Summary:


NtCallbackReturn(>) 
 1 
NtReadFile(>) 
 1 
NtQuerySection(>) 
 2 
NtRequestWaitReplyPort(>) 
 5 

NtCreateFile(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 1 
NtQueryVirtualMemory(>) 
 2 
NtCreateEvent(>) 
 6 

NtCreateThread(>) 
 1 
NtResumeThread(>) 
 1 
NtSetInformationFile(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 

NtFlushInstructionCache(>) 
 1 
NtSecureConnectPort(>) 
 1 
NtSetInformationObject(>) 
 2 
NtQuerySystemInformation(>) 
 10 

NtGdiCreateBitmap(>) 
 1 
NtTestAlert(>) 
 1 
NtTerminateProcess(>) 
 2 
NtOpenSection(>) 
 12 

NtGdiInit(>) 
 1 
NtUnmapViewOfSection(>) 
 1 
NtContinue(>) 
 3 
NtQueryValueKey(>) 
 12 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserCallNoParam(>) 
 1 
NtCreateSection(>) 
 3 
NtMapViewOfSection(>) 
 13 

NtGdiSelectBitmap(>) 
 1 
NtUserGetThreadDesktop(>) 
 1 
NtDuplicateObject(>) 
 3 
NtProtectVirtualMemory(>) 
 13 

NtOpenDirectoryObject(>) 
 1 
NtWriteFile(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtUserRegisterClassExWOW(>) 
 15 

NtOpenKeyedEvent(>) 
 1 
NtCreateIoCompletion(>) 
 2 
NtGdiCreateCompatibleDC(>) 
 3 
NtAllocateVirtualMemory(>) 
 19 

NtOpenMutant(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtOpenProcessToken(>) 
 3 
NtOpenKey(>) 
 21 

NtOpenSymbolicLinkObject(>) 
 1 
NtOpenFile(>) 
 2 
NtSetInformationThread(>) 
 3 
NtOpenProcess(>) 
 34 

NtQueryObject(>) 
 1 
NtOpenProcessTokenEx(>) 
 2 
NtFsControlFile(>) 
 4 
NtQueryInformationProcess(>) 
 60 

NtQuerySymbolicLinkObject(>) 
 1 
NtOpenThreadToken(>) 
 2 
NtQueryAttributesFile(>) 
 4 
NtClose(>) 
 63 

NtQuerySystemTime(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtReadVirtualMemory(>) 
 1385 

NtQueryVolumeInformationFile(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtQueryInformationToken(>) 
 5 

