0\0+t"\24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) \24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) == 0x0
 00790   396   NtReadVirtualMemory  (88, 0x183408, 76, ...  (88, 0x183408, 76, ... "\2504\30\0h3\30\0\2604\30\0p3\30\0x3\30\0\2002\30\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\3003\30\0\24\0\26\0\3503\30\0\6@\0\0\1\0\0\0\148\30\0\234.\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00791   396   NtReadVirtualMemory  (88, 0x1834a8, 76, ...  (88, 0x1834a8, 76, ... "H5\30\0\104\30\0P5\30\0\204\30\0\2306\30\0X5\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0`4\30\0\26\0\30\0\2104\30\0\4@\14\0\2\0\0\0\2045\30\0, 76, ) , 76, ) == 0x0
 00792   396   NtReadVirtualMemory  (88, 0x183548, 76, ...  (88, 0x183548, 76, ... "\3505\30\0\2504\30\0\3605\30\0\2604\30\0\2704\30\0x3\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\05\30\0\24\0\26\0(5\30\0\6@\14\0\2\0\0\0\234D\30\0\3444\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00793   396   NtReadVirtualMemory  (88, 0x1835e8, 76, ...  (88, 0x1835e8, 76, ... "\2106\30\0H5\30\0\2206\30\0P5\30\0pD\30\0@7\30\0\0\00t\11\300t\0@\1\0<\0>\0\2405\30\0\24\0\26\0\3105\30\0\4@\14\0\1\0\0\0\3046\30\0\254,\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00794   396   NtReadVirtualMemory  (88, 0x183688, 76, ...  (88, 0x183688, 76, ... "07\30\0\3505\30\087\30\0\3605\30\0\3109\30\0\2704\30\0\0\0)t\0\0\0\0\0@\0\08\0:\0@6\30\0\20\0\22\0h6\30\0\6@\0\0\1\0\0\0l7\30\0$6\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00795   396   NtReadVirtualMemory  (88, 0x183730, 76, ...  (88, 0x183730, 76, ... "\3207\30\0\2106\30\0\3307\30\0\2206\30\0\3705\30\0\3407\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\3406\30\0\30\0\32\0\107\30\0\6@\14\0\3\0\0\0\240Z\374w\3046\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00796   396   NtReadVirtualMemory  (88, 0x1837d0, 76, ...  (88, 0x1837d0, 76, ... "p8\30\007\30\0x8\30\087\30\0@7\30\0\260@\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\2107\30\0\24\0\26\0\2607\30\0\6@\14\0\1\0\0\0\310Z\374wD4\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00797   396   NtReadVirtualMemory  (88, 0x183870, 76, ...  (88, 0x183870, 76, ... "\309\30\0\3207\30\0 9\30\0\3307\30\0\220=\30\0H<\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0(8\30\0\24\0\26\0P8\30\0\6@\14\0\1\0\0\0\300Z\374w\3041\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00798   396   NtReadVirtualMemory  (88, 0x183918, 76, ...  (88, 0x183918, 76, ... "\2709\30\0p8\30\0\3009\30\0x8\30\0\0;\30\0`:\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\3108\30\0\30\0\32\0\3608\30\0\6@\14\0\1\0\0\0\3649\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00799   396   NtReadVirtualMemory  (88, 0x1839b8, 76, ...  (88, 0x1839b8, 76, ... "P:\30\0\309\30\0X:\30\0 9\30\0`:\30\0\2306\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0p9\30\0\26\0\30\0\2309\30\0\6@\10\0\1\0\0\0\214:\30\0T9\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00800   396   NtReadVirtualMemory  (88, 0x183a50, 76, ...  (88, 0x183a50, 76, ... "\360:\30\0\2709\30\0\370:\30\0\3009\30\0(9\30\0\3109\30\0\0\0\262v<-\262v\0P\1\06\08\0\20:\30\0\16\0\20\08:\30\0\6@\14\0\1\0\0\0`Z\374w\3649\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00801   396   NtReadVirtualMemory  (88, 0x183af0, 76, ...  (88, 0x183af0, 76, ... "\220;\30\0P:\30\0\230;\30\0X:\30\0\240;\30\0(9\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\250:\30\0\26\0\30\0\320:\30\0\6@\14\0\4\0\0\0\34=\30\0,(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00802   396   NtReadVirtualMemory  (88, 0x183b90, 76, ...  (88, 0x183b90, 76, ... "8<\30\0\360:\30\0@<\30\0\370:\30\0H<\30\0\0;\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\1\0\0\0t<\30\0\34*\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00803   396   NtReadVirtualMemory  (88, 0x183c38, 76, ...  (88, 0x183c38, 76, ... "\340<\30\0\220;\30\0\350<\30\0\230;\30\0\2008\30\0\240;\30\0\0\0gv8\25gv\0@\16\0@\0B\0\350;\30\0\30\0\32\0\20<\30\0\6@\10\0\1\0\0\0\374>\30\0\314;\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00804   396   NtReadVirtualMemory  (88, 0x183ce0, 76, ...  (88, 0x183ce0, 76, ... "\200=\30\08<\30\0\210=\30\0@<\30\0\20@\30\00>\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\220<\30\0\30\0\32\0\270<\30\0\6@\14\0\2\0\0\0\274=\30\0,;\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00805   396   NtReadVirtualMemory  (88, 0x183d80, 76, ...  (88, 0x183d80, 76, ... " >\30\0\340<\30\0(>\30\0\350<\30\0\320>\30\0\2008\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\08=\30\0\24\0\26\0`=\30\0\6@\14\0\2\0\0\0\350Z\374w\34=\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00806   396   NtReadVirtualMemory  (88, 0x183e20, 76, ...  (88, 0x183e20, 76, ... "\300>\30\0\200=\30\0\310>\30\0\210=\30\0\360<\30\0p?\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\330=\30\0\24\0\26\0\0>\30\0\6@\10\0\2\0\0\0\370Z\374w|0\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00807   396   NtReadVirtualMemory  (88, 0x183ec0, 76, ...  (88, 0x183ec0, 76, ... "`?\30\0 >\30\0h?\30\0(>\30\0p?