Trace:
 00001   424   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   424   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   424   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   424   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   424   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   424   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   424   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   424   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   424   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   424   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   424   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   424   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   424   NtClose  (12, ... ) == 0x0
 00014   424   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   424   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   424   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   424   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   424   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   424   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   424   NtClose  (16, ... ) == 0x0
 00021   424   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   424   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   424   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   424   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   424   NtClose  (16, ... ) == 0x0
 00026   424   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   424   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   424   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   424   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   424   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   424   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 420, 424, 1477, 0} "`F\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 420, 424, 1477, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 420, 424, 1477, 0} "`F\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   424   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   424   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   424   NtClose  (16, ... ) == 0x0
 00036   424   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   424   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   424   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   424   NtClose  (28, ... ) == 0x0
 00041   424   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   424   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   424   NtClose  (28, ... ) == 0x0
 00045   424   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   424   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   424   NtClose  (28, ... ) == 0x0
 00049   424   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   424   NtClose  (28, ... ) == 0x0
 00052   424   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   424   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   424   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   424   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 420, 424, 1479, 0} "\370\323\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 420, 424, 1479, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 420, 424, 1479, 0} "\370\323\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   424   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00057   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00058   424   NtClose  (28, ... ) == 0x0
 00059   424   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00061   424   NtClose  (28, ... ) == 0x0
 00062   424   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00064   424   NtClose  (28, ... ) == 0x0
 00065   424   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   424   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00067   424   NtClose  (28, ... ) == 0x0
 00068   424   NtProtectVirtualMemory  (-1, (0x409000), 8192, 4, ... (0x409000), 8192, 8, ) == 0x0
 00069   424   NtProtectVirtualMemory  (-1, (0x409000), 8192, 8, ... (0x409000), 8192, 4, ) == 0x0
 00070   424   NtFlushInstructionCache  (-1, 4231168, 8192, ... ) == 0x0
 00071   424   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00072   424   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00073   424   NtClose  (28, ... ) == 0x0
 00074   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00075   424   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00076   424   NtClose  (28, ... ) == 0x0
 00077   424   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00078   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00079   424   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00080   424   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00081   424   NtClose  (28, ... ) == 0x0
 00082   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00083   424   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00084   424   NtClose  (28, ... ) == 0x0
 00085   424   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00086   424   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00087   424   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00088   424   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00089   424   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 420, 424, 1482, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 420, 424, 1482, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 420, 424, 1482, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00090   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   424   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00092   424   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00093   424   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00094   424   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482020, ) == 0x0
 00095   424   NtQueryInformationToken  (-2147482020, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00096   424   NtQueryInformationToken  (-2147482020, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00097   424   NtClose  (-2147482020, ... ) == 0x0
 00098   424   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00099   424   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00100   424   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00101   424   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00102   424   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00103   424   NtClose  (-2147482020, ... ) == 0x0
 00104   424   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00105   424   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00106   424   NtClose  (-2147482020, ... ) == 0x0
 00107   424   NtQueryDefaultLocale  (0, -133133812, ... ) == 0x0
 00108   424   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00109   424   NtUserCallNoParam  (24, ... ) == 0x0
 00110   424   NtGdiCreateCompatibleDC  (0, ...
 00111   424   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00110   424   NtGdiCreateCompatibleDC  ... ) == 0x260102f8
 00112   424   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00113   424   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00114   424   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x27050382
 00115   424   NtGdiCreateSolidBrush  (0, 0, ...
 00116   424   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8519680, 4096, ) == 0x0
 00115   424   NtGdiCreateSolidBrush  ... ) == 0x121003dc
 00117   424   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00118   424   NtGdiCreateCompatibleDC  (0, ... ) == 0x390103e4
 00119   424   NtGdiSelectBitmap  (956367844, 654640002, ... ) == 0x185000f
 00120   424   NtUserGetThreadDesktop  (424, 0, ... ) == 0x2c
 00121   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00122   424   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00123   424   NtClose  (52, ... ) == 0x0
 00124   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00125   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017
 00126   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00127   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c
 00128   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00129   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e
 00130   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00131   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002
 00132   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00133   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018
 00134   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00135   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a
 00136   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00137   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d
 00138   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00139   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00140   424   NtAllocateVirtualMemory  (-1, 5468160, 0, 4096, 4096, 32, ... 5468160, 4096, ) == 0x0
 00139   424   NtUserRegisterClassExWOW  ... ) == 0x810dc026
 00141   424   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   424   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019
 00143   424   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020
 00144   424   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022
 00145   424   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023
 00146   424   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024
 00147   424   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc025
 00148   424   NtCallbackReturn  (0, 0, 0, ...
 00149   424   NtGdiInit  (... ) == 0x1
 00150   424   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00151   424   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00152   424   NtTestAlert  (... ) == 0x0
 00153   424   NtContinue  (1244464, 1, ...
 00154   424   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40920c,}, 4, ... ) == 0x0
 00155   424   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 52, ) == 0x0
 00156   424   NtQueryInformationProcess  (52, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 00157   424   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 8585216, 4096, ) == 0x0
 00158   424   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 56, ) == 0x0
 00159   424   NtQueryInformationProcess  (56, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=420,ParentPid=180,}, 24, ) == 0x0
 00160   424   NtClose  (56, ... ) == 0x0
 00161   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {180, 0}, ... 56, ) == 0x0
 00162   424   NtProtectVirtualMemory  (-1, (0x77e616b4), 127, 64, ... (0x77e61000), 4096, 32, ) == 0x0
 00163   424   NtReadVirtualMemory  (56, 0x77e616b4, 127, ...  (56, 0x77e616b4, 127, ... "\203|$\4\0t\30\377t$\10\377t$\10\377\25\354\23\346w\205\300|\173\300@\302\10\0j\6\350*_\1\0\353\6P\350\330_\1\03\300\353\352d\241\30\0\0\0\213@0\213H\20\213D$\4\307\0D\0\0\0\213\221\204\0\0\0\211P\4\213Q|\211P\10\213Qt\211P\14\213QL\211P\20\213QP\211P\24\213QT\211P\30\213QX\211P\34\213Q\\211P \213Q`\211", 127, ) , 127, ) == 0x0
 00164   424   NtProtectVirtualMemory  (-1, (0x77eba6e9), 127, 64, ... (0x77eba000), 4096, 32, ) == 0x0
 00165   424   NtReadVirtualMemory  (56, 0x77eba6e9, 127, ...  (56, 0x77eba6e9, 127, ... "U\213\354\201\354,\2\0\0V\213u\14\205\366\17\204\224\0\0\0\201>(\1\0\0\17\202\210\0\0\0S\215\205\324\375\377\377P\377u\10\307\205\324\375\377\377,\2\0\0\350+\377\377\377j\0j\0h\4\1\0\0\213\330\215F$Pj\377\215\205\370\375\377\377Pj\0j\0\350\337\361\373\377\213\205\330\375\377\377\211F\4\213\205\334\375\377\377\211F\10\213\205\340\375\377\377\211F\14\213\205\344\375\377\377\211F", 127, ) , 127, ) == 0x0
 00166   424   NtProtectVirtualMemory  (-1, (0x77eba64f), 127, 64, ... (0x77eba000), 4096, 64, ) == 0x0
 00167   424   NtReadVirtualMemory  (56, 0x77eba64f, 127, ...  (56, 0x77eba64f, 127, ... "U\213\354\203\354\14VW\213}\143\366;\376tw\201?,\2\0\0uoj\4Vj\1\215E\374P\215E\364PVV\215E\14Pj\377\377u\10\211u\364\211u\370\211u\374\211u\14\377\25H\22\346w;\306}\3P\353C\213E\14\213H$;H\4s\35\213\361i\366,\2\0\0\3p\24\3\360A\211H$\271\213\0\0\0\363\2453\366F\353\7j\22\350<\317\373\377\377u\14j\377\377", 127, ) , 127, ) == 0x0
 00168   424   NtProtectVirtualMemory  (-1, (0x77ebaafa), 127, 64, ... (0x77eba000), 4096, 64, ) == 0x0
 00169   424   NtReadVirtualMemory  (56, 0x77ebaafa, 127, ...  (56, 0x77ebaafa, 127, ... "U\213\354\201\354(\4\0\0V\213u\14W3\377;\367\17\204\234\0\0\0\201>$\2\0\0\17\202\220\0\0\0S\215\205\330\373\377\377P\377u\10\307\205\330\373\377\377(\4\0\0\350(\377\377\377WWh\0\1\0\0\213\330\215F Pj\377\215\205\370\373\377\377PWW\350\317\355\373\377WWh\4\1\0\0\215\206 \1\0\0Pj\377\215\205\370\375\377\377PWW\350\261\355\373\377\213\205\334\373\377\377", 127, ) , 127, ) == 0x0
 00170   424   NtProtectVirtualMemory  (-1, (0x77e7751a), 127, 64, ... (0x77e77000), 4096, 32, ) == 0x0
 00171   424   NtReadVirtualMemory  (56, 0x77e7751a, 127, ...  (56, 0x77e7751a, 127, ... "\272\0\0\376\177\213\2\367b\4\17\254\320\30\303\213D$\10\203\370\377\17\204\210\3\0\0\271\20'\0\0\367\341\213L$\4\211\1\367\330\211Q\4\203\322\0\367\332\211\1\211Q\4\213\301\302\10\0\215E\324P\377\25,\22\346w\303j,h0!\350w\350s\377\377\377\307E\324\24\0\0\0\307E\330\1\0\0\03\300\215}\334\253\253\2533\366V\215E\324P\377\250\22\346w\211u\374\377u\10\215E", 127, ) , 127, ) == 0x0
 00172   424   NtProtectVirtualMemory  (-1, (0x77e7ac37), 127, 64, ... (0x77e7a000), 4096, 32, ) == 0x0
 00173   424   NtReadVirtualMemory  (56, 0x77e7ac37, 127, ...  (56, 0x77e7ac37, 127, ... "U\213\354\377u\34\377u\30\377u\24\377u\20\377u\14\377u\10j\377\3500\376\377\377]\302\30\0\213\302\351m\374\377\377U\213\354\203\354 S\377u\10\215E\340P\377\25\200\22\346wj\1\215E\340P\215E\350P\377\25\210\20\346w3\333;\303\17\214\267\215\2\0V\213u\20\270\375\177\0\0;\360W\17\207#Z\0\0;\363\213\306\17\205\31Z\0\03\300\3\300f\211E\372d\241\30\0\0\0", 127, ) , 127, ) == 0x0
 00174   424   NtProtectVirtualMemory  (-1, (0x77e7c4b7), 127, 64, ... (0x77e7c000), 4096, 32, ) == 0x0
 00175   424   NtReadVirtualMemory  (56, 0x77e7c4b7, 127, ...  (56, 0x77e7c4b7, 127, ... "U\213\354V\2135\260\22\346wW\377u\30\215E\20\377u\24P\215E\14P\377u\10\377\326\213\370\205\377\17\214\271b\2\03\300@_^]\302\24\0\213D$\4\243\220c\355w\302\4\0\377\25\270\20\346w95$`\355wuK\241<`\355wSWj@\203\300\20[\211E\340\215E\330P\277\17\0\2\0W\215E\370\211u\334\211u\350\211u\354\2135\370\21\346wP\307E\330\30\0\0\0", 127, ) , 127, ) == 0x0
 00176   424   NtClose  (56, ... ) == 0x0
 00177   424   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 56, ) == 0x0
 00178   424   NtQueryInformationProcess  (56, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 00179   424   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 60, ) == 0x0
 00180   424   NtQueryInformationProcess  (60, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 00181   424   NtProtectVirtualMemory  (-1, (0x400000), 45056, 64, ... (0x400000), 45056, 2, ) == 0x0
 00182   424   NtAllocateVirtualMemory  (-1, 0, 0, 188416, 4096, 64, ... 8650752, 188416, ) == 0x0
 00183   424   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 64, ) }, ... 64, ) == 0x0
 00184   424   NtQueryValueKey  (64,  (64, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00185   424   NtClose  (64, ... ) == 0x0
 00186   424   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 128, ) == 0x0
 00187   424   NtProtectVirtualMemory  (-1, (0x400000), 4096, 128, ... (0x400000), 4096, 4, ) == 0x0
 00188   424   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "psapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00189   424   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00190   424   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\psapi.dll"}, 1237848, ... ) }, 1237848, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00191   424   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "psapi.dll"}, 1237848, ... ) }, 1237848, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00192   424   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 1237848, ... ) }, 1237848, ... ) == 0x0
 00193   424   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00194   424   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 64, ... 68, ) == 0x0
 00195   424   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00196   424   NtOpenProcessToken  (-1, 0x8, ... 72, ) == 0x0
 00197   424   NtQueryInformationToken  (72, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00198   424   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00199   424   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 76, ) }, ... 76, ) == 0x0
 00200   424   NtQueryValueKey  (76,  (76, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (76, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00201   424   NtClose  (76, ... ) == 0x0
 00202   424   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00203   424   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 76, ) == 0x0
 00204   424   NtQueryInformationToken  (76, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00205   424   NtClose  (76, ... ) == 0x0
 00206   424   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00207   424   NtClose  (72, ... ) == 0x0
 00208   424   NtClose  (64, ... ) == 0x0
 00209   424   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bf0000), 0x0, 45056, ) == 0x0
 00210   424   NtClose  (68, ... ) == 0x0
 00211   424   NtAllocateVirtualMemory  (-1, 1327104, 0, 36864, 4096, 4, ... 1327104, 36864, ) == 0x0
 00212   424   NtQuerySystemInformation  (ProcessesAndThreads, 32768, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00213   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {4, 0}, ... 68, ) == 0x0
 00214   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x0,AffinityMask=0x1,BasePriority=8,Pid=4,ParentPid=0,}, 0x0, ) == 0x0
 00215   424   NtReadVirtualMemory  (68, 0xc, 4, ...
 00216   424   NtContinue  (-133137252, 0, ...
 00215   424   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00217   424   NtClose  (68, ... ) == 0x0
 00218   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {356, 0}, ... 68, ) == 0x0
 00219   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00220   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00221   424   NtReadVirtualMemory  (68, 0x261ea4, 4, ...  (68, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00222   424   NtReadVirtualMemory  (68, 0x261ec0, 76, ...  (68, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00223   424   NtReadVirtualMemory  (68, 0x261f18, 76, ...  (68, 0x261f18, 76, ... "\234\36&\0\300\36&\0\244\36&\0\310\36&\0\254\36&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00224   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00225   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00226   424   NtReadVirtualMemory  (68, 0x261ea4, 4, ...  (68, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00227   424   NtReadVirtualMemory  (68, 0x261ec0, 76, ...  (68, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00228   424   NtReadVirtualMemory  (68, 0x1106a0, 60, ...  (68, 0x1106a0, 60, ... "\\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0m\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00229   424   NtClose  (68, ... ) == 0x0
 00230   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {592, 0}, ... 68, ) == 0x0
 00231   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 00232   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00233   424   NtReadVirtualMemory  (68, 0x261ea4, 4, ...  (68, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00234   424   NtReadVirtualMemory  (68, 0x261ec0, 76, ...  (68, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00235   424   NtReadVirtualMemory  (68, 0x261f18, 76, ...  (68, 0x261f18, 76, ... "\270\37&\0\300\36&\0\300\37&\0\310\36&\0\310\37&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\4\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00236   424   NtReadVirtualMemory  (68, 0x261fb8, 76, ...  (68, 0x261fb8, 76, ... "X &\0\30\37&\0` &\0 \37&\0h &\0(\37&\0\0\0\264u\0\0\0\0\0\240\0\0<\0>\0p\37&\0\24\0\26\0\230\37&\0\6@\0\0\377\377\0\0pZ\374w\374\36&\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00237   424   NtReadVirtualMemory  (68, 0x262058, 76, ...  (68, 0x262058, 76, ... "\370 &\0\270\37&\0\0!&\0\300\37&\0P"&\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) &\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) == 0x0
 00238   424   NtReadVirtualMemory  (68, 0x2620f8, 76, ...  (68, 0x2620f8, 76, ... "\230!&\0X &\0\240!&\0` &\0\320$&\0\250!&\0\0\0\266u\0\0\0\0\0`\4\0<\0>\0\260 &\0\24\0\26\0\330 &\0\4@\0\0\2\0\0\0\20[\374w\20[\374w\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00239   424   NtReadVirtualMemory  (68, 0x262198, 76, ...  (68, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\370 &\0H (68, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00240   424   NtReadVirtualMemory  (68, 0x262240, 76, ...  (68, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\230!&\0\350 (68, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00241   424   NtReadVirtualMemory  (68, 0x2622e0, 76, ...  (68, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\220#&\0H (68, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\22\0\24\0\300 (68, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00242   424   NtReadVirtualMemory  (68, 0x262388, 76, ...  (68, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\00$&\0\350 (68, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00243   424   NtReadVirtualMemory  (68, 0x262428, 76, ...  (68, 0x262428, 76, ... "\300$&\0\210#&\0\310$&\0\220#&\0\230#&\0P"&\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00244   424   NtReadVirtualMemory  (68, 0x2624c0, 76, ...  (68, 0x2624c0, 76, ... "\234\36&\0($&\0\244\36&\00$&\0\254\36&\0\10!&\0\0\0\351u\212\23\351u\0\20\12\06\08\0\200$&\0\16\0\20\0\250$&\0\4@\10\0\1\0\0\0\360Z\374w\360Z\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00245   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 00246   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00247   424   NtReadVirtualMemory  (68, 0x261ea4, 4, ...  (68, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00248   424   NtReadVirtualMemory  (68, 0x261ec0, 76, ...  (68, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00249   424   NtReadVirtualMemory  (68, 0x110534, 68, ...  (68, 0x110534, 68, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0s\0r\0s\0s\0.\0e\0x\0e\0\0\0", 68, ) , 68, ) == 0x0
 00250   424   NtClose  (68, ... ) == 0x0
 00251   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {616, 0}, ... 68, ) == 0x0
 00252   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 00253   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00254   424   NtReadVirtualMemory  (68, 0x171ea4, 4, ...  (68, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00255   424   NtReadVirtualMemory  (68, 0x171ec0, 76, ...  (68, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00256   424   NtReadVirtualMemory  (68, 0x171f18, 76, ...  (68, 0x171f18, 76, ... "\300\37\27\0\300\36\27\0\310\37\27\0\310\36\27\0\320\37\27\0\254\36\27\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\244%\27\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00257   424   NtReadVirtualMemory  (68, 0x171fc0, 76, ...  (68, 0x171fc0, 76, ... "h \27\0\30\37\27\0p \27\0 \37\27\0\30!\27\0(\37\27\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\27\0\30\0\32\0\230\37\27\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00258   424   NtReadVirtualMemory  (68, 0x172068, 76, ...  (68, 0x172068, 76, ... "\10!\27\0\300\37\27\0\20!\27\0\310\37\27\0X"\27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) \27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00259   424   NtReadVirtualMemory  (68, 0x172108, 76, ...  (68, 0x172108, 76, ... "\250!\27\0h \27\0\260!\27\0p \27\0x \27\0\320\37\27\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \27\0\24\0\26\0\350 \27\0\6@\10\0\377\377\0\0\314(\27\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00260   424   NtReadVirtualMemory  (68, 0x1721a8, 76, ...  (68, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\10!\27\0P (68, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) == 0x0
 00261   424   NtReadVirtualMemory  (68, 0x172248, 76, ...  (68, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\250!\27\0\360 (68, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\24\0\26\0( (68, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00262   424   NtReadVirtualMemory  (68, 0x1722e8, 76, ...  (68, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\220#\27\0P (68, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\26\0\30\0\310 (68, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00263   424   NtReadVirtualMemory  (68, 0x172388, 76, ...  (68, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) \27\00$\27\0\360 (68, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00264   424   NtReadVirtualMemory  (68, 0x172428, 76, ...  (68, 0x172428, 76, ... "\310$\27\0\210#\27\0\320$\27\0\220#\27\0\230#\27\0\270!\27\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\27\0\22\0\24\0\10$\27\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00265   424   NtReadVirtualMemory  (68, 0x1724c8, 76, ...  (68, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) \27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204 (68, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00266   424   NtReadVirtualMemory  (68, 0x172568, 76, ...  (68, 0x172568, 76, ... "\10&\27\0\310$\27\0\20&\27\0\320$\27\0\300&\27\0\370"\27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) \27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) == 0x0
 00267   424   NtReadVirtualMemory  (68, 0x172608, 76, ...  (68, 0x172608, 76, ... "\260&\27\0h%\27\0\270&\27\0p%\27\0\0(\27\0`'\27\0\0\0\223u \22\223u\0\240\0\0>\0@\0\300%\27\0\26\0\30\0\350%\27\0\6@\10\0\377\377\0\0,(\27\0\330Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00268   424   NtReadVirtualMemory  (68, 0x1726b0, 76, ...  (68, 0x1726b0, 76, ... "P'\27\0\10&\27\0X'\27\0\20&\27\0`'\27\0x%\27\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0`&\27\0\30\0\32\0\210&\27\0\6@\14\0\377\377\0\0|?\27\0\244%\27\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00269   424   NtReadVirtualMemory  (68, 0x172750, 76, ...  (68, 0x172750, 76, ... "\360'\27\0\260&\27\0\370'\27\0\270&\27\0\30&\27\0\300&\27\0\0\0\247uM\31\247u\00\12\0>\0@\0\10'\27\0\26\0\30\00'\27\0\6@\14\0\377\377\0\0\3348\27\0\304#\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00270   424   NtReadVirtualMemory  (68, 0x1727f0, 76, ...  (68, 0x1727f0, 76, ... "\220(\27\0P'\27\0\230(\27\0X'\27\0\240(\27\0\30&\27\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\250'\27\0\22\0\24\0\320'\27\0\6@\14\0\377\377\0\0\330Z\374wD&\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00271   424   NtReadVirtualMemory  (68, 0x172890, 76, ...  (68, 0x172890, 76, ... "0)\27\0\360'\27\08)\27\0\370'\27\0@)\27\0\0(\27\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0H(\27\0\24\0\26\0p(\27\0\6@\10\0\377\377\0\0T<\27\0D!\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00272   424   NtReadVirtualMemory  (68, 0x172930, 76, ...  (68, 0x172930, 76, ... "\330)\27\0\220(\27\0\340)\27\0\230(\27\0\350)\27\0\240(\27\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\350(\27\0\26\0\30\0\20)\27\0\6@\14\0\377\377\0\0\24*\27\0\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00273   424   NtReadVirtualMemory  (68, 0x1729d8, 76, ...  (68, 0x1729d8, 76, ... "x*\27\00)\27\0\200*\27\08)\27\0\320+\27\0@)\27\0\0\0gv8\25gv\0@\16\0@\0B\0\210)\27\0\30\0\32\0\260)\27\0\6@\10\0\377\377\0\0\264*\27\0l)\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00274   424   NtReadVirtualMemory  (68, 0x172a78, 76, ...  (68, 0x172a78, 76, ... " +\27\0\330)\27\0(+\27\0\340)\27\0\30-\27\00+\27\0\0\0\306v\355\346\306v\0\220\2\0<\0>\00*\27\0\24\0\26\0X*\27\0\6@\14\0\377\377\0\0d0\27\0\24*\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00275   424   NtReadVirtualMemory  (68, 0x172b20, 76, ...  (68, 0x172b20, 76, ... "\300+\27\0x*\27\0\310+\27\0\200*\27\0\210*\27\0x,\27\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320*\27\0\30\0\32\0\370*\27\0\6@\14\0\377\377\0\0\344-\27\0\374\36\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00276   424   NtReadVirtualMemory  (68, 0x172bc0, 76, ...  (68, 0x172bc0, 76, ... "h,\27\0 +\27\0p,\27\0(+\27\0x,\27\0\350)\27\0\0\0\33wp\10\34w\0\240\21\0:\0<\0x+\27\0\22\0\24\0\240+\27\0\6@\10\0\377\377\0\0L2\27\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00277   424   NtReadVirtualMemory  (68, 0x172c68, 76, ...  (68, 0x172c68, 76, ... "\10-\27\0\300+\27\0\20-\27\0\310+\27\00+\27\0\320+\27\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\30,\27\0\30\0\32\0@,\27\0\6@\14\0\377\377\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00278   424   NtReadVirtualMemory  (68, 0x172d08, 76, ...  (68, 0x172d08, 76, ... "\250-\27\0h,\27\0\260-\27\0p,\27\0\270-\27\0\210*\27\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\300,\27\0\26\0\30\0\350,\27\0\6@\10\0\377\377\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00279   424   NtReadVirtualMemory  (68, 0x172da8, 76, ...  (68, 0x172da8, 76, ... "H.\27\0\10-\27\0P.\27\0\20-\27\0\370.\27\0\30-\27\0\0\06v\240\206v\0\360\0\0<\0>\0`-\27\0\24\0\26\0\210-\27\0\6@\10\0\377\377\0\0\204.\27\0\+\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00280   424   NtReadVirtualMemory  (68, 0x172e48, 76, ...  (68, 0x172e48, 76, ... "\350.\27\0\250-\27\0\360.\27\0\260-\27\0\3300\27\0\370.\27\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\0.\27\0\24\0\26\0(.\27\0\6@\10\0\377\377\0\0$/\27\0\344-\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00281   424   NtReadVirtualMemory  (68, 0x172ee8, 76, ...  (68, 0x172ee8, 76, ... "\210/\27\0H.\27\0\220/\27\0P.\27\0X.\27\0\270-\27\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\240.\27\0\26\0\30\0\310.\27\0\6@\14\0\377\377\0\0\2546\27\0\204.\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00282   424   NtReadVirtualMemory  (68, 0x172f88, 76, ...  (68, 0x172f88, 76, ... "(0\27\0\350.\27\000\27\0\360.\27\0\04\27\0 2\27\0\0\0\227u\31\32\227u\0\20\17\0<\0>\0@/\27\0\24\0\26\0h/\27\0\4@\14\0\2\0\0\0\264;\27\0\4%\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00283   424   NtReadVirtualMemory  (68, 0x173028, 76, ...  (68, 0x173028, 76, ... "\3100\27\0\210/\27\0\3200\27\0\220/\27\0\2001\27\0\3300\27\0\0\0=w\24 ?w\0@\177\0>\0@\0\340/\27\0\26\0\30\0\100\27\0\6@\10\0\21\0\0\0\41\27\0\264*\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00284   424   NtReadVirtualMemory  (68, 0x1730c8, 76, ...  (68, 0x1730c8, 76, ... "p1\27\0(0\27\0x1\27\000\27\080\27\0X.\27\0\0\0-w\306@-w\00\6\0>\0@\0\2000\27\0\26\0\30\0\2500\27\0\6@\14\0\35\0\0\0l5\27\0d0\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00285   424   NtReadVirtualMemory  (68, 0x173170, 76, ...  (68, 0x173170, 76, ... "\202\27\0\3100\27\0\302\27\0\3200\27\0\3102\27\080\27\0\0\04wY\324w\0\260\10\0@\0B\0 1\27\0\30\0\32\0H1\27\0\6@\14\0\10\0\0\0\3642\27\0$#\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00286   424   NtReadVirtualMemory  (68, 0x173210, 76, ...  (68, 0x173210, 76, ... "\2702\27\0p1\27\0\3002\27\0x1\27\0\230/\27\0\3102\27\0\0\0{\37\200F{\37\0\20\3\0<\0>\0\3101\27\0\24\0\26\0\3601\27\0\6@\14\0\2\0\0\0\3144\27\0\374+\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00287   424   NtReadVirtualMemory  (68, 0x1732b8, 76, ...  (68, 0x1732b8, 76, ... "\3603\27\0\202\27\0\3703\27\0\302\27\0 2\27\0\2001\27\0\0\0;v\0\26;v\0P\4\0@\0B\0h2\27\0\30\0\32\0\2202\27\0\6@\14\0\3\0\0\0,4\27\0\2541\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00288   424   NtReadVirtualMemory  (68, 0x1733f0, 76, ...  (68, 0x1733f0, 76, ... "\2204\27\0\2702\27\0\2304\27\0\3002\27\0\2404\27\0\230/\27\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\203\27\0\30\0\32\0\3163\27\0\4@\14\20\3\0\0\0\34:\27\0\3642\27\02\376};\370\254\7\0", 76, ) , 76, ) == 0x0
 00289   424   NtReadVirtualMemory  (68, 0x173490, 76, ...  (68, 0x173490, 76, ... "05\27\0\3603\27\085\27\0\3703\27\0@5\27\0\04\27\0\0\0\205\37\0\0\0\0\0`\1\0>\0@\0H4\27\0\26\0\30\0p4\27\0\4@\0\0\1\0\0\0\374F\27\0L2\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00290   424   NtReadVirtualMemory  (68, 0x173530, 76, ...  (68, 0x173530, 76, ... "\3105\27\0\2204\27\0\3205\27\0\2304\27\0\3305\27\0\2404\27\0\0\0\275vG"\276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) == 0x0