\30\0\220=\30\0\0\0-w\306@-w\00\6\0>\0@\0x>\30\0\26\0\30\0\240>\30\0\6@\14\0\6\0\0\0<@\30\0t<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00808   396   NtReadVirtualMemory  (88, 0x183f60, 76, ...  (88, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\00>\30\0\320>\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\30?\30\0\22\0\24\0@?\30\0\6@\14\0\2\0\0\0\334@\30\0\2443\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00809   396   NtReadVirtualMemory  (88, 0x184000, 76, ...  (88, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0HA\30\0\360<\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0\360Z\374w\374>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00810   396   NtReadVirtualMemory  (88, 0x1840a0, 76, ...  (88, 0x1840a0, 76, ... "8A\30\0\0@\30\0@A\30\0\10@\30\0\3407\30\0\230B\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00811   396   NtReadVirtualMemory  (88, 0x184138, 76, ...  (88, 0x184138, 76, ... "\340A\30\0\240@\30\0\350A\30\0\250@\30\0\360A\30\0\20@\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\370@\30\0\16\0\20\0 A\30\0\6@\0\0\1\0\0\0\304B\30\0\334@\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00812   396   NtReadVirtualMemory  (88, 0x1841e0, 76, ...  (88, 0x1841e0, 76, ... "\210B\30\08A\30\0\220B\30\0@A\30\08C\30\0HA\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220A\30\0\30\0\32\0\270A\30\0\6@\14\0\1\0\0\0xZ\374wD&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00813   396   NtReadVirtualMemory  (88, 0x184288, 76, ...  (88, 0x184288, 76, ... "(C\30\0\340A\30\00C\30\0\350A\30\0\260@\30\08C\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08B\30\0\30\0\32\0`B\30\0\6@\0\0\1\0\0\0dC\30\0tA\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00814   396   NtReadVirtualMemory  (88, 0x184328, 76, ...  (88, 0x184328, 76, ... "`D\30\0\210B\30\0hD\30\0\220B\30\0\230B\30\0\360A\30\0\0\06v\240\206v\0\360\0\0<\0>\0\340B\30\0\24\0\26\0\10C\30\0\6@\10\0\2\0\0\0\20[\374w\304B\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00815   396   NtReadVirtualMemory  (88, 0x184460, 76, ...  (88, 0x184460, 76, ... "\10E\30\0(C\30\0\20E\30\00C\30\0\30E\30\0\3705\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\200C\30\0\30\0\32\0>D\30\0\4@\14\20\2\0\0\0DE\30\0\2045\30\02\376};P\23\12\0", 76, ) , 76, ) == 0x0
 00816   396   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\234\36\30\0`D\30\0\244\36\30\0hD\30\0\254\36\30\0pD\30\0\0\04wY\324w\0\260\10\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\4@\14\0\1\0\0\0pZ\374w\234D\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00817   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1408,ParentPid=660,}, 0x0, ) == 0x0
 00818   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00819   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00820   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00821   396   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0p\0o\0o\0l\0s\0v\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00822   396   NtClose  (88, ... ) == 0x0
 00823   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1640, 0}, ... 88, ) == 0x0
 00824   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1640,ParentPid=660,}, 0x0, ) == 0x0
 00825   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00826   396   NtReadVirtualMemory  (88, 0x241ea4, 4, ...  (88, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00827   396   NtReadVirtualMemory  (88, 0x241ec0, 76, ...  (88, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00828   396   NtReadVirtualMemory  (88, 0x241f18, 76, ...  (88, 0x241f18, 76, ... "\300\37$\0\300\36$\0\310\37$\0\310\36$\0\320\37$\0\254\36$\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%$\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00829   396   NtReadVirtualMemory  (88, 0x241fc0, 76, ...  (88, 0x241fc0, 76, ... "` $\0\30\37$\0h $\0 \37$\0p $\0(\37$\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37$\0\30\0\32\0\230\37$\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00830   396   NtReadVirtualMemory  (88, 0x242060, 76, ...  (88, 0x242060, 76, ... "\10!$\0\300\37$\0\20!$\0\310\37$\0\270!$\0\320\37$\0\0\04|\237"4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) 4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) == 0x0
 00831   396   NtReadVirtualMemory  (88, 0x242108, 76, ...  (88, 0x242108, 76, ... "\250!$\0` $\0\260!$\0h $\0\370"$\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) $\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00832   396   NtReadVirtualMemory  (88, 0x2421a8, 76, ...  (88, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) $\0\10!$\0P (88, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00833   396   NtReadVirtualMemory  (88, 0x242248, 76, ...  (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\250!$\0\360 (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00834   396   NtReadVirtualMemory  (88, 0x2422e8, 76, ...  (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\220#$\0P (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00835   396   NtReadVirtualMemory  (88, 0x242388, 76, ...  (88, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\00$$\0\360 (88, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) == 0x0