 00291   424   NtReadVirtualMemory  (68, 0x1735c8, 76, ...  (68, 0x1735c8, 76, ... "p6\27\005\27\0x6\27\085\27\0(7\27\0@5\27\0\0\0\273v\0\0\0\0\0@\0\06\08\0\2105\27\0\16\0\20\0\2605\27\0\4@\0\0\2\0\0\0\3747\27\0l5\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00292   424   NtReadVirtualMemory  (68, 0x173670, 76, ...  (68, 0x173670, 76, ... "\307\27\0\3105\27\0 7\27\0\3205\27\0\3207\27\0(7\27\0\0\0=r\240\22=r\0\240\1\0@\0B\0 6\27\0\30\0\32\0H6\27\0\4@\10\0\7\0\0\0T7\27\0$/\27\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00293   424   NtReadVirtualMemory  (68, 0x173718, 76, ...  (68, 0x173718, 76, ... "\3007\27\0p6\27\0\3107\27\0x6\27\0\2006\27\0\3305\27\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\3106\27\0\30\0\32\0\3606\27\0\6@\0\0\7\0\0\0|9\27\0\2546\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00294   424   NtReadVirtualMemory  (68, 0x1737c0, 76, ...  (68, 0x1737c0, 76, ... "\2408\27\0\307\27\0\2508\27\0 7\27\0\2608\27\0\2006\27\0\0\0\351u\212\23\351u\0\20\12\06\08\0\308\27\0\16\0\20\0@8\27\0\4@\10\0\1\0\0\0\224=\27\0\46\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00295   424   NtReadVirtualMemory  (68, 0x1738a0, 76, ...  (68, 0x1738a0, 76, ... "@9\27\0\3007\27\0H9\27\0\3107\27\0P9\27\0\3207\27\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0X8\27\0\26\0\30\0\2008\27\0\4@\10\0\5\0\0\0\0[\374w\214'\27\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00296   424   NtReadVirtualMemory  (68, 0x173940, 76, ...  (68, 0x173940, 76, ... "\3409\27\0\2408\27\0\3509\27\0\2508\27\0\3609\27\0\2608\27\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\3708\27\0\22\0\24\0 9\27\0\4@\14\0\7\0\0\0t:\27\0T7\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00297   424   NtReadVirtualMemory  (68, 0x1739e0, 76, ...  (68, 0x1739e0, 76, ... "8:\27\0@9\27\0@:\27\0H9\27\0\360:\27\0P9\27\0\0\0`v\20\22`v\0\260\1\0<\0>\0\2309\27\0\24\0\26\0\3009\27\0\4@\10\0\3\0\0\04>\27\0,4\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00298   424   NtReadVirtualMemory  (68, 0x173a38, 76, ...  (68, 0x173a38, 76, ... "\340:\27\0\3409\27\0\350:\27\0\3509\27\0(<\27\0\210;\27\0\0\0\225um\25\225u\0\220\1\0@\0B\0p7\27\0\30\0\32\0\2307\27\0\4@\14\0\6\0\0\0\34;\27\0|9\27\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00299   424   NtReadVirtualMemory  (68, 0x173ae0, 76, ...  (68, 0x173ae0, 76, ... "x;\27\08:\27\0\200;\27\0@:\27\0\210;\27\0\3609\27\0\0\0\0s\372\26\0s\00\2\0@\0B\0\220:\27\0\30\0\32\0\270:\27\0\6@\14\0\6\0\0\0\34E\27\0t:\27\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00300   424   NtReadVirtualMemory  (68, 0x173b78, 76, ...  (68, 0x173b78, 76, ... "\30<\27\0\340:\27\0 <\27\0\350:\27\0H:\27\0\360:\27\0\0\0\262q\234\21\262q\0\20\1\06\08\08;\27\0\16\0\20\0`;\27\0\6@\14\0\12\0\0\0\364<\27\0\304/\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00301   424   NtReadVirtualMemory  (68, 0x173c18, 76, ...  (68, 0x173c18, 76, ... "\270<\27\0x;\27\0\300<\27\0\200;\27\0\310<\27\0H:\27\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\320;\27\0\24\0\26\0\370;\27\0\4@\14\0\1\0\0\0\350Z\374w\314(\27\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00302   424   NtReadVirtualMemory  (68, 0x173cb8, 76, ...  (68, 0x173cb8, 76, ... "X=\27\0\30<\27\0`=\27\0 <\27\0h=\27\0(<\27\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0p<\27\0\24\0\26\0\230<\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 00303   424   NtReadVirtualMemory  (68, 0x173d58, 76, ...  (68, 0x173d58, 76, ... "\370=\27\0\270<\27\0\0>\27\0\300<\27\0\10>\27\0\310<\27\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\20=\27\0\24\0\26\08=\27\0\4@\10\0\5\0\0\0\360Z\374w\3747\27\01\376};\220a\10\0", 76, ) , 76, ) == 0x0
 00304   424   NtReadVirtualMemory  (68, 0x173df8, 76, ...  (68, 0x173df8, 76, ... "\240>\27\0X=\27\0\250>\27\0`=\27\0\260>\27\0h=\27\0\0\0bv\316\26bv\0\340\4\0:\0<\0\260=\27\0\22\0\24\0\330=\27\0\4@\14\0\1\0\0\0TF\27\0\34:\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00305   424   NtReadVirtualMemory  (68, 0x173ea0, 76, ...  (68, 0x173ea0, 76, ... "@?\27\0\370=\27\0H?\27\0\0>\27\0\360?\27\0\10>\27\0\0\0\366ux\20\366u\0`\0\0<\0>\0\370>\27\0\24\0\26\0 ?\27\0\4@\14\0\1\0\0\0\374A\27\0xZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00306   424   NtReadVirtualMemory  (68, 0x173f40, 76, ...  (68, 0x173f40, 76, ... "\340?\27\0\240>\27\0\350?\27\0\250>\27\0\320A\27\0\220@\27\0\0\0\301q\12\23\301q\0\320\0\0@\0B\0P>\27\0\30\0\32\0x>\27\0\4@\14\0\1\0\0\0\34@\27\0\354&\27\04\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00307   424   NtReadVirtualMemory  (68, 0x173fe0, 76, ...  (68, 0x173fe0, 76, ... "\200@\27\0@?\27\0\210@\27\0H?\27\00A\27\0\260>\27\0\0\0\315q\6\22\315q\0`\1\0<\0>\0\230?\27\0\24\0\26\0\300?\27\0\6@\14\0\5\0\0\0\274@\27\0|?\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00308   424   NtReadVirtualMemory  (68, 0x174080, 76, ...  (68, 0x174080, 76, ... " A\27\0\340?\27\0(A\27\0\350?\27\0P?\27\00A\27\0\0\0\311qP\26\311q\0\300\3\0<\0>\08@\27\0\24\0\26\0`@\27\0\6@\14\0\2\0\0\0\A\27\0\34@\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00309   424   NtReadVirtualMemory  (68, 0x174120, 76, ...  (68, 0x174120, 76, ... "\300A\27\0\200@\27\0\310A\27\0\210@\27\0\220@\27\0\360?\27\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\330@\27\0\24\0\26\0\0A\27\0\6@\0\0\2\0\0\0\334C\27\0\274@\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00310   424   NtReadVirtualMemory  (68, 0x1741c0, 76, ...  (68, 0x1741c0, 76, ... "`B\27\0 A\27\0hB\27\0(A\27\0pB\27\0P?\27\0\0\0\367uB\21\367u\0\220\0\0>\0@\0xA\27\0\26\0\30\0\240A\27\0\4@\14\0\1\0\0\0xZ\374w\334>\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00311   424   NtReadVirtualMemory  (68, 0x174260, 76, ...  (68, 0x174260, 76, ... "\0C\27\0\300A\27\0\10C\27\0\310A\27\0\260C\27\0\320A\27\0\0\0\0\20\340t\0\20\0\0\2\0:\0<\0\30B\27\0\22\0\24\0@B\27\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374w\340Z\332D\0\0\0\0", 76, ) , 76, ) == 0x0
 00312   424   NtReadVirtualMemory  (68, 0x174300, 76, ...  (68, 0x174300, 76, ... "\240C\27\0`B\27\0\250C\27\0hB\27\0PD\27\0\260C\27\0\0\0\260q>\23\260q\0\360\0\0:\0<\0\270B\27\0\22\0\24\0\340B\27\0\4@\14\0\1\0\0\0\300Z\374w\364<\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00313   424   NtReadVirtualMemory  (68, 0x1743a0, 76, ...  (68, 0x1743a0, 76, ... "@D\27\0\0C\27\0HD\27\0\10C\27\0\20C\27\0pB\27\0\0\0\272qp\27\272q\0\340\4\0<\0>\0XC\27\0\24\0\26\0\200C\27\0\6@\14\0\1\0\0\0|D\27\0\A\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00314   424   NtReadVirtualMemory  (68, 0x174440, 76, ...  (68, 0x174440, 76, ... "\340D\27\0\240C\27\0\350D\27\0\250C\27\0\360D\27\0\20C\27\0\0\0\264q\0\0\0\0\0\300\2\0<\0>\0\370C\27\0\24\0\26\0 D\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 00315   424   NtReadVirtualMemory  (68, 0x1744e0, 76, ...  (68, 0x1744e0, 76, ... "\30F\27\0@D\27\0 F\27\0HD\27\0(F\27\0PD\27\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\230D\27\0\26\0\30\0\300D\27\0\4@\10\0\2\0\0\0\20[\374w\34;\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00316   424   NtReadVirtualMemory  (68, 0x174618, 76, ...  (68, 0x174618, 76, ... "\300F\27\0\340D\27\0\310F\27\0\350D\27\0\320F\27\0\360D\27\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320E\27\0\24\0\26\0\370E\27\0\6@\14\0\2\0\0\0\234G\27\04>\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00317   424   NtReadVirtualMemory  (68, 0x1746c0, 76, ...  (68, 0x1746c0, 76, ... "`G\27\0\30F\27\0hG\27\0 F\27\0pG\27\0(F\27\0\0\0\22w\360+\23w\0\260\10\0@\0B\0pF\27\0\30\0\32\0\230F\27\0\6@\10\0\2\0\0\0\320Z\374w\3144\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00318   424   NtReadVirtualMemory  (68, 0x174760, 76, ...  (68, 0x174760, 76, ... "\0H\27\0\300F\27\0\10H\27\0\310F\27\0\20H\27\0\320F\27\0\0\0\375v%0\375v\0\200\7\0>\0@\0\30G\27\0\26\0\30\0@G\27\0\4@\14\0\2\0\0\0pZ\374wTF\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00319   424   NtReadVirtualMemory  (68, 0x174800, 76, ...  (68, 0x174800, 76, ... "\234\36\27\0`G\27\0\244\36\27\0hG\27\0\254\36\27\0pG\27\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\270G\27\0\26\0\30\0\340G\27\0\4@\14\0\1\0\0\0\310Z\374w|D\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00320   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 00321   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00322   424   NtReadVirtualMemory  (68, 0x171ea4, 4, ...  (68, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00323   424   NtReadVirtualMemory  (68, 0x171ec0, 76, ...  (68, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00324   424   NtReadVirtualMemory  (68, 0x20534, 74, ...  (68, 0x20534, 74, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0l\0o\0g\0o\0n\0.\0e\0x\0e\0\0\0", 74, ) , 74, ) == 0x0
 00325   424   NtClose  (68, ... ) == 0x0
 00326   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {660, 0}, ... 68, ) == 0x0
 00327   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 00328   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00329   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00330   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00331   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00332   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00333   424   NtReadVirtualMemory  (68, 0x182060, 76, ...  (68, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\300Z\374w\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00334   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00335   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00336   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00337   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00338   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00339   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0 &\30\0\330$\30\0\0\0\216u\20\24\216u\0\320\4\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\377\377\377\377\224'\30\0\374\36\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00340   424   NtReadVirtualMemory  (68, 0x1824c8, 76, ...  (68, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\08$\30\0\230#\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0`Z\374wD!\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00341   424   NtReadVirtualMemory  (68, 0x182570, 76, ...  (68, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0\310&\30\0 &\30\0\0\0\214u\203\27\214u\0\300\1\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\0[\374w\304#\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00342   424   NtReadVirtualMemory  (68, 0x182610, 76, ...  (68, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\200%\30\08$\30\0\0\06v\240\206v\0\360\0\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\10\0\377\377\0\0\334(\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00343   424   NtReadVirtualMemory  (68, 0x1826b8, 76, ...  (68, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0h'\30\0\200%\30\0\0\0w_5\21w_\0\340\0\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\10\0\377\377\0\0l+\30\0T\37\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00344   424   NtReadVirtualMemory  (68, 0x182758, 76, ...  (68, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0P)\30\0\310&\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\20'\30\0\26\0\30\08'\30\0\4@\14\0\3\0\0\0\360Z\374wd$\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00345   424   NtReadVirtualMemory  (68, 0x182800, 76, ...  (68, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\230*\30\0\360)\30\0\0\0\212u\0\0\0\0\0\360\0\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\4@\0\0\1\0\0\0\200Z\374w\200Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00346   424   NtReadVirtualMemory  (68, 0x1828a0, 76, ...  (68, 0x1828a0, 76, ... "@)\30\0\0(\30\0H)\30\0\10(\30\0\360)\30\0P)\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0X(\30\0\24\0\26\0\200(\30\0\6@\10\0\1\0\0\0|)\30\0L&\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00347   424   NtReadVirtualMemory  (68, 0x182940, 76, ...  (68, 0x182940, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\260(\30\0h'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\370(\30\0\26\0\30\0 )\30\0\6@\14\0\1\0\0\0\304*\30\0\334(\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00348   424   NtReadVirtualMemory  (68, 0x1829e0, 76, ...  (68, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0\20(\30\0\260(\30\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\230)\30\0\22\0\24\0\300)\30\0\6@\14\0\1\0\0\0\330Z\374w\330Z\374w\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00349   424   NtReadVirtualMemory  (68, 0x182a88, 76, ...  (68, 0x182a88, 76, ... "0+\30\0\340)\30\08+\30\0\350)\30\0@+\30\0\20(\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08*\30\0\30\0\32\0`*\30\0\4@\0\0\1\0\0\0\20[\374w|)\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00350   424   NtReadVirtualMemory  (68, 0x182b30, 76, ...  (68, 0x182b30, 76, ... "\234\36\30\0\210*\30\0\244\36\30\0\220*\30\0\254\36\30\0\230*\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\340*\30\0\30\0\32\0\10+\30\0\4@\14\0\2\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00351   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 00352   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00353   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00354   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00355   424   NtReadVirtualMemory  (68, 0x20598, 66, ...  (68, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0e\0r\0v\0i\0c\0e\0s\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00356   424   NtClose  (68, ... ) == 0x0
 00357   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {672, 0}, ... 68, ) == 0x0
 00358   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 00359   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00360   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00361   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00362   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\324(\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00363   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\04-\30\0\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00364   424   NtReadVirtualMemory  (68, 0x182068, 76, ...  (68, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00365   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\3144\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00366   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00367   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00368   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) == 0x0
 00369   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00370   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00371   424   NtReadVirtualMemory  (68, 0x1824c8, 76, ...  (68, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\0(\30\0 &\30\0\0\0Dt\0\0\0\0\0\220\6\0<\0>\0\200$\30\0\24\0\26\0\250$\30\0\6@\0\0\377\377\0\0t)\30\0$#\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00372   424   NtReadVirtualMemory  (68, 0x182570, 76, ...  (68, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0`'\30\0\230#\30\0\0\0yv\7\30yv\0\260\0\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\14\0\377\377\0\0\274;\30\0pZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00373   424   NtReadVirtualMemory  (68, 0x182610, 76, ...  (68, 0x182610, 76, ... "\260&\30\0p%\30\0\270&\30\0x%\30\0\330$\30\0\300&\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\377\377\0\0\34;\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00374   424   NtReadVirtualMemory  (68, 0x1826b0, 76, ...  (68, 0x1826b0, 76, ... "P'\30\0\20&\30\0X'\30\0\30&\30\0 &\30\0`'\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h&\30\0\24\0\26\0\220&\30\0\6@\10\0\377\377\0\0\214'\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00375   424   NtReadVirtualMemory  (68, 0x182750, 76, ...  (68, 0x182750, 76, ... "\360'\30\0\260&\30\0\370'\30\0\270&\30\0\300&\30\0\200%\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10'\30\0\26\0\30\00'\30\0\6@\14\0\377\377\0\0L+\30\0\354&\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00376   424   NtReadVirtualMemory  (68, 0x1827f0, 76, ...  (68, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\250(\30\0\330$\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\6@\14\0\377\377\0\0\14*\30\0\204"\30\0\26\376};\0\0\0\0", 76, ) \30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00377   424   NtReadVirtualMemory  (68, 0x182898, 76, ...  (68, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0H)\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\6@\14\0\377\377\0\0\254*\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00378   424   NtReadVirtualMemory  (68, 0x182938, 76, ...  (68, 0x182938, 76, ... "\320)\30\0\230(\30\0\330)\30\0\240(\30\0\340)\30\0\250(\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\10\0\377\377\0\0t5\30\0\4%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00379   424   NtReadVirtualMemory  (68, 0x1829d0, 76, ...  (68, 0x1829d0, 76, ... "p*\30\08)\30\0x*\30\0@)\30\0 +\30\0H)\30\0\0\0\262q\234\21\262q\0\20\1\06\08\0\220)\30\0\16\0\20\0\270)\30\0\6@\14\0\377\377\0\0\224,\30\0,(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00380   424   NtReadVirtualMemory  (68, 0x182a70, 76, ...  (68, 0x182a70, 76, ... "\20+\30\0\320)\30\0\30+\30\0\330)\30\0\270!\30\0 +\30\0\0\0zv\32\22zv\00\1\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0\377\377\0\0\334-\30\0\324(\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00381   424   NtReadVirtualMemory  (68, 0x182b10, 76, ...  (68, 0x182b10, 76, ... "X,\30\0p*\30\0`,\30\0x*\30\0\200*\30\0\340)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\310*\30\0\26\0\30\0\360*\30\0\6@\10\0\377\377\0\0|.\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00382   424   NtReadVirtualMemory  (68, 0x182c58, 76, ...  (68, 0x182c58, 76, ... "\370,\30\0\20+\30\0\0-\30\0\30+\30\0\10-\30\0\270!\30\0\0\0;t\0\0\0\0\0\320\0\0>\0@\0\20,\30\0\26\0\30\08,\30\0\4@\0\0\1\0\0\0\364+\30\0\14*\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00383   424   NtReadVirtualMemory  (68, 0x182cf8, 76, ...  (68, 0x182cf8, 76, ... "\270+\30\0X,\30\0\300+\30\0`,\30\0\310+\30\0h,\30\0\0\0\317q7\177\320q\0@\4\0@\0B\0h+\30\0\30\0\32\0\220+\30\0\4@\14\0\2\0\0\0\260Z\374w\374\37\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00384   424   NtReadVirtualMemory  (68, 0x182bb8, 76, ...  (68, 0x182bb8, 76, ... "\240-\30\0\370,\30\0\250-\30\0\0-\30\0\360.\30\0\10-\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\4@\0\0\4\0\0\0\34/\30\0\224,\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00385   424   NtReadVirtualMemory  (68, 0x182da0, 76, ...  (68, 0x182da0, 76, ... "@.\30\0\270+\30\0H.\30\0\300+\30\0\260>\30\0P.\30\0\0\0Kt\232\356Kt\00\6\0@\0B\0P-\30\0\30\0\32\0x-\30\0\4@\14\0\2\0\0\0d0\30\0\254*\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00386   424   NtReadVirtualMemory  (68, 0x182e40, 76, ...  (68, 0x182e40, 76, ... "\340.\30\0\240-\30\0\350.\30\0\250-\30\0\260-\30\0x=\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\370-\30\0\26\0\30\0 .\30\0\6@\0\0\2\0\0\0\2348\30\0L+\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00387   424   NtReadVirtualMemory  (68, 0x182ee0, 76, ...  (68, 0x182ee0, 76, ... "\210/\30\0@.\30\0\220/\30\0H.\30\0 2\30\0\310+\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0\230.\30\0\26\0\30\0\300.\30\0\6@\14\0\2\0\0\0\41\30\0\364+\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00388   424   NtReadVirtualMemory  (68, 0x182f88, 76, ...  (68, 0x182f88, 76, ... "(0\30\0\340.\30\000\30\0\350.\30\0x=\30\080\30\0\0\0\326v\326/\326v\0P\1\0@\0B\08/\30\0\30\0\32\0`/\30\0\6@\14\0\11\0\0\0\264B\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00389   424   NtReadVirtualMemory  (68, 0x183028, 76, ...  (68, 0x183028, 76, ... "\3100\30\0\210/\30\0\3200\30\0\220/\30\0\230/\30\0\2609\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\340/\30\0\24\0\26\0\100\30\0\6@\14\0\3\0\0\0\310Z\374w\334-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00390   424   NtReadVirtualMemory  (68, 0x1830c8, 76, ...  (68, 0x1830c8, 76, ... "p1\30\0(0\30\0x1\30\000\30\0\2206\30\0H5\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\2000\30\0\24\0\26\0\2500\30\0\6@\14\0\3\0\0\0DE\30\0\34/\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00391   424   NtReadVirtualMemory  (68, 0x183170, 76, ...  (68, 0x183170, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0\2404\30\0\04\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0 1\30\0\30\0\32\0H1\30\0\6@\14\0\3\0\0\0L2\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00392   424   NtReadVirtualMemory  (68, 0x183210, 76, ...  (68, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\2702\30\0\360.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\3101\30\0\26\0\30\0\3601\30\0\6@\10\0\3\0\0\0\3442\30\0\2541\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00393   424   NtReadVirtualMemory  (68, 0x1832a8, 76, ...  (68, 0x1832a8, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0X3\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\14\0\3\0\0\0`Z\374wL2\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00394   424   NtReadVirtualMemory  (68, 0x183348, 76, ...  (68, 0x183348, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0\04\30\0\2702\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\03\30\0\22\0\24\0(3\30\0\6@\10\0\25\0\0\0,4\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00395   424   NtReadVirtualMemory  (68, 0x1833f0, 76, ...  (68, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\2001\30\0X3\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\6@\10\0\15\0\0\0TC\30\0\2043\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00396   424   NtReadVirtualMemory  (68, 0x183490, 76, ...  (68, 0x183490, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\0H5\30\0\2001\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\14\0\12\0\0\0\346\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00397   424   NtReadVirtualMemory  (68, 0x183538, 76, ...  (68, 0x183538, 76, ... "\3405\30\0\2204\30\0\3505\30\0\2304\30\0\3300\30\0\2404\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3504\30\0\30\0\32\0\205\30\0\6@\10\0\4\0\0\0\3747\30\0t)\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00398   424   NtReadVirtualMemory  (68, 0x1835e0, 76, ...  (68, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\209\30\007\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\14\0\4\0\0\0\2746\30\0\3144\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00399   424   NtReadVirtualMemory  (68, 0x183680, 76, ...  (68, 0x183680, 76, ... " 7\30\0\3405\30\0(7\30\0\3505\30\0\3207\30\0\3300\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\14\0\4\0\0\0lA\30\0\346\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00400   424   NtReadVirtualMemory  (68, 0x183720, 76, ...  (68, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3605\30\0p8\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\6@\10\0\4\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00401   424   NtReadVirtualMemory  (68, 0x1837c0, 76, ...  (68, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\0\2206\30\0\0\0-w\306@-w\00\6\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\6@\14\0\15\0\0\0<9\30\0t5\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00402   424   NtReadVirtualMemory  (68, 0x183860, 76, ...  (68, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\007\30\0\3207\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\308\30\0\22\0\24\0@8\30\0\6@\14\0\4\0\0\0\3349\30\0|.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00403   424   NtReadVirtualMemory  (68, 0x183900, 76, ...  (68, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0H:\30\0\3605\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\4\0\0\0,@\30\0\3747\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00404   424   NtReadVirtualMemory  (68, 0x1839a0, 76, ...  (68, 0x1839a0, 76, ... "8:\30\0\09\30\0@:\30\0\109\30\080\30\08<\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00405   424   NtReadVirtualMemory  (68, 0x183a38, 76, ...  (68, 0x183a38, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\360:\30\0\209\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3709\30\0\16\0\20\0 :\30\0\6@\0\0\3\0\0\0d<\30\0\3349\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00406   424   NtReadVirtualMemory  (68, 0x183ae0, 76, ...  (68, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\0\220;\30\0H:\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\3\0\0\0,G\30\0L&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00407   424   NtReadVirtualMemory  (68, 0x183b80, 76, ...  (68, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0,vN\25,v\0\240\10\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\10\0\6\0\0\0\334>\30\0\254%\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00408   424   NtReadVirtualMemory  (68, 0x183c28, 76, ...  (68, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0\2609\30\0\330<\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\0\0\3\0\0\0\4=\30\0t:\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00409   424   NtReadVirtualMemory  (68, 0x183cc8, 76, ...  (68, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\220;\30\0\0\06v\240\206v\0\360\0\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\10\0\6\0\0\0\314@\30\0d<\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00410   424   NtReadVirtualMemory  (68, 0x183d68, 76, ...  (68, 0x183d68, 76, ... "\240>\30\0\310<\30\0\250>\30\0\320<\30\0P.\30\0\230/\30\0\0\0\247uM\31\247u\00\12\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\14\0\6\0\0\0\0[\374w\304#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00411   424   NtReadVirtualMemory  (68, 0x183ea0, 76, ...  (68, 0x183ea0, 76, ... "H?\30\0h=\30\0P?\30\0p=\30\0X?\30\0\260-\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300=\30\0\30\0\32\0~>\30\0\4@\14\20\2\0\0\0\204?\30\0\274;\30\02\376};\20\15\11\0", 76, ) , 76, ) == 0x0
 00412   424   NtReadVirtualMemory  (68, 0x183f48, 76, ...  (68, 0x183f48, 76, ... "\360?\30\0\240>\30\0\370?\30\0\250>\30\0\0@\30\0\260>\30\0\0\04wY\324w\0\260\10\0@\0B\0\370>\30\0\30\0\32\0 ?\30\0\4@\14\0\1\0\0\0pZ\374w\334>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00413   424   NtReadVirtualMemory  (68, 0x183ff0, 76, ...  (68, 0x183ff0, 76, ... "\220@\30\0H?\30\0\230@\30\0P?\30\0\240@\30\0X?\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\240?\30\0\30\0\32\0\310?\30\0\4@\14\0\1\0\0\0\14B\30\0<9\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00414   424   NtReadVirtualMemory  (68, 0x184090, 76, ...  (68, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0\0@\30\0\0\08t\0\0\0\0\0\360\0\0>\0@\0H@\30\0\26\0\30\0p@\30\0\4@\0\0\1\0\0\0\374C\30\0\4=\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00415   424   NtReadVirtualMemory  (68, 0x184130, 76, ...  (68, 0x184130, 76, ... "\320A\30\0\220@\30\0\330A\30\0\230@\30\0\340A\30\0\240@\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\350@\30\0\24\0\26\0\20A\30\0\4@\14\0\1\0\0\0\350Z\374w\2746\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00416   424   NtReadVirtualMemory  (68, 0x1841d0, 76, ...  (68, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\0@A\30\0\0\0At\200\23At\0\320\2\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\4@\10\0\1\0\0\0\360Z\374w,@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00417   424   NtReadVirtualMemory  (68, 0x184278, 76, ...  (68, 0x184278, 76, ... "\30C\30\0\320A\30\0 C\30\0\330A\30\0xD\30\0(C\30\0\0\0>tG\26>t\0p\2\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\240Z\374w\304/\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00418   424   NtReadVirtualMemory  (68, 0x184318, 76, ...  (68, 0x184318, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\210B\30\0\320C\30\0\0\0]t\206\25]t\0p\13\0<\0>\0\320B\30\0\24\0\26\0\370B\30\0\6@\10\0\1\0\0\0\320Z\374w,4\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00419   424   NtReadVirtualMemory  (68, 0x1843c0, 76, ...  (68, 0x1843c0, 76, ... "hD\30\0\30C\30\0pD\30\0 C\30\0(C\30\0\340A\30\0\0\07tP\207t\0\240\0\0@\0B\0pC\30\0\30\0\32\0\230C\30\0\6@\14\0\1\0\0\0\354E\30\0\314@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00420   424   NtReadVirtualMemory  (68, 0x184468, 76, ...  (68, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\210B\30\0\0\0:tP\21:t\0\220\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\14\0\1\0\0\0\214F\30\0\330Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00421   424   NtReadVirtualMemory  (68, 0x184508, 76, ...  (68, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0\300E\30\0xD\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\2\0\0\0\300Z\374w\41\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00422   424   NtReadVirtualMemory  (68, 0x1845b0, 76, ...  (68, 0x1845b0, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0`F\30\0\30E\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\0\20[\374w\374C\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00423   424   NtReadVirtualMemory  (68, 0x184650, 76, ...  (68, 0x184650, 76, ... "\360F\30\0\260E\30\0\370F\30\0\270E\30\0\0G\30\0\300E\30\0\0\0\0\10F\30\0\24\0\26\00F\30\0\4@\14\0\1\0\0\0\330Z\374w\244D\30\0"\376};\220>\13\0", 76, ) \376};\220>\13\0", 76, ) == 0x0
 00424   424   NtReadVirtualMemory  (68, 0x1846f0, 76, ...  (68, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0\254\36\30\0`F\30\0\0\0\372\17\37]\372\17\0\20\2\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\4@\14\0\1\0\0\0xZ\374w\34;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00425   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 00426   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00427   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00428   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00429   424   NtReadVirtualMemory  (68, 0x20598, 60, ...  (68, 0x20598, 60, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0l\0s\0a\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00430   424   NtClose  (68, ... ) == 0x0
 00431   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {852, 0}, ... 68, ) == 0x0
 00432   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=852,ParentPid=660,}, 0x0, ) == 0x0
 00433   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00434   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00435   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00436   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0t)\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00437   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00438   424   NtReadVirtualMemory  (68, 0x182068, 76, ...  (68, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00439   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\344!\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00440   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00441   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00442   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\310 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00443   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\0X (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00444   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0x%\30\0\330$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\04\0\0\0D&\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00445   424   NtReadVirtualMemory  (68, 0x1824c8, 76, ...  (68, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\08$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00446   424   NtReadVirtualMemory  (68, 0x182568, 76, ...  (68, 0x182568, 76, ... "\10&\30\0\310$\30\0\20&\30\0\320$\30\0\270!\30\08$\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0 %\30\0\26\0\30\0H%\30\0\6@\14\0\5\0\0\0\304/\30\0\374\36\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00447   424   NtReadVirtualMemory  (68, 0x182608, 76, ...  (68, 0x182608, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\270!\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\300%\30\0\26\0\30\0\350%\30\0\4@\14\0\1\0\0\0\0[\374wd$\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00448   424   NtReadVirtualMemory  (68, 0x1826a8, 76, ...  (68, 0x1826a8, 76, ... "P'\30\0\10&\30\0X'\30\0\20&\30\0`'\30\0\30&\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\4@\10\0\5\0\0\0\24*\30\0\204"\30\01\376};\0\0\0\0", 76, ) \30\01\376};\0\0\0\0", 76, ) == 0x0