 00836   396   NtReadVirtualMemory  (88, 0x242428, 76, ...  (88, 0x242428, 76, ... "\320$$\0\210#$\0\330$$\0\220#$\0`8$\0\200%$\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$$\0\30\0\32\0\250$$\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00837   396   NtReadVirtualMemory  (88, 0x2424d0, 76, ...  (88, 0x2424d0, 76, ... "p%$\0($$\0x%$\00$$\0\20($\0\230#$\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#$\0\24\0\26\0\10$$\0\6@\10\0"\0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) \0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) == 0x0
 00838   396   NtReadVirtualMemory  (88, 0x242570, 76, ...  (88, 0x242570, 76, ... "\20&$\0\320$$\0\30&$\0\330$$\08$$\0\3002$\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%$\0\24\0\26\0P%$\0\6@\14\0\1\0\0\0<($\0T\37$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00839   396   NtReadVirtualMemory  (88, 0x242610, 76, ...  (88, 0x242610, 76, ... "\270&$\0p%$\0\300&$\0x%$\0\0/$\0x,$\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%$\0\24\0\26\0\360%$\0\6@\14\0\1\0\0\0\146$\0\14%$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00840   396   NtReadVirtualMemory  (88, 0x2426b8, 76, ...  (88, 0x2426b8, 76, ... "X'$\0\20&$\0`'$\0\30&$\00+$\0\220*$\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&$\0\30\0\32\0\220&$\0\6@\14\0\1\0\0\0\224'$\0D!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00841   396   NtReadVirtualMemory  (88, 0x242758, 76, ...  (88, 0x242758, 76, ... "\0($\0\270&$\0\10($\0\300&$\0H)$\0\260($\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'$\0\26\0\30\08'$\0\6@\10\0\1\0\0\0t)$\0\364&$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00842   396   NtReadVirtualMemory  (88, 0x242800, 76, ...  (88, 0x242800, 76, ... "\240($\0X'$\0\250($\0`'$\0\260($\0\340$$\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'$\0\30\0\32\0\330'$\0\6@\14\0\6\0\0\0\310Z\374w\254%$\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00843   396   NtReadVirtualMemory  (88, 0x2428a0, 76, ...  (88, 0x2428a0, 76, ... "8)$\0\0($\0@)$\0\10($\0h'$\0\20($\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X($\0\26\0\30\0\200($\0\6@\10\0\1\0\0\0\214.$\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00844   396   NtReadVirtualMemory  (88, 0x242938, 76, ...  (88, 0x242938, 76, ... "\330)$\0\240($\0\340)$\0\250($\0\350)$\0h'$\0\0\0\262v<-\262v\0P\1\06\08\0\370($\0\16\0\20\0 )$\0\6@\14\0\1\0\0\0`Z\374w\224'$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00845   396   NtReadVirtualMemory  (88, 0x2429d8, 76, ...  (88, 0x2429d8, 76, ... "\200*$\08)$\0\210*$\0@)$\0\220*$\0H)$\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\220)$\0\22\0\24\0\270)$\0\6@\10\0\7\0\0\0\274*$\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00846   396   NtReadVirtualMemory  (88, 0x242a80, 76, ...  (88, 0x242a80, 76, ... " +$\0\330)$\0(+$\0\340)$\0\310&$\0\350)$\0\0\0\22w\360+\23w\0\260\10\0@\0B\00*$\0\30\0\32\0X*$\0\6@\10\0\4\0\0\0\320Z\374w\24*$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00847   396   NtReadVirtualMemory  (88, 0x242b20, 76, ...  (88, 0x242b20, 76, ... "\300+$\0\200*$\0\310+$\0\210*$\0\320+$\0\310&$\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\330*$\0\26\0\30\0\0+$\0\6@\14\0\4\0\0\0L-$\0\344!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00848   396   NtReadVirtualMemory  (88, 0x242bc0, 76, ...  (88, 0x242bc0, 76, ... "h,$\0 +$\0p,$\0(+$\0x,$\00+$\0\0\0\277qp\21\277q\0\20\1\0<\0>\0x+$\0\24\0\26\0\240+$\0\6@\10\0\1\0\0\0\244,$\0\360Z\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00849   396   NtReadVirtualMemory  (88, 0x242c68, 76, ...  (88, 0x242c68, 76, ... "\20-$\0\300+$\0\30-$\0\310+$\0 &$\0\320+$\0\0\0gv8\25gv\0@\16\0@\0B\0\30,$\0\30\0\32\0@,$\0\6@\10\0\1\0\0\0l0$\0\374+$\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00850   396   NtReadVirtualMemory  (88, 0x242d10, 76, ...  (88, 0x242d10, 76, ... "\260-$\0h,$\0\270-$\0p,$\0\2001$\0\240/$\0\0\0\356v(\25\356v\0p\3\0@\0B\0\300,$\0\30\0\32\0\350,$\0\6@\14\0\2\0\0\0\354-$\0\+$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00851   396   NtReadVirtualMemory  (88, 0x242db0, 76, ...  (88, 0x242db0, 76, ... "P.$\0\20-$\0X.$\0\30-$\0@0$\0`.$\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0h-$\0\24\0\26\0\220-$\0\6@\14\0\2\0\0\0\350Z\374wL-$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00852   396   NtReadVirtualMemory  (88, 0x242e50, 76, ...  (88, 0x242e50, 76, ... "\360.$\0\260-$\0\370.$\0\270-$\0\300-$\0\0/$\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\10.$\0\24\0\26\00.$\0\6@\10\0\6\0\0\0,/$\0\334($\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00853   396   NtReadVirtualMemory  (88, 0x242ef0, 76, ...  (88, 0x242ef0, 76, ... "\220/$\0P.$\0\230/$\0X.$\0`.$\0 &$\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\250.$\0\26\0\30\0\320.$\0\6@\14\0\2\0\0\0\141$\0\214.$\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00854   396   NtReadVirtualMemory  (88, 0x242f90, 76, ...  (88, 0x242f90, 76, ... "00$\0\360.$\080$\0\370.$\0 -$\0\3400$\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0H/$\0\24\0\26\0p/$\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00855   396   NtReadVirtualMemory  (88, 0x243030, 76, ...  (88, 0x243030, 76, ... "\3200$\0\220/$\0\3300$\0\230/$\0\3400$\0\300-$\0\0\0-w\306@-w\00\6\0>\0@\0\350/$\0\26\0\30\0\200$\0\6@\14\0\6\0\0\0\2541$\0\244,$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00856   396   NtReadVirtualMemory  (88, 0x2430d0, 76, ...  (88, 0x2430d0, 76, ... "p1$\000$\0x1$\080$\0\240/$\0@0$\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2100$\0\22\0\24\0\2600$\0\6@\14\0\2\0\0\0\3542$\0,/$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00857   396   NtReadVirtualMemory  (88, 0x243170, 76, ...  (88, 0x243170, 76, ... "\202$\0\3200$\0\302$\0\3300$\0 2$\0 -$\0\0\0=w\24 ?w\0@\177\0>\0@\0(1$\0\26\0\30\0P1$\0\6@\10\0\1\0\0\0L2$\0l0$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00858   396   NtReadVirtualMemory  (88, 0x243210, 76, ...  (88, 0x243210, 76, ... "\2602$\0p1$\0\2702$\0x1$\0X3$\0\2001$\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3101$\0\26\0\30\0\3601$\0\6@\14\0\3\0\0\0\360Z\374w\2541$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00859   396   NtReadVirtualMemory  (88, 0x2432b0, 76, ...  (88, 0x2432b0, 76, ... "H3$\0\202$\0P3$\0\302$\0\200%$\0\2106$\0\0\0\332v\33"\333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) == 0x0
 00860   396   NtReadVirtualMemory  (88, 0x243348, 76, ...  (88, 0x243348, 76, ... "\3603$\0\2602$\0\3703$\0\2702$\0\2404$\0 2$\0\0\0\323v\0\0\0\0\0@\0\06\08\0\103$\0\16\0\20\003$\0\6@\0\0\1\0\0\0\2646$\0\3542$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00861   396   NtReadVirtualMemory  (88, 0x2433f0, 76, ...  (88, 0x2433f0, 76, ... "\2204$\0H3$\0\2304$\0P3$\0\3405$\0\2404$\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2403$\0\30\0\32\0\3103$\0\6@\14\0\1\0\0\0\3144$\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00862   396   NtReadVirtualMemory  (88, 0x243490, 76, ...  (88, 0x243490, 76, ... "05$\0\3603$\085$\0\3703$\0\04$\0X3$\0\0\0\362v\317\22\362v\0P\2\0<\0>\0H4$\0\24\0\26\0p4$\0\6@\14\0\1\0\0\0xZ\374w,4$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00863   396   NtReadVirtualMemory  (88, 0x243530, 76, ...  (88, 0x243530, 76, ... "\3205$\0\2204$\0\3305$\0\2304$\0(7$\0\3405$\0\0\0,vN\25,v\0\240\10\0>\0@\0\3504$\0\26\0\30\0\205$\0\6@\10\0\1\0\0\0\2148$\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00864   396   NtReadVirtualMemory  (88, 0x2435d0, 76, ...  (88, 0x2435d0, 76, ... "x6$\005$\0\2006$\085$\0@5$\0\04$\0\0\0*v\\20*v\0\360\0\0<\0>\0\2105$\0\24\0\26\0\2605$\0\6@\14\0\1\0\0\0\300Z\374wL&$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00865   396   NtReadVirtualMemory  (88, 0x243678, 76, ...  (88, 0x243678, 76, ... "\307$\0\3205$\0 7$\0\3305$\0\3002$\0(7$\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0(6$\0\30\0\32\0P6$\0\6@\0\0\1\0\0\0T7$\0\2043$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00866   396   NtReadVirtualMemory  (88, 0x243718, 76, ...  (88, 0x243718, 76, ... "P8$\0x6$\0X8$\0\2006$\0\2106$\0@5$\0\0\06v\240\206v\0\360\0\0<\0>\0\3206$\0\24\0\26\0\3706$\0\6@\10\0\2\0\0\0\20[\374w\2646$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00867   396   NtReadVirtualMemory  (88, 0x243850, 76, ...  (88, 0x243850, 76, ... "\3708$\0\307$\0\09$\0 7$\0\109$\08$$\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0p7$\0\30\0\32\0.8$\0\4@\14\20\2\0\0\049$\0l5$\02\376};\310W\24\0", 76, ) , 76, ) == 0x0
 00868   396   NtReadVirtualMemory  (88, 0x2438f8, 76, ...  (88, 0x2438f8, 76, ... "\2309$\0P8$\0\2409$\0X8$\0\2509$\0`8$\0\0\04wY\324w\0\260\10\0@\0B\0\2508$\0\30\0\32\0\3208$\0\4@\14\0\1\0\0\0pZ\374w\2148$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00869   396   NtReadVirtualMemory  (88, 0x243998, 76, ...  (88, 0x243998, 76, ... "\234\36$\0\3708$\0\244\36$\0\09$\0\254\36$\0\109$\0\0\0\247uM\31\247u\00\12\0>\0@\0P9$\0\26\0\30\0x9$\0\4@\14\0\1\0\0\0\0[\374w\204"$\0\30\376};\0\0\0\0", 76, ) $\0\30\376};\0\0\0\0", 76, ) == 0x0
 00870   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1640,ParentPid=660,}, 0x0, ) == 0x0
 00871   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00872   396   NtReadVirtualMemory  (88, 0x241ea4, 4, ...  (88, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00873   396   NtReadVirtualMemory  (88, 0x241ec0, 76, ...  (88, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00874   396   NtReadVirtualMemory  (88, 0x205b8, 110, ...  (88, 0x205b8, 110, ... "C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0V\0M\0w\0a\0r\0e\0\\0V\0M\0w\0a\0r\0e\0 \0T\0o\0o\0l\0s\0\\0V\0M\0w\0a\0r\0e\0S\0e\0r\0v\0i\0c\0e\0.\0e\0x\0e\0\0\0", 110, ) , 110, ) == 0x0
 00875   396   NtClose  (88, ... ) == 0x0
 00876   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1868, 0}, ... 88, ) == 0x0
 00877   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1868,ParentPid=616,}, 0x0, ) == 0x0
 00878   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00879   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00880   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00881   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00882   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0X"\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00883   396   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\0!\30\0\300\37\30\0\10!\30\0\310\37\30\0\230#\30\0\20!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\14\0\377\377\0\0\254%\30\0\374\36\30\0\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00884   396   NtReadVirtualMemory  (88, 0x182100, 76, ...  (88, 0x182100, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0p \30\0\270!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\270 \30\0\22\0\24\0\340 \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00885   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00886   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00887   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\26\0\30\0\310 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00888   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00889   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\370"\30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) \30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00890   396   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\0\370"\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) \30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) == 0x0
 00891   396   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0(&\30\0\340$\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0(%\30\0\26\0\30\0P%\30\0\4@\10\0\2\0\0\0\0[\374w\234 \30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00892   396   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\4@\14\0\1\0\0\0\360Z\374w\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00893   396   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "\234\36\30\0\30&\30\0\244\36\30\0 &\30\0\254\36\30\0(&\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\4@\14\0\1\0\0\0\310Z\374wT\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00894   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1868,ParentPid=616,}, 0x0, ) == 0x0
 00895   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00896   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00897   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00898   396   NtReadVirtualMemory  (88, 0x20598, 66, ...  (88, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0s\0e\0r\0i\0n\0i\0t\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00899   396   NtClose  (88, ... ) == 0x0
 00900   396   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1912, 0}, ... 88, ) == 0x0
 00901   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1912,ParentPid=1868,}, 0x0, ) == 0x0
 00902   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00903   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00904   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00905   396   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\41\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00906   396   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00907   396   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\264/\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00908   396   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00909   396   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\7\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\7\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00910   396   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00911   396   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00912   396   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00913   396   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\340#\30\0\26\0\30\0\10$\30\0\6@\10\0\377\377\0\0\364&\30\0\304#\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00914   396   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\08$\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0\254%\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00915   396   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\310$\30\0 &\30\0\320$\30\0(&\30\0\330$\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\320Z\374w\4%\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00916   396   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\370u\265*\370u\0\300\17\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\377\377\0\0hZ\374whZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00917   396   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0h'\30\0(&\30\0\0\0\234v=\5\235v\0\220\24\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\6@\14\0\377\377\0\0\24/\30\0d$\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00918   396   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\220(\30\0\270&\30\0\230(\30\0\300&\30\0\240(\30\0\310&\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\377\377\0\0\324-\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00919   396   NtReadVirtualMemory  (88, 0x182890, 76, ...  (88, 0x182890, 76, ... "8)\30\0X'\30\0@)\30\0`'\30\0H)\30\0h'\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\260'\30\0\30\0\32\0n(\30\0\4@\14\20\14\0\0\0t)\30\0pZ\374w2\376};(=\10\0", 76, ) , 76, ) == 0x0