 00449   424   NtReadVirtualMemory  (68, 0x182750, 76, ...  (68, 0x182750, 76, ... "\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0(\30\0\270&\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\0'\30\0\30\0\32\0('\30\0\4@\14\0\1\0\0\0\244,\30\0\304#\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00450   424   NtReadVirtualMemory  (68, 0x1827f0, 76, ...  (68, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\330+\30\0`'\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\4@\14\0\3\0\0\0\246\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00451   424   NtReadVirtualMemory  (68, 0x182898, 76, ...  (68, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0\2509\30\0H)\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00452   424   NtReadVirtualMemory  (68, 0x182938, 76, ...  (68, 0x182938, 76, ... "\330)\30\0\230(\30\0\340)\30\0\240(\30\0\250(\30\0\2504\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\14\0\1\0\0\0\4,\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00453   424   NtReadVirtualMemory  (68, 0x1829d8, 76, ...  (68, 0x1829d8, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\2101\30\0@0\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\220)\30\0\24\0\26\0\270)\30\0\6@\14\0\1\0\0\0T7\30\0\344&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00454   424   NtReadVirtualMemory  (68, 0x182a80, 76, ...  (68, 0x182a80, 76, ... " +\30\0\330)\30\0(+\30\0\340)\30\0\370.\30\0X.\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\00*\30\0\30\0\32\0X*\30\0\6@\14\0\1\0\0\0\+\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00455   424   NtReadVirtualMemory  (68, 0x182b20, 76, ...  (68, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\20-\30\0x,\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\330*\30\0\26\0\30\0\0+\30\0\6@\10\0\1\0\0\0<-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00456   424   NtReadVirtualMemory  (68, 0x182bc8, 76, ...  (68, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0x,\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\14\0\6\0\0\0\310Z\374wt)\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00457   424   NtReadVirtualMemory  (68, 0x182c68, 76, ...  (68, 0x182c68, 76, ... "\0-\30\0\310+\30\0\10-\30\0\320+\30\00+\30\0\330+\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\10\0\2\0\0\0\2243\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00458   424   NtReadVirtualMemory  (68, 0x182d00, 76, ...  (68, 0x182d00, 76, ... "\240-\30\0h,\30\0\250-\30\0p,\30\0\260-\30\00+\30\0\0\0\262v<-\262v\0P\1\06\08\0\300,\30\0\16\0\20\0\350,\30\0\6@\14\0\1\0\0\0`Z\374w\+\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00459   424   NtReadVirtualMemory  (68, 0x182da0, 76, ...  (68, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0X.\30\0\20-\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0X-\30\0\22\0\24\0\200-\30\0\6@\10\0\13\0\0\0\204.\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00460   424   NtReadVirtualMemory  (68, 0x182e48, 76, ...  (68, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\220*\30\0\260-\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\10\0\6\0\0\0\320Z\374w\334-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00461   424   NtReadVirtualMemory  (68, 0x182ee8, 76, ...  (68, 0x182ee8, 76, ... "\210/\30\0H.\30\0\220/\30\0P.\30\0\230/\30\0\220*\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\14\0\4\0\0\0\241\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00462   424   NtReadVirtualMemory  (68, 0x182f88, 76, ...  (68, 0x182f88, 76, ... "00\30\0\350.\30\080\30\0\360.\30\0@0\30\0\370.\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0@/\30\0\24\0\26\0h/\30\0\6@\10\0\1\0\0\0l0\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00463   424   NtReadVirtualMemory  (68, 0x183030, 76, ...  (68, 0x183030, 76, ... "\3300\30\0\210/\30\0\3400\30\0\220/\30\0\350)\30\0\230/\30\0\0\0gv8\25gv\0@\16\0@\0B\0\340/\30\0\30\0\32\0\100\30\0\6@\10\0\1\0\0\0\3642\30\0\304/\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00464   424   NtReadVirtualMemory  (68, 0x1830d8, 76, ...  (68, 0x1830d8, 76, ... "x1\30\000\30\0\2001\30\080\30\0\104\30\0(2\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2100\30\0\30\0\32\0\2600\30\0\6@\14\0\2\0\0\0\2641\30\0$/\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00465   424   NtReadVirtualMemory  (68, 0x183178, 76, ...  (68, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0\3102\30\0\350)\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\001\30\0\24\0\26\0X1\30\0\6@\14\0\2\0\0\0\304;\30\0\241\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00466   424   NtReadVirtualMemory  (68, 0x183218, 76, ...  (68, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0\3500\30\0h3\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3201\30\0\24\0\26\0\3701\30\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00467   424   NtReadVirtualMemory  (68, 0x1832b8, 76, ...  (68, 0x1832b8, 76, ... "X3\30\0\302\30\0`3\30\0 2\30\0h3\30\0\2101\30\0\0\0-w\306@-w\00\6\0>\0@\0p2\30\0\26\0\30\0\2302\30\0\6@\14\0\6\0\0\044\30\0l0\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00468   424   NtReadVirtualMemory  (68, 0x183358, 76, ...  (68, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0(2\30\0\3102\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\203\30\0\22\0\24\083\30\0\6@\14\0\2\0\0\0\3244\30\0\244,\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00469   424   NtReadVirtualMemory  (68, 0x1833f8, 76, ...  (68, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0@5\30\0\3500\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2603\30\0\26\0\30\0\3303\30\0\6@\10\0\1\0\0\0\360Z\374w\3642\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00470   424   NtReadVirtualMemory  (68, 0x183498, 76, ...  (68, 0x183498, 76, ... "05\30\0\3703\30\085\30\0\04\30\0H)\30\0\3207\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00471   424   NtReadVirtualMemory  (68, 0x183530, 76, ...  (68, 0x183530, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\3505\30\0\104\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3604\30\0\16\0\20\0\305\30\0\6@\0\0\1\0\0\0\3747\30\0\3244\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00472   424   NtReadVirtualMemory  (68, 0x1835d8, 76, ...  (68, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0(7\30\0@5\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\14\0\1\0\0\0xZ\374w,(\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00473   424   NtReadVirtualMemory  (68, 0x183678, 76, ...  (68, 0x183678, 76, ... "\307\30\0\3305\30\0 7\30\0\3405\30\0p8\30\0(7\30\0\0\0,vN\25,v\0\240\10\0>\0@\006\30\0\26\0\30\0X6\30\0\6@\10\0\1\0\0\0\3249\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00474   424   NtReadVirtualMemory  (68, 0x183718, 76, ...  (68, 0x183718, 76, ... "\3007\30\0x6\30\0\3107\30\0\2006\30\0\2106\30\0\3505\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\300Z\374w\24*\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00475   424   NtReadVirtualMemory  (68, 0x1837c0, 76, ...  (68, 0x1837c0, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\2504\30\0p8\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0p7\30\0\30\0\32\0\2307\30\0\6@\0\0\1\0\0\0\2348\30\0l5\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00476   424   NtReadVirtualMemory  (68, 0x183860, 76, ...  (68, 0x183860, 76, ... "\2309\30\0\3007\30\0\2409\30\0\3107\30\0\3207\30\0\2106\30\0\0\06v\240\206v\0\360\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\6@\10\0\2\0\0\0\34;\30\0\3747\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00477   424   NtReadVirtualMemory  (68, 0x183998, 76, ...  (68, 0x183998, 76, ... "@:\30\0`8\30\0H:\30\0h8\30\0P:\30\0\250(\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\2708\30\0\30\0\32\0v9\30\0\4@\14\20\2\0\0\0|:\30\0\2646\30\02\376};\360e\12\0", 76, ) , 76, ) == 0x0
 00478   424   NtReadVirtualMemory  (68, 0x183a40, 76, ...  (68, 0x183a40, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\360:\30\0\2509\30\0\0\04wY\324w\0\260\10\0@\0B\0\3609\30\0\30\0\32\0\30:\30\0\4@\14\0\1\0\0\0d<\30\0\3249\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00479   424   NtReadVirtualMemory  (68, 0x183ae0, 76, ...  (68, 0x183ae0, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\230;\30\0P:\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\230:\30\0\24\0\26\0\300:\30\0\4@\14\0\1\0\0\0\20[\374w\2348\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00480   424   NtReadVirtualMemory  (68, 0x183b88, 76, ...  (68, 0x183b88, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0\374v!\21\374v\0P\0\0@\0B\08;\30\0\30\0\32\0`;\30\0\4@\14\0\1\0\0\0\350Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00481   424   NtReadVirtualMemory  (68, 0x183c28, 76, ...  (68, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\254\36\30\0x=\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\340;\30\0\26\0\30\0\10<\30\0\4@\14\0\2\0\0\0\4=\30\0|:\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00482   424   NtReadVirtualMemory  (68, 0x183cc8, 76, ...  (68, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0\230;\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\14\0\2\0\0\0pZ\374wd<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00483   424   NtReadVirtualMemory  (68, 0x183d68, 76, ...  (68, 0x183d68, 76, ... "\234\36\30\0\310<\30\0\244\36\30\0\320<\30\08<\30\0\330<\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\10\0\2\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00484   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=852,ParentPid=660,}, 0x0, ) == 0x0
 00485   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00486   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00487   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00488   424   NtReadVirtualMemory  (68, 0x20598, 64, ...  (68, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00489   424   NtClose  (68, ... ) == 0x0
 00490   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {972, 0}, ... 68, ) == 0x0
 00491   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=972,ParentPid=660,}, 0x0, ) == 0x0
 00492   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00493   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00494   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00495   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364+\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00496   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00497   424   NtReadVirtualMemory  (68, 0x182068, 76, ...  (68, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00498   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\41\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00499   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00500   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00501   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00502   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) == 0x0
 00503   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0(\2\0\0\224,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00504   424   NtReadVirtualMemory  (68, 0x1824c8, 76, ...  (68, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\0\230#\30\08$\30\0\0\0-w\306@-w\00\6\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0@\0\0\0\244%\30\0\304#\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00505   424   NtReadVirtualMemory  (68, 0x182568, 76, ...  (68, 0x182568, 76, ... "\240&\30\0\310$\30\0\250&\30\0\320$\30\0\260&\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0 %\30\0\26\0\30\0H%\30\0\4@\10\0\24\0\0\0\2441\30\0\4%\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00506   424   NtReadVirtualMemory  (68, 0x1826a0, 76, ...  (68, 0x1826a0, 76, ... "H'\30\0h%\30\0P'\30\0p%\30\0X'\30\0x%\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300%\30\0\30\0\32\0~&\30\0\4@\14\20\10\0\0\0\204'\30\0pZ\374w2\376};H\315\10\0", 76, ) , 76, ) == 0x0
 00507   424   NtReadVirtualMemory  (68, 0x182748, 76, ...  (68, 0x182748, 76, ... "\350'\30\0\240&\30\0\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0\04wY\324w\0\260\10\0@\0B\0\370&\30\0\30\0\32\0 '\30\0\4@\14\0\1\0\0\0L7\30\0\334&\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00508   424   NtReadVirtualMemory  (68, 0x1827e8, 76, ...  (68, 0x1827e8, 76, ... "\220(\30\0H'\30\0\230(\30\0P'\30\0\200*\30\0X'\30\0\0\06v\240\206v\0\360\0\0<\0>\0\240'\30\0\24\0\26\0\310'\30\0\4@\10\0#\0\0\0\14*\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00509   424   NtReadVirtualMemory  (68, 0x182890, 76, ...  (68, 0x182890, 76, ... "0)\30\0\350'\30\08)\30\0\360'\30\0\109\30\0(+\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0@(\30\0\30\0\32\0h(\30\0\4@\14\0\17\0\0\0l)\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00510   424   NtReadVirtualMemory  (68, 0x182930, 76, ...  (68, 0x182930, 76, ... "\320)\30\0\220(\30\0\330)\30\0\230(\30\0X.\30\0\340)\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350(\30\0\24\0\26\0\20)\30\0\6@\14\0\21\0\0\0lS\30\0\314(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00511   424   NtReadVirtualMemory  (68, 0x1829d0, 76, ...  (68, 0x1829d0, 76, ... "p*\30\00)\30\0x*\30\08)\30\0@)\30\0\200*\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210)\30\0\24\0\26\0\260)\30\0\6@\10\0e\0\0\0\254*\30\0$(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00512   424   NtReadVirtualMemory  (68, 0x182a70, 76, ...  (68, 0x182a70, 76, ... "\30+\30\0\320)\30\0 +\30\0\330)\30\0\340)\30\0\370'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0-\0\0\0$/\30\0\14*\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00513   424   NtReadVirtualMemory  (68, 0x182b18, 76, ...  (68, 0x182b18, 76, ... "\270+\30\0p*\30\0\300+\30\0x*\30\0\240(\30\0\310+\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310*\30\0\30\0\32\0\360*\30\0\6@\14\0!\0\0\0\C\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00514   424   NtReadVirtualMemory  (68, 0x182bb8, 76, ...  (68, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0(+\30\0\3505\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p+\30\0\24\0\26\0\230+\30\0\6@\14\0\15\0\0\0\204.\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00515   424   NtReadVirtualMemory  (68, 0x182c58, 76, ...  (68, 0x182c58, 76, ... "\0-\30\0\270+\30\0\10-\30\0\300+\30\0h3\30\0 2\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20,\30\0\24\0\26\08,\30\0\6@\14\0\16\0\0\0\3547\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00516   424   NtReadVirtualMemory  (68, 0x182d00, 76, ...  (68, 0x182d00, 76, ... "\240-\30\0X,\30\0\250-\30\0`,\30\0\3300\30\080\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260,\30\0\30\0\32\0\330,\30\0\6@\14\0\17\0\0\0\334-\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00517   424   NtReadVirtualMemory  (68, 0x182da0, 76, ...  (68, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0\220/\30\0\370.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X-\30\0\26\0\30\0\200-\30\0\6@\10\0\17\0\0\0\274/\30\0<-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00518   424   NtReadVirtualMemory  (68, 0x182e48, 76, ...  (68, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\370.\30\0@)\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\14\0_\0\0\0\214?\30\0\364+\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00519   424   NtReadVirtualMemory  (68, 0x182ee8, 76, ...  (68, 0x182ee8, 76, ... "\200/\30\0H.\30\0\210/\30\0P.\30\0\260-\30\0X.\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\10\0\26\0\0\0\3244\30\0\254*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00520   424   NtReadVirtualMemory  (68, 0x182f80, 76, ...  (68, 0x182f80, 76, ... "(0\30\0\350.\30\000\30\0\360.\30\080\30\0\260-\30\0\0\0\262v<-\262v\0P\1\06\08\0@/\30\0\16\0\20\0h/\30\0\6@\14\0\22\0\0\0\244D\30\0\334-\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00521   424   NtReadVirtualMemory  (68, 0x183028, 76, ...  (68, 0x183028, 76, ... "\3100\30\0\200/\30\0\3200\30\0\210/\30\0\20-\30\0\220/\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\330/\30\0\30\0\32\0\00\30\0\6@\10\0r\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00522   424   NtReadVirtualMemory  (68, 0x1830c8, 76, ...  (68, 0x1830c8, 76, ... "h1\30\0(0\30\0p1\30\000\30\0x1\30\0\20-\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\2000\30\0\26\0\30\0\2500\30\0\6@\14\0*\0\0\0\3642\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00523   424   NtReadVirtualMemory  (68, 0x183168, 76, ...  (68, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\6@\10\0\20\0\0\0L2\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00524   424   NtReadVirtualMemory  (68, 0x183210, 76, ...  (68, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0h,\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\6@\10\0\23\0\0\0t5\30\0\2441\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00525   424   NtReadVirtualMemory  (68, 0x1832b8, 76, ...  (68, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0H5\30\0\104\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\6@\14\0\17\0\0\0\2243\30\0\41\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00526   424   NtReadVirtualMemory  (68, 0x183358, 76, ...  (68, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\2504\30\0h,\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\203\30\0\24\0\26\083\30\0\6@\14\0\17\0\0\0\3249\30\0\3642\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00527   424   NtReadVirtualMemory  (68, 0x1833f8, 76, ...  (68, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0\3102\30\0\2504\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\2603\30\0\24\0\26\0\3303\30\0\6@\10\0\16\0\0\0TO\30\0\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00528   424   NtReadVirtualMemory  (68, 0x183498, 76, ...  (68, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\104\30\0h3\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0P4\30\0\22\0\24\0x4\30\0\6@\14\0\16\0\0\0\246\30\0$/\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00529   424   NtReadVirtualMemory  (68, 0x183538, 76, ...  (68, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2006\30\0\3102\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\14\08\0\0\0\34;\30\0L2\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00530   424   NtReadVirtualMemory  (68, 0x1835d8, 76, ...  (68, 0x1835d8, 76, ... "p6\30\085\30\0x6\30\0@5\30\0\310+\30\0h8\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00531   424   NtReadVirtualMemory  (68, 0x183670, 76, ...  (68, 0x183670, 76, ... "\207\30\0\3305\30\0\307\30\0\3405\30\0\3007\30\0H5\30\0\0\0\323v\0\0\0\0\0@\0\06\08\006\30\0\16\0\20\0X6\30\0\6@\0\0\14\0\0\0\2248\30\0\246\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00532   424   NtReadVirtualMemory  (68, 0x183710, 76, ...  (68, 0x183710, 76, ... "\2607\30\0p6\30\0\2707\30\0x6\30\0h8\30\0\3007\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3106\30\0\26\0\30\0\3606\30\0\6@\10\0\31\0\0\0,@\30\0\204'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00533   424   NtReadVirtualMemory  (68, 0x1837b0, 76, ...  (68, 0x1837b0, 76, ... "X8\30\0\207\30\0`8\30\0\307\30\0 7\30\0\2006\30\0\0\0*v\\20*v\0\360\0\0<\0>\0h7\30\0\24\0\26\0\2207\30\0\6@\14\0\23\0\0\0\244=\30\0\224,\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00534   424   NtReadVirtualMemory  (68, 0x183858, 76, ...  (68, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\3505\30\0 7\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\108\30\0\30\0\32\008\30\0\6@\0\0\21\0\0\0d<\30\0\2546\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00535   424   NtReadVirtualMemory  (68, 0x1838f8, 76, ...  (68, 0x1838f8, 76, ... "\2309\30\0X8\30\0\2409\30\0`8\30\0\2509\30\0\240(\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\3\0\0\0\274;\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00536   424   NtReadVirtualMemory  (68, 0x183998, 76, ...  (68, 0x183998, 76, ... "8:\30\0\3708\30\0@:\30\0\09\30\0\220;\30\0\109\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0P9\30\0\24\0\26\0x9\30\0\4@\14\0\1\0\0\0t:\30\0\2243\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00537   424   NtReadVirtualMemory  (68, 0x183a38, 76, ...  (68, 0x183a38, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\330<\30\08<\30\0\0\0\361t\1\225\361t\0\0\1\0<\0>\0\3609\30\0\24\0\26\0\30:\30\0\4@\14\0\1\0\0\0\4=\30\0\3249\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00538   424   NtReadVirtualMemory  (68, 0x183ae0, 76, ...  (68, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\08<\30\0\220;\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\1\0\0\0\24B\30\0t5\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00539   424   NtReadVirtualMemory  (68, 0x183b80, 76, ...  (68, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\360:\30\0\2509\30\0\0\0\247uM\31\247u\00\12\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\14\0\14\0\0\0\274c\30\049\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00540   424   NtReadVirtualMemory  (68, 0x183c28, 76, ...  (68, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0H:\30\0\360:\30\0\0\0=r\240\22=r\0\240\1\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\10\0\1\0\0\0\354>\30\0\2248\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00541   424   NtReadVirtualMemory  (68, 0x183cc8, 76, ...  (68, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0H:\30\0\0\0\363t\0\0\0\0\0\300\0\0>\0@\0\200<\30\0\26\0\30\0\250<\30\0\4@\0\0\1\0\0\0\204[\30\0t:\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00542   424   NtReadVirtualMemory  (68, 0x183d68, 76, ...  (68, 0x183d68, 76, ... "\10>\30\0\310<\30\0\20>\30\0\320<\30\0\30>\30\0\330<\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0 =\30\0\24\0\26\0H=\30\0\4@\0\0\1\0\0\0D>\30\0\3547\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00543   424   NtReadVirtualMemory  (68, 0x183e08, 76, ...  (68, 0x183e08, 76, ... "\260>\30\0h=\30\0\270>\30\0p=\30\0\300>\30\0x=\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\6\0\0\0\374C\30\0\244=\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00544   424   NtReadVirtualMemory  (68, 0x183eb0, 76, ...  (68, 0x183eb0, 76, ... "P?\30\0\10>\30\0X?\30\0\20>\30\0`?\30\0\30>\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`>\30\0\30\0\32\0\210>\30\0\4@\14\0\1\0\0\0DE\30\0d<\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00545   424   NtReadVirtualMemory  (68, 0x183f50, 76, ...  (68, 0x183f50, 76, ... "\360?\30\0\260>\30\0\370?\30\0\270>\30\0\240@\30\0\300>\30\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\10?\30\0\26\0\30\00?\30\0\4@\14\0\1\0\0\0\264B\30\0\204.\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00546   424   NtReadVirtualMemory  (68, 0x183ff0, 76, ...  (68, 0x183ff0, 76, ... "\220@\30\0P?\30\0\230@\30\0X?\30\0\210B\30\0@A\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\250?\30\0\26\0\30\0\320?\30\0\4@\14\0\4\0\0\0\314@\30\0L7\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00547   424   NtReadVirtualMemory  (68, 0x184090, 76, ...  (68, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0`?\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0H@\30\0\24\0\26\0p@\30\0\6@\14\0\15\0\0\0\354E\30\0,@\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00548   424   NtReadVirtualMemory  (68, 0x184130, 76, ...  (68, 0x184130, 76, ... "\330A\30\0\220@\30\0\340A\30\0\230@\30\0\0@\30\0\240@\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\350@\30\0\26\0\30\0\20A\30\0\6@\10\0\20\0\0\0\254L\30\0\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00549   424   NtReadVirtualMemory  (68, 0x1841d8, 76, ...  (68, 0x1841d8, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\00C\30\0\0\0\35u\335\243\35u\0\220\2\0@\0B\0\210A\30\0\30\0\32\0\260A\30\0\4@\14\0\1\0\0\0\364O\30\0\34;\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00550   424   NtReadVirtualMemory  (68, 0x184278, 76, ...  (68, 0x184278, 76, ... " C\30\0\330A\30\0(C\30\0\340A\30\00C\30\0\0@\30\0\0\0zv\32\22zv\00\1\0>\0@\00B\30\0\26\0\30\0XB\30\0\6@\14\0\2\0\0\0|b\30\0\214?\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00551   424   NtReadVirtualMemory  (68, 0x184320, 76, ...  (68, 0x184320, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\350A\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\6@\14\0\3\0\0\0\354_\30\0T+\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00552   424   NtReadVirtualMemory  (68, 0x1843c0, 76, ...  (68, 0x1843c0, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\0xD\30\0\350A\30\0\0\0\365t\10\21\365t\0P\0\0<\0>\0xC\30\0\24\0\26\0\240C\30\0\4@\14\0\1\0\0\0dJ\30\0D>\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00553   424   NtReadVirtualMemory  (68, 0x184468, 76, ...  (68, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\320C\30\0\0\0\213p\275#\213p\0\300\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\10\0\1\0\0\0\254T\30\0\274/\30\0>\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00554   424   NtReadVirtualMemory  (68, 0x184508, 76, ...  (68, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0hF\30\0xD\30\0\0\0\27u\0\0\0\0\0\0\2\0<\0>\0\300D\30\0\24\0\26\0\350D\30\0\4@\0\0\1\0\0\0\224F\30\0\354>\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00555   424   NtReadVirtualMemory  (68, 0x1845b0, 76, ...  (68, 0x1845b0, 76, ... "XF\30\0\10E\30\0`F\30\0\20E\30\0\220I\30\0\350H\30\0\0\0\372t~\23\372t\0\0\1\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\04G\30\0\314@\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00556   424   NtReadVirtualMemory  (68, 0x184658, 76, ...  (68, 0x184658, 76, ... "\370F\30\0\260E\30\0\0G\30\0\270E\30\0HH\30\0\30E\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\10F\30\0\30\0\32\00F\30\0\6@\14\0\3\0\0\0tH\30\0DE\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00557   424   NtReadVirtualMemory  (68, 0x1846f8, 76, ...  (68, 0x1846f8, 76, ... "\230G\30\0XF\30\0\240G\30\0`F\30\0\350H\30\0\250G\30\0\0\05u\240\245u\0\0\3\0>\0@\0\260F\30\0\26\0\30\0\330F\30\0\6@\14\0\1\0\0\0\324G\30\0\354E\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00558   424   NtReadVirtualMemory  (68, 0x184798, 76, ...  (68, 0x184798, 76, ... "8H\30\0\370F\30\0@H\30\0\0G\30\0\10G\30\0HH\30\0\0\0Mu$\25Mu\0`\7\0>\0@\0PG\30\0\26\0\30\0xG\30\0\6@\14\0\1\0\0\0\X\30\04G\30\0\33\376};X\241\13\0", 76, ) , 76, ) == 0x0
 00559   424   NtReadVirtualMemory  (68, 0x184838, 76, ...  (68, 0x184838, 76, ... "\330H\30\0\230G\30\0\340H\30\0\240G\30\0\250G\30\0hF\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\360G\30\0\26\0\30\0\30H\30\0\6@\10\0\4\0\0\0\274I\30\0\224F\30\0\26\376};X\241\13\0", 76, ) , 76, ) == 0x0
 00560   424   NtReadVirtualMemory  (68, 0x1848d8, 76, ...  (68, 0x1848d8, 76, ... "\200I\30\08H\30\0\210I\30\0@H\30\0\300E\30\0\10G\30\0\0\0qi\320\22qi\0\320\17\0:\0<\0\220H\30\0\22\0\24\0\270H\30\0\6@\10\0\1\0\0\0$R\30\0\200Z\374w\210\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00561   424   NtReadVirtualMemory  (68, 0x184980, 76, ...  (68, 0x184980, 76, ... "(J\30\0\330H\30\00J\30\0\340H\30\08J\30\0\300E\30\0\0\0\354t\0\0\0\0\0P\0\0@\0B\00I\30\0\30\0\32\0XI\30\0\4@\0\0\1\0\0\0\14K\30\0tH\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00562   424   NtReadVirtualMemory  (68, 0x184a28, 76, ...  (68, 0x184a28, 76, ... "\320J\30\0\200I\30\0\330J\30\0\210I\30\0\340K\30\0\220I\30\0\0\0Lr\3662Lr\0\360\0\0@\0B\0\330I\30\0\30\0\32\0\0J\30\0\4@\10\0\1\0\0\0\354M\30\0\374C\30\0,\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00563   424   NtReadVirtualMemory  (68, 0x184ad0, 76, ...  (68, 0x184ad0, 76, ... "\320K\30\0(J\30\0\330K\30\00J\30\0\300M\30\0\200L\30\0\0\0zY7\255zY\0\300\1\0F\0H\0\200J\30\0\24\0\26\0\262J\30\0\4@\14\0\1\0\0\0\14L\30\0\274I\30\0\325\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00564   424   NtReadVirtualMemory  (68, 0x184bd0, 76, ...  (68, 0x184bd0, 76, ... "pL\30\0\320J\30\0xL\30\0\330J\30\0\200L\30\08J\30\0\0\0)u\222\217)u\0\200\3\0J\0L\0xK\30\0\30\0\32\0\252K\30\0\6@\14\0\20\0\0\0LM\30\0\14K\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00565   424   NtReadVirtualMemory  (68, 0x184c70, 76, ...  (68, 0x184c70, 76, ... "\20M\30\0\320K\30\0\30M\30\0\330K\30\0\340J\30\0\340K\30\0\0\0>u\231s@u\0\200\6\0<\0>\0(L\30\0\24\0\26\0PL\30\0\6@\10\0\1\0\0\0\10[\374wlA\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00566   424   NtReadVirtualMemory  (68, 0x184d10, 76, ...  (68, 0x184d10, 76, ... "\260M\30\0pL\30\0\270M\30\0xL\30\0\210N\30\0\300M\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\310L\30\0\26\0\30\0\360L\30\0\4@\0\0\3\0\0\0\14T\30\0\14L\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00567   424   NtReadVirtualMemory  (68, 0x184db0, 76, ...  (68, 0x184db0, 76, ... "xN\30\0\20M\30\0\200N\30\0\30M\30\0 M\30\0\340J\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0hM\30\0\26\0\30\0\220M\30\0\6@\14\0\3\0\0\0\354P\30\0dJ\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00568   424   NtReadVirtualMemory  (68, 0x184e78, 76, ...  (68, 0x184e78, 76, ... "\30O\30\0\260M\30\0 O\30\0\270M\30\0(O\30\0 M\30\0\0\0\364t\354!\364t\0\240\0\0^\0b\0\10N\30\0\24\0\30\0RN\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00569   424   NtReadVirtualMemory  (68, 0x184f18, 76, ...  (68, 0x184f18, 76, ... "\270O\30\0xN\30\0\300O\30\0\200N\30\0\310O\30\0\210N\30\0\0\0\7u\24\31\7u\0`\1\0<\0>\0\320N\30\0\24\0\26\0\370N\30\0\4@\14\0\1\0\0\0L_\30\044\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00570   424   NtReadVirtualMemory  (68, 0x184fb8, 76, ...  (68, 0x184fb8, 76, ... "\20P\30\0\30O\30\0\30P\30\0 O\30\0 P\30\0(O\30\0\0\0\32uh\342\32u\0\240\2\0:\0<\0pO\30\0\22\0\24\0\230O\30\0\4@\14\0\1\0\0\0LP\30\0\24B\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00571   424   NtReadVirtualMemory  (68, 0x185010, 76, ...  (68, 0x185010, 76, ... "\260P\30\0\270O\30\0\270P\30\0\300O\30\0\300P\30\0\310O\30\0\0\0\322s\0\0\0\0\0\220\0\0@\0B\0(K\30\0\30\0\32\0PK\30\0\4@\0\0\1\0\0\0\214Q\30\0\364O\30\0$\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00572   424   NtReadVirtualMemory  (68, 0x1850b0, 76, ...  (68, 0x1850b0, 76, ... "PQ\30\0\20P\30\0XQ\30\0\30P\30\0`Q\30\0 P\30\0\0\0\366t\0\0\0\0\0\260\0\0<\0>\0hP\30\0\24\0\26\0\220P\30\0\4@\0\0\1\0\0\0\374X\30\0\354M\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00573   424   NtReadVirtualMemory  (68, 0x185150, 76, ...  (68, 0x185150, 76, ... "\350Q\30\0\260P\30\0\360Q\30\0\270P\30\0\370Q\30\0\300P\30\0\0\0\11u\0\0\0\0\0p\1\0<\0>\0\10Q\30\0\24\0\26\00Q\30\0\4@\0\0\1\0\0\0DU\30\0LP\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00574   424   NtReadVirtualMemory  (68, 0x1851e8, 76, ...  (68, 0x1851e8, 76, ... "\210R\30\0PQ\30\0\220R\30\0XQ\30\0\230R\30\0`Q\30\0\0\0\267v!\226\271v\0\320\3\04\06\0\250Q\30\0\14\0\16\0\320Q\30\0\4@\14\0\3\0\0\0\304R\30\0\24I\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00575   424   NtReadVirtualMemory  (68, 0x185288, 76, ...  (68, 0x185288, 76, ... "0S\30\0\350Q\30\08S\30\0\360Q\30\0@S\30\0\370Q\30\0\0\0\370tg0\370t\0\200\0\0:\0<\0@R\30\0\22\0\24\0hR\30\0\4@\14\0\1\0\0\0Lg\30\0$R\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00576   424   NtReadVirtualMemory  (68, 0x185330, 76, ...  (68, 0x185330, 76, ... "\320S\30\0\210R\30\0\330S\30\0\220R\30\0\200T\30\0\230R\30\0\0\0\371t\0\21\371t\0\220\0\0@\0B\0\340R\30\0\30\0\32\0\10S\30\0\4@\10\0\1\0\0\0xZ\374wl)\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00577   424   NtReadVirtualMemory  (68, 0x1853d0, 76, ...  (68, 0x1853d0, 76, ... "pT\30\00S\30\0xT\30\08S\30\0XV\30\0\30U\30\0\0\0\0u\31\222\0u\0\260\1\0>\0@\0\210S\30\0\26\0\30\0\260S\30\0\4@\14\0\1\0\0\0$W\30\0LM\30\0\35\376};p\244\14\0", 76, ) , 76, ) == 0x0
 00578   424   NtReadVirtualMemory  (68, 0x185470, 76, ...  (68, 0x185470, 76, ... "\10U\30\0\320S\30\0\20U\30\0\330S\30\0\270U\30\0@S\30\0\0\0&u\305H&u\0p\2\0>\0@\0(T\30\0\26\0\30\0PT\30\0\6@\10\0\1\0\0\0\254]\30\0\244D\30\0\34\376};p\244\14\0", 76, ) , 76, ) == 0x0
 00579   424   NtReadVirtualMemory  (68, 0x185508, 76, ...  (68, 0x185508, 76, ... "\250U\30\0pT\30\0\260U\30\0xT\30\0\340S\30\0\270U\30\0\0\0\273v\0\0\0\0\0@\0\06\08\0\310T\30\0\16\0\20\0\360T\30\0\6@\0\0\1\0\0\0\344U\30\0\214Q\30\0\23\376};p\244\14\0", 76, ) , 76, ) == 0x0
 00580   424   NtReadVirtualMemory  (68, 0x1855a8, 76, ...  (68, 0x1855a8, 76, ... "HV\30\0\10U\30\0PV\30\0\20U\30\0\30U\30\0\200T\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0`U\30\0\24\0\26\0\210U\30\0\6@\14\0\2\0\0\0\204V\30\0DU\30\0\22\376};p\244\14\0", 76, ) , 76, ) == 0x0
 00581   424   NtReadVirtualMemory  (68, 0x185648, 76, ...  (68, 0x185648, 76, ... "\350V\30\0\250U\30\0\360V\30\0\260U\30\0\370V\30\0\340S\30\0\0\0-r\201\22-r\0\300\0\08\0:\0\0V\30\0\20\0\22\0(V\30\0\4@\14\0\1\0\0\0\274W\30\0\344U\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00582   424   NtReadVirtualMemory  (68, 0x1856e8, 76, ...  (68, 0x1856e8, 76, ... "\200W\30\0HV\30\0\210W\30\0PV\30\0\220W\30\0XV\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\240V\30\0\24\0\26\0\310V\30\0\4@\14\0\1\0\0\0\234Y\30\0\14T\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00583   424   NtReadVirtualMemory  (68, 0x185780, 76, ...  (68, 0x185780, 76, ... " X\30\0\350V\30\0(X\30\0\360V\30\0pY\30\0\370V\30\0\0\0\351u\212\23\351u\0\20\12\06\08\0@W\30\0\16\0\20\0hW\30\0\4@\10\0\1\0\0\0\d\30\0\204V\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00584   424   NtReadVirtualMemory  (68, 0x185820, 76, ...  (68, 0x185820, 76, ... "\300X\30\0\200W\30\0\310X\30\0\210W\30\0\260Z\30\0\20Z\30\0\0\0suh"su\0\320\21\0>\0@\0\330W\30\0\26\0\30\0\0X\30\0\4@\14\0\2\0\0\00\320\21\0>\0@\0\330W\30\0\26\0\30\0\0X\30\0\4@\14\0\2\0\0\030\0\324G\30\0\31\376};\0\0\0\0", 76, ) == 0x0
 00585   424   NtReadVirtualMemory  (68, 0x1858c0, 76, ...  (68, 0x1858c0, 76, ... "`Y\30\0 X\30\0hY\30\0(X\30\0\20Z\30\0pY\30\0\0\0\17u@\22\17u\0 \1\0<\0>\0xX\30\0\24\0\26\0\240X\30\0\6@\14\0\2\0\0\0$\\30\0\354P\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00586   424   NtReadVirtualMemory  (68, 0x185960, 76, ...  (68, 0x185960, 76, ... "\0Z\30\0\300X\30\0\10Z\30\0\310X\30\0\320X\30\0\220W\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\0\30Y\30\0\26\0\30\0@Y\30\0\6@\0\0\2\0\0\0\254e\30\0$W\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00587   424   NtReadVirtualMemory  (68, 0x185a00, 76, ...  (68, 0x185a00, 76, ... "\240Z\30\0`Y\30\0\250Z\30\0hY\30\00X\30\0\320X\30\0\0\0\23u*\24\23u\00\1\0>\0@\0\270Y\30\0\26\0\30\0\340Y\30\0\6@\14\0\2\0\0\0\334Z\30\0\X\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00588   424   NtReadVirtualMemory  (68, 0x185aa0, 76, ...  (68, 0x185aa0, 76, ... "H[\30\0\0Z\30\0P[\30\0\10Z\30\0X[\30\00X\30\0\0\0\374t\0\0\0\0\0\0\1\0>\0@\0XZ\30\0\26\0\30\0\200Z\30\0\4@\0\0\3\0\0\0\34c\30\0, 76, ) , 76, ) == 0x0