 00920   396   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\330)\30\0\220(\30\0\340)\30\0\230(\30\0\350)\30\0\240(\30\0\0\04wY\324w\0\260\10\0@\0B\0\350(\30\0\30\0\32\0\20)\30\0\4@\14\0\4\0\0\0\264*\30\0\314(\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00921   396   NtReadVirtualMemory  (88, 0x1829d8, 76, ...  (88, 0x1829d8, 76, ... "x*\30\08)\30\0\200*\30\0@)\30\0(+\30\0H)\30\0\0\0\364u\320\21\364u\0\320\1\0>\0@\0\220)\30\0\26\0\30\0\270)\30\0\4@\10\0\1\0\0\0\0\30\0D!\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00922   396   NtReadVirtualMemory  (88, 0x182a78, 76, ...  (88, 0x182a78, 76, ... "\30+\30\0\330)\30\0 +\30\0\340)\30\0\10-\30\0\310+\30\0\0\0\375v%0\375v\0\200\7\0>\0@\00*\30\0\26\0\30\0X*\30\0\4@\14\0\2\0\0\0T+\30\0t)\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00923   396   NtReadVirtualMemory  (88, 0x182b18, 76, ...  (88, 0x182b18, 76, ... "\270+\30\0x*\30\0\300+\30\0\200*\30\0\310+\30\0\350)\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320*\30\0\24\0\26\0\370*\30\0\6@\14\0\2\0\0\0\224,\30\0\264*\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00924   396   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0\210*\30\0(+\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0p+\30\0\26\0\30\0\230+\30\0\6@\10\0\3\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00925   396   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\370,\30\0\270+\30\0\0-\30\0\300+\30\0\350.\30\0\10-\30\0\0\0bv\316\26bv\0\340\4\0:\0<\0\20,\30\0\22\0\24\08,\30\0\4@\14\0\1\0\0\04-\30\0T+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00926   396   NtReadVirtualMemory  (88, 0x182cf8, 76, ...  (88, 0x182cf8, 76, ... "8.\30\0X,\30\0@.\30\0`,\30\0h,\30\0\210*\30\0\0\0`v\20\22`v\0\260\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\6@\10\0\1\0\0\0t5\30\0\224,\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00927   396   NtReadVirtualMemory  (88, 0x182e38, 76, ...  (88, 0x182e38, 76, ... "\330.\30\0\370,\30\0\340.\30\0\0-\30\0\250-\30\0\210/\30\0\0\0c[\237qd[\0\0\7\0>\0@\0\360-\30\0\26\0\30\0\30.\30\0\4@\14\0\1\0\0\0\304B\30\0\370Z\374w\267\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00928   396   NtReadVirtualMemory  (88, 0x182ed8, 76, ...  (88, 0x182ed8, 76, ... "x/\30\08.\30\0\200/\30\0@.\30\0\210/\30\0h,\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\220.\30\0\26\0\30\0\270.\30\0\6@\14\0\6\0\0\0\2441\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00929   396   NtReadVirtualMemory  (88, 0x182f78, 76, ...  (88, 0x182f78, 76, ... "\230-\30\0\330.\30\0\240-\30\0\340.\30\0H.\30\0\350.\30\0\0\08v4\208v\0P\0\0>\0@\00/\30\0\26\0\30\0X/\30\0\6@\14\0\1\0\0\0\246\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00930   396   NtReadVirtualMemory  (88, 0x182d98, 76, ...  (88, 0x182d98, 76, ... " 0\30\0x/\30\0(0\30\0\200/\30\000\30\0H.\30\0\0\0\247uM\31\247u\00\12\0>\0@\0P-\30\0\26\0\30\0x-\30\0\4@\14\0\4\0\0\0\0[\374w\224'\30\0\30\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00931   396   NtReadVirtualMemory  (88, 0x183020, 76, ...  (88, 0x183020, 76, ... "\3100\30\0\230-\30\0\3200\30\0\240-\30\0\3300\30\0\250-\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0\320/\30\0\30\0\32\0\370/\30\0\4@\14\0\1\0\0\0,4\30\0\24*\30\00\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00932   396   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "h1\30\0 0\30\0p1\30\0(0\30\0x1\30\000\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x0\30\0\30\0\32\0\2400\30\0\4@\14\0\13\0\0\0\2243\30\0T\37\30\03\376};(=\10\0", 76, ) , 76, ) == 0x0
 00933   396   NtReadVirtualMemory  (88, 0x183168, 76, ...  (88, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\4@\10\0\2\0\0\0L2\30\0\24/\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00934   396   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0\3102\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\4@\10\0\2\0\0\0\360Z\374w\2441\30\0\25\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00935   396   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0\04\30\0 2\30\0\0\0\230v\264\20\230v\0p\0\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\4@\14\0\1\0\0\0\270Z\374w\270Z\374w\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00936   396   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3603\30\0\2702\30\0\3703\30\0\3002\30\0\3505\30\0\04\30\0\0\0\231v\250\22\231v\0@\2\0>\0@\0\203\30\0\26\0\30\083\30\0\4@\14\0\2\0\0\0\324:\30\0\41\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00937   396   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0h3\30\0\3102\30\0\0\0\262v<-\262v\0P\1\06\08\0\2603\30\0\16\0\20\0\3303\30\0\6@\14\0\3\0\0\0\3747\30\0\0\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00938   396   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\007\30\0\2206\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0H4\30\0\30\0\32\0p4\30\0\4@\14\0\1\0\0\0<9\30\0\20[\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00939   396   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2206\30\0\3505\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\10\0\4\0\0\0\3449\30\04-\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00940   396   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0H5\30\0h3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\5\0\0\0\2348\30\0\264/\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00941   396   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... " 7\30\0\3305\30\0(7\30\0\3405\30\0\2504\30\0H5\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\006\30\0\30\0\32\0X6\30\0\6@\14\0\1\0\0\0\24=\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00942   396   NtReadVirtualMemory  (88, 0x183720, 76, ...  (88, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3207\30\0\2504\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\4@\14\0\1\0\0\0\334@\30\0\344!\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00943   396   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\007\30\0\0\0\353p\240.\353p\0p\0\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\4@\10\0\1\0\0\0\374>\30\0,4\30\0q\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00944   396   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\0\2709\30\0\3207\30\0\0\0_`(;_`\0\320\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\4@\10\0\1\0\0\0T>\30\0\246\30\0\357\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00945   396   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\0;\30\0\2709\30\0\0\0\352t\360\24\352t\0\0\1\0<\0>\0\2708\30\0\24\0\26\0\3408\30\0\4@\10\0\1\0\0\0\314;\30\0\3244\30\0\37\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00946   396   NtReadVirtualMemory  (88, 0x1839a8, 76, ...  (88, 0x1839a8, 76, ... "\230:\30\0\09\30\0\240:\30\0\109\30\0\209\30\0p8\30\0\0\0;v\0\26;v\0P\4\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\6@\14\0\1\0\0\0,;\30\0t5\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00947   396   NtReadVirtualMemory  (88, 0x183a98, 76, ...  (88, 0x183a98, 76, ... "\360:\30\0\2509\30\0\370:\30\0\2609\30\0\254\36\30\0\350<\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0H:\30\0\30\0\32\0p:\30\0\4@\14\0\1\0\0\0\264=\30\0\2243\30\0\27\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00948   396   NtReadVirtualMemory  (88, 0x183af0, 76, ...  (88, 0x183af0, 76, ... "\220;\30\0\230:\30\0\230;\30\0\240:\30\0@<\30\0\209\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\0:\30\0\24\0\26\0(:\30\0\6@\14\0\1\0\0\0pZ\374w\3449\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00949   396   NtReadVirtualMemory  (88, 0x183b90, 76, ...  (88, 0x183b90, 76, ... "0<\30\0\360:\30\08<\30\0\370:\30\0\20@\30\0@<\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\7\0\0\0l<\30\0<9\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00950   396   NtReadVirtualMemory  (88, 0x183c30, 76, ...  (88, 0x183c30, 76, ... "\330<\30\0\220;\30\0\340<\30\0\230;\30\0\240;\30\0\0;\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\350;\30\0\26\0\30\0\20<\30\0\6@\14\0\2\0\0\0<@\30\0\314;\30\02\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00951   396   NtReadVirtualMemory  (88, 0x183cd8, 76, ...  (88, 0x183cd8, 76, ... "x=\30\00<\30\0\200=\30\08<\30\0\250:\30\0\210=\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\210<\30\0\30\0\32\0\260<\30\0\6@\14\0\3\0\0\0\240Z\374w\2746\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00952   396   NtReadVirtualMemory  (88, 0x183d78, 76, ...  (88, 0x183d78, 76, ... "\30>\30\0\330<\30\0 >\30\0\340<\30\0\350<\30\0\330C\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\00=\30\0\24\0\26\0X=\30\0\6@\14\0\1\0\0\0\310Z\374w\324:\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00953   396   NtReadVirtualMemory  (88, 0x183e18, 76, ...  (88, 0x183e18, 76, ... "\300>\30\0x=\30\0\310>\30\0\200=\30\0\370A\30\0\260@\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\320=\30\0\24\0\26\0\370=\30\0\6@\14\0\1\0\0\0\300Z\374w\2348\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00954   396   NtReadVirtualMemory  (88, 0x183ec0, 76, ...  (88, 0x183ec0, 76, ... "`?\30\0\30>\30\0h?\30\0 >\30\0\260@\30\0p?\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0p>\30\0\30\0\32\0\230>\30\0\6@\14\0\1\0\0\0\234?\30\0\3747\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00955   396   NtReadVirtualMemory  (88, 0x183f60, 76, ...  (88, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\0\320>\30\0\20@\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\30?\30\0\26\0\30\0@?\30\0\6@\10\0\1\0\0\0`Z\374w\374>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00956   396   NtReadVirtualMemory  (88, 0x184000, 76, ...  (88, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0p?\30\0\240;\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0dC\30\0l<\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00957   396   NtReadVirtualMemory  (88, 0x1840a0, 76, ...  (88, 0x1840a0, 76, ... "HA\30\0\0@\30\0PA\30\0\10@\30\0(>\30\0\320>\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0X@\30\0\26\0\30\0\200@\30\0\6@\14\0\4\0\0\0\204A\30\0\7\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00958   396   NtReadVirtualMemory  (88, 0x184148, 76, ...  (88, 0x184148, 76, ... "\350A\30\0\240@\30\0\360A\30\0\250@\30\0pD\30\0\230B\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\370@\30\0\30\0\32\0 A\30\0\6@\14\0\2\0\0\0$B\30\0\334@\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00959   396   NtReadVirtualMemory  (88, 0x1841e8, 76, ...  (88, 0x1841e8, 76, ... "\210B\30\0HA\30\0\220B\30\0PA\30\08C\30\0(>\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\240A\30\0\24\0\26\0\310A\30\0\6@\14\0\2\0\0\0\350Z\374w\204A\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00960   396   NtReadVirtualMemory  (88, 0x184288, 76, ...  (88, 0x184288, 76, ... "(C\30\0\350A\30\00C\30\0\360A\30\0XA\30\08C\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0@B\30\0\24\0\26\0hB\30\0\6@\10\0\2\0\0\0\370Z\374wt.\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00961   396   NtReadVirtualMemory  (88, 0x184328, 76, ...  (88, 0x184328, 76, ... "\310C\30\0\210B\30\0\320C\30\0\220B\30\0\230B\30\0\370A\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\340B\30\0\22\0\24\0\10C\30\0\6@\14\0\2\0\0\0\4D\30\0<@\30\0\23\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00962   396   NtReadVirtualMemory  (88, 0x1843c8, 76, ...  (88, 0x1843c8, 76, ... "`D\30\0(C\30\0hD\30\00C\30\0\210=\30\0`F\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\200C\30\0\24\0\26\0\250C\30\0\6@\14\0\1\0\0\0\234D\30\0dC\30\0\21\376};\330Z\10\0", 76, ) \333v\0\0\3\0<\0>\0\200C\30\0\24\0\26\0\250C\30\0\6@\14\0\1\0\0\0\234D\30\0dC\30\0\21\376};\330Z\10\0", 76, ) == 0x0
 00963   396   NtReadVirtualMemory  (88, 0x184460, 76, ...  (88, 0x184460, 76, ... "\10E\30\0\310C\30\0\20E\30\0\320C\30\0\270E\30\0XA\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0 D\30\0\16\0\20\0HD\30\0\6@\0\0\1\0\0\0\214F\30\0\4D\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00964   396   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\250E\30\0`D\30\0\260E\30\0hD\30\0\0G\30\0\270E\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\6@\14\0\1\0\0\0\344E\30\0xZ\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00965   396   NtReadVirtualMemory  (88, 0x1845a8, 76, ...  (88, 0x1845a8, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0\30E\30\0pD\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0`E\30\0\24\0\26\0\210E\30\0\6@\14\0\1\0\0\0xZ\374wDE\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00966   396   NtReadVirtualMemory  (88, 0x184650, 76, ...  (88, 0x184650, 76, ... "\360F\30\0\250E\30\0\370F\30\0\260E\30\0\330C\30\0\0G\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\0F\30\0\30\0\32\0(F\30\0\6@\0\0\1\0\0\0,G\30\0\234D\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00967   396   NtReadVirtualMemory  (88, 0x1846f0, 76, ...  (88, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0`F\30\0\30E\30\0\0\06v\240\206v\0\360\0\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\6@\10\0\2\0\0\0\20[\374w\214F\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00968   396   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1912,ParentPid=1868,}, 0x0, ) == 0x0
 00969   396   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00970   396   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00971   396   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00972   396   NtReadVirtualMemory  (88, 0x20584, 48, ...  (88, 0x20584, 48, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0E\0x\0p\0l\0o\0r\0e\0r\0.\0E\0X\0E\0\0\0", 48, ) , 48, ) == 0x0
 00973   396   NtOpenProcess  (0x1f0fff, {24, 0, 0x0, 0, 0, 0x0}, {1912, 0}, ... 92, ) == 0x0
 00974   396   NtCreateSection  (0xf0007, 0x0, {36864, 0}, 4, 134217728, 0, ... 96, ) == 0x0
 00975   396   NtMapViewOfSection  (96, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x830000), {0, 0}, 36864, ) == 0x0
 00976   396   NtMapViewOfSection  (96, 92, (0x0), 0, 0, 0x0, 36864, 1, 0, 4, ... (0xf30000), 0x0, 36864, ) == 0x0
 00977   396   NtAllocateVirtualMemory  (92, 0, 0, 1048576, 8192, 4, ... 20578304, 1048576, ) == 0x0
 00978   396   NtAllocateVirtualMemory  (92, 21618688, 0, 8192, 4096, 4, ... 21618688, 8192, ) == 0x0
 00979   396   NtProtectVirtualMemory  (92, (0x149e000), 4096, 260, ... (0x149e000), 4096, 4, ) == 0x0
 00980   396   NtCreateThread  (0x1f03ff, 0x0, 92, 1243172, 1243888, 1, ... 100, {1912, 588}, ) == 0x0
 00981   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400}  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0x\7\0\0L\2\0\0" ... {28, 56, reply, 0, 392, 396, 1500, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0x\7\0\0L\2\0\0" )  ... {28, 56, reply, 0, 392, 396, 1500, 0}  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0x\7\0\0L\2\0\0" ... {28, 56, reply, 0, 392, 396, 1500, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0x\7\0\0L\2\0\0" )  ) == 0x0
 00982   396   NtResumeThread  (100, ... 1, ) == 0x0
 00983   396   NtClose  (100, ... ) == 0x0
 00984   396   NtUnmapViewOfSection  (-1, 0x830000, ... ) == 0x0
 00985   396   NtClose  (96, ... ) == 0x0
 00986   396   NtClose  (92, ... ) == 0x0
 00987   396   NtTerminateProcess  (0, 0, ... ) == 0x0
 00988   396   NtFreeVirtualMemory  (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED
 00989   396   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 392, 396, 1501, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 392, 396, 1501, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 392, 396, 1501, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00990   396   NtTerminateProcess  (-1, 0, ...
 00991   396   NtClose  (44, ... ) == 0x0