 00589   424   NtReadVirtualMemory  (68, 0x185b48, 76, ...  (68, 0x185b48, 76, ... "\350[\30\0\240Z\30\0\360[\30\0\250Z\30\0\370[\30\0\260Z\30\0\0\0\13u\320\21\13u\0\20\1\0@\0B\0\370Z\30\0\30\0\32\0 [\30\0\4@\14\0\1\0\0\0T^\30\0\4=\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00590   424   NtReadVirtualMemory  (68, 0x185be8, 76, ...  (68, 0x185be8, 76, ... "\310\\30\0H[\30\0\320\\30\0P[\30\0\330\\30\0X[\30\0\0\0\15uP\21\15u\0p\1\0<\0>\0\240[\30\0\24\0\26\0\310[\30\0\4@\10\0\1\0\0\0\254^\30\0\374X\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00591   424   NtReadVirtualMemory  (68, 0x185cc8, 76, ...  (68, 0x185cc8, 76, ... "p]\30\0\350[\30\0x]\30\0\360[\30\0\200]\30\0\370[\30\0\0\0\376t\0\0\0\0\0\360\0\0>\0@\0\200\\30\0\26\0\30\0\250\\30\0\4@\0\0\1\0\0\0hZ\374whZ\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00592   424   NtReadVirtualMemory  (68, 0x185d70, 76, ...  (68, 0x185d70, 76, ... "\30^\30\0\310\\30\0 ^\30\0\320\\30\0(^\30\0\330\\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0 ]\30\0\30\0\32\0H]\30\0\4@\14\0\1\0\0\0\214`\30\0\254T\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00593   424   NtReadVirtualMemory  (68, 0x185e18, 76, ...  (68, 0x185e18, 76, ... "p^\30\0p]\30\0x^\30\0x]\30\0\200^\30\0\200]\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\310]\30\0\30\0\32\0\360]\30\0\4@\14\0\1\0\0\0\324a\30\0\204[\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00594   424   NtReadVirtualMemory  (68, 0x185e70, 76, ...  (68, 0x185e70, 76, ... "\20_\30\0\30^\30\0\30_\30\0 ^\30\0\300_\30\0(^\30\0\0\0@v:\222@v\0\260\37\06\08\0@\\30\0\16\0\20\0h\\30\0\4@\14\0\1\0\0\04a\30\0$\\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00595   424   NtReadVirtualMemory  (68, 0x185f10, 76, ...  (68, 0x185f10, 76, ... "\260_\30\0p^\30\0\270_\30\0x^\30\0\250a\30\0\10a\30\0\0\0-u\230`-u\0\240\3\0>\0@\0\310^\30\0\26\0\30\0\360^\30\0\4@\14\0\1\0\0\0\370Z\374wTO\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00596   424   NtReadVirtualMemory  (68, 0x185fb0, 76, ...  (68, 0x185fb0, 76, ... "P`\30\0\20_\30\0X`\30\0\30_\30\0``\30\0\200^\30\0\0\0\367t\0\0\0\0\0P\0\0<\0>\0h_\30\0\24\0\26\0\220_\30\0\6@\0\0\1\0\0\0\240Z\374w\C\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00597   424   NtReadVirtualMemory  (68, 0x186050, 76, ...  (68, 0x186050, 76, ... "\370`\30\0\260_\30\0\0a\30\0\270_\30\0\10a\30\0\300_\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\10`\30\0\22\0\24\00`\30\0\6@\10\0\1\0\0\0`Z\374w\254]\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00598   424   NtReadVirtualMemory  (68, 0x1860f8, 76, ...  (68, 0x1860f8, 76, ... "\230a\30\0P`\30\0\240a\30\0X`\30\0 _\30\0``\30\0\0\0\21u\260Q\21u\0\300\1\0@\0B\0\250`\30\0\30\0\32\0\320`\30\0\6@\14\0\1\0\0\0\300Z\374w\254^\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00599   424   NtReadVirtualMemory  (68, 0x186198, 76, ...  (68, 0x186198, 76, ... "@b\30\0\370`\30\0Hb\30\0\0a\30\0\360b\30\0 _\30\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0Pa\30\0\24\0\26\0xa\30\0\4@\10\0\1\0\0\0\j\30\0T^\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00600   424   NtReadVirtualMemory  (68, 0x186240, 76, ...  (68, 0x186240, 76, ... "\340b\30\0\230a\30\0\350b\30\0\240a\30\00d\30\0\360b\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\360a\30\0\30\0\32\0\30b\30\0\4@\14\0\2\0\0\0dk\30\0\264B\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00601   424   NtReadVirtualMemory  (68, 0x1862e0, 76, ...  (68, 0x1862e0, 76, ... "\200c\30\0@b\30\0\210c\30\0Hb\30\0Pb\30\0\250a\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\230b\30\0\24\0\26\0\300b\30\0\6@\14\0\2\0\0\0pZ\374w\334Z\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00602   424   NtReadVirtualMemory  (68, 0x186380, 76, ...  (68, 0x186380, 76, ... " d\30\0\340b\30\0(d\30\0\350b\30\0\320d\30\00d\30\0\0\0\4u\300\276\4u\0\360\1\08\0:\08c\30\0\20\0\22\0`c\30\0\4@\14\0\1\0\0\0\0[\374w\274;\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00603   424   NtReadVirtualMemory  (68, 0x186420, 76, ...  (68, 0x186420, 76, ... "\300d\30\0\200c\30\0\310d\30\0\210c\30\0\220c\30\0Pb\30\0\0\0\360t\222E\360t\0\240\0\0>\0@\0\330c\30\0\26\0\30\0\0d\30\0\6@\14\0\1\0\0\0\360Z\374w\274W\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00604   424   NtReadVirtualMemory  (68, 0x1864c0, 76, ...  (68, 0x1864c0, 76, ... "pe\30\0 d\30\0xe\30\0(d\30\0\200e\30\0\220c\30\0\0\0\210hw:\212h\0\360\3\0>\0@\0xd\30\0\26\0\30\0\240d\30\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374wk\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00605   424   NtReadVirtualMemory  (68, 0x186570, 76, ...  (68, 0x186570, 76, ... "pf\30\0\300d\30\0xf\30\0\310d\30\0 h\30\0\320d\30\0\0\0\357t\14\22\357t\0\240\0\0J\0L\0\30e\30\0\30\0\32\0Je\30\0\4@\14\0\1\0\0\0\254f\30\0\234Y\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00606   424   NtReadVirtualMemory  (68, 0x186670, 76, ...  (68, 0x186670, 76, ... "\20g\30\0pe\30\0\30g\30\0xe\30\0\320h\30\0 g\30\0\0\0Eu\26\0Ju\0p\7\0J\0L\0\30f\30\0\30\0\32\0Jf\30\0\4@\14\0\1\0\0\0\374h\30\0\254e\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00607   424   NtReadVirtualMemory  (68, 0x186710, 76, ...  (68, 0x186710, 76, ... "\20h\30\0pf\30\0\30h\30\0xf\30\0\200f\30\0 h\30\0\0\01u\0\2713u\0\300\3\0F\0H\0\310e\30\0\24\0\26\0\372e\30\0\6@\14\0\4\0\0\0\200Z\374w\304R\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00608   424   NtReadVirtualMemory  (68, 0x186810, 76, ...  (68, 0x186810, 76, ... "\300h\30\0\20g\30\0\310h\30\0\30g\30\0 g\30\0\200e\30\0\0\0iu\317\254mu\0 \11\0J\0L\0\270g\30\0\30\0\32\0\352g\30\0\6@\14\0\10\0\0\0\210Z\374w\210Z\374w\32\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00609   424   NtReadVirtualMemory  (68, 0x1868c0, 76, ...  (68, 0x1868c0, 76, ... "pi\30\0\20h\30\0xi\30\0\30h\30\0\200i\30\0\200f\30\0\0\0\355t\16\246\355t\0\360\0\0H\0J\0hh\30\0\26\0\30\0\232h\30\0\4@\10\0\1\0\0\0\254i\30\0\254f\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00610   424   NtReadVirtualMemory  (68, 0x186970, 76, ...  (68, 0x186970, 76, ... " j\30\0\300h\30\0(j\30\0\310h\30\00j\30\0\320h\30\0\0\0\2u\254\365\2u\0\260\1\0J\0L\0\30i\30\0\30\0\32\0Ji\30\0\4@\14\0\1\0\0\0\14k\30\0\374h\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00611   424   NtReadVirtualMemory  (68, 0x186a20, 76, ...  (68, 0x186a20, 76, ... "\320j\30\0pi\30\0\330j\30\0xi\30\08k\30\0\200i\30\0\0\0 uh\251!u\0@\2\0J\0L\0\310i\30\0\30\0\32\0\372i\30\0\4@\14\0\1\0\0\0\350Z\374w\324a\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00612   424   NtReadVirtualMemory  (68, 0x186ad0, 76, ...  (68, 0x186ad0, 76, ... "(k\30\0 j\30\00k\30\0(j\30\0\350k\30\08k\30\0\0\0\177Yy\17\204Y\0p\6\0J\0L\0xj\30\0\30\0\32\0\252j\30\0\4@\14\0\1\0\0\0\24l\30\0\254i\30\0\322\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00613   424   NtReadVirtualMemory  (68, 0x186b28, 76, ...  (68, 0x186b28, 76, ... "\330k\30\0\320j\30\0\340k\30\0\330j\30\0\340j\30\00j\30\0\0\0w_5\21w_\0\340\0\0@\0B\0hg\30\0\30\0\32\0\220g\30\0\6@\10\0\2\0\0\0ll\30\0|b\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00614   424   NtReadVirtualMemory  (68, 0x186bd8, 76, ...  (68, 0x186bd8, 76, ... "0l\30\0(k\30\08l\30\00k\30\0@l\30\0\340j\30\0\0\09u\36\315;u\0 \4\0H\0J\0\200k\30\0\26\0\30\0\262k\30\0\4@\14\0\1\0\0\0\20[\374w\14k\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00615   424   NtReadVirtualMemory  (68, 0x186c30, 76, ...  (68, 0x186c30, 76, ... "\234\36\30\0\330k\30\0\244\36\30\0\340k\30\0\254\36\30\0\350k\30\0\0\0_u\261\245bu\0\20\11\0>\0@\0\310f\30\0\26\0\30\0\360f\30\0\4@\14\0\1\0\0\0\310Z\374wdk\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00616   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=972,ParentPid=660,}, 0x0, ) == 0x0
 00617   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00618   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00619   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00620   424   NtReadVirtualMemory  (68, 0x20598, 64, ...  (68, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00621   424   NtClose  (68, ... ) == 0x0
 00622   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1060, 0}, ... 68, ) == 0x0
 00623   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1060,ParentPid=660,}, 0x0, ) == 0x0
 00624   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00625   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00626   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00627   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00628   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00629   424   NtReadVirtualMemory  (68, 0x182068, 76, ...  (68, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0`"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00630   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\260!\30\0h \30\0\270!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\244,\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00631   424   NtReadVirtualMemory  (68, 0x1821b0, 76, ...  (68, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) \30\0\10!\30\0X (68, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00632   424   NtReadVirtualMemory  (68, 0x182250, 76, ...  (68, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\260!\30\0\370 (68, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\00 (68, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00633   424   NtReadVirtualMemory  (68, 0x1822f0, 76, ...  (68, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\230#\30\0X (68, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\320 (68, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00634   424   NtReadVirtualMemory  (68, 0x182390, 76, ...  (68, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\08$\30\0\370 (68, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00635   424   NtReadVirtualMemory  (68, 0x182430, 76, ...  (68, 0x182430, 76, ... "\320$\30\0\220#\30\0\330$\30\0\230#\30\0X)\30\0\340$\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350#\30\0\24\0\26\0\20$\30\0\6@\14\0\3\0\0\044\30\0\354!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00636   424   NtReadVirtualMemory  (68, 0x1824d0, 76, ...  (68, 0x1824d0, 76, ... "p%\30\00$\30\0x%\30\08$\30\0@$\30\0\200%\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210$\30\0\24\0\26\0\260$\30\0\6@\10\0\16\0\0\0\254%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00637   424   NtReadVirtualMemory  (68, 0x182570, 76, ...  (68, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0\340$\30\0\0#\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(%\30\0\26\0\30\0P%\30\0\6@\14\0\10\0\0\0$*\30\0\14%\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00638   424   NtReadVirtualMemory  (68, 0x182618, 76, ...  (68, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\300!\30\0\310&\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00639   424   NtReadVirtualMemory  (68, 0x1826b8, 76, ...  (68, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0(&\30\0\3102\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p&\30\0\24\0\26\0\230&\30\0\6@\14\0\2\0\0\0\204)\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00640   424   NtReadVirtualMemory  (68, 0x182758, 76, ...  (68, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0\10/\30\0\300-\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20'\30\0\24\0\26\08'\30\0\6@\14\0\2\0\0\0t5\30\0\214"\30\0\22\376};\0\0\0\0", 76, ) \30\0\22\376};\0\0\0\0", 76, ) == 0x0
 00641   424   NtReadVirtualMemory  (68, 0x182800, 76, ...  (68, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0x,\30\0\330+\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\2\0\0\0\334(\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00642   424   NtReadVirtualMemory  (68, 0x1828a0, 76, ...  (68, 0x1828a0, 76, ... "H)\30\0\0(\30\0P)\30\0\10(\30\0\220*\30\0\370)\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\274*\30\0<(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00643   424   NtReadVirtualMemory  (68, 0x182948, 76, ...  (68, 0x182948, 76, ... "\350)\30\0\240(\30\0\360)\30\0\250(\30\0\370)\30\0@$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370(\30\0\30\0\32\0 )\30\0\6@\14\0\13\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00644   424   NtReadVirtualMemory  (68, 0x1829e8, 76, ...  (68, 0x1829e8, 76, ... "\200*\30\0H)\30\0\210*\30\0P)\30\0\260(\30\0X)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240)\30\0\26\0\30\0\310)\30\0\6@\10\0\2\0\0\0\241\30\0\254%\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00645   424   NtReadVirtualMemory  (68, 0x182a80, 76, ...  (68, 0x182a80, 76, ... " +\30\0\350)\30\0(+\30\0\360)\30\00+\30\0\260(\30\0\0\0\262v<-\262v\0P\1\06\08\0@*\30\0\16\0\20\0h*\30\0\6@\14\0\2\0\0\0`Z\374w\334(\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00646   424   NtReadVirtualMemory  (68, 0x182b20, 76, ...  (68, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\330*\30\0\22\0\24\0\0+\30\0\6@\10\0\15\0\0\0\4,\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00647   424   NtReadVirtualMemory  (68, 0x182bc8, 76, ...  (68, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0\20(\30\00+\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\10\0\0\0\320Z\374w\+\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00648   424   NtReadVirtualMemory  (68, 0x182c68, 76, ...  (68, 0x182c68, 76, ... "\10-\30\0\310+\30\0\20-\30\0\320+\30\0\30-\30\0\20(\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\14\0\7\0\0\0\224.\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00649   424   NtReadVirtualMemory  (68, 0x182d08, 76, ...  (68, 0x182d08, 76, ... "\260-\30\0h,\30\0\270-\30\0p,\30\0\300-\30\0x,\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\300,\30\0\24\0\26\0\350,\30\0\6@\10\0\2\0\0\0\354-\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00650   424   NtReadVirtualMemory  (68, 0x182db0, 76, ...  (68, 0x182db0, 76, ... "X.\30\0\10-\30\0`.\30\0\20-\30\0h'\30\0\30-\30\0\0\0gv8\25gv\0@\16\0@\0B\0`-\30\0\30\0\32\0\210-\30\0\6@\10\0\2\0\0\0t0\30\0D-\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00651   424   NtReadVirtualMemory  (68, 0x182e58, 76, ...  (68, 0x182e58, 76, ... "\370.\30\0\260-\30\0\0/\30\0\270-\30\0\2101\30\0\250/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\10.\30\0\30\0\32\00.\30\0\6@\14\0\3\0\0\04/\30\0\244,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00652   424   NtReadVirtualMemory  (68, 0x182ef8, 76, ...  (68, 0x182ef8, 76, ... "\230/\30\0X.\30\0\240/\30\0`.\30\0H0\30\0h'\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\260.\30\0\24\0\26\0\330.\30\0\6@\14\0\3\0\0\0\350Z\374w\224.\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00653   424   NtReadVirtualMemory  (68, 0x182f98, 76, ...  (68, 0x182f98, 76, ... "80\30\0\370.\30\0@0\30\0\0/\30\0h.\30\0\3500\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0P/\30\0\24\0\26\0x/\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00654   424   NtReadVirtualMemory  (68, 0x183038, 76, ...  (68, 0x183038, 76, ... "\3300\30\0\230/\30\0\3400\30\0\240/\30\0\3500\30\0\10/\30\0\0\0-w\306@-w\00\6\0>\0@\0\360/\30\0\26\0\30\0\300\30\0\6@\14\0\11\0\0\0\2641\30\0\354-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00655   424   NtReadVirtualMemory  (68, 0x1830d8, 76, ...  (68, 0x1830d8, 76, ... "x1\30\080\30\0\2001\30\0@0\30\0\250/\30\0H0\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2200\30\0\22\0\24\0\2700\30\0\6@\14\0\3\0\0\0\3642\30\0$*\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00656   424   NtReadVirtualMemory  (68, 0x183178, 76, ...  (68, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0(2\30\0h.\30\0\0\0=w\24 ?w\0@\177\0>\0@\001\30\0\26\0\30\0X1\30\0\6@\10\0\2\0\0\0T2\30\0t0\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00657   424   NtReadVirtualMemory  (68, 0x183218, 76, ...  (68, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0`3\30\0\2101\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3201\30\0\26\0\30\0\3701\30\0\6@\14\0\6\0\0\0\360Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00658   424   NtReadVirtualMemory  (68, 0x1832b8, 76, ...  (68, 0x1832b8, 76, ... "P3\30\0\302\30\0X3\30\0 2\30\0\310&\30\0\3605\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00659   424   NtReadVirtualMemory  (68, 0x183350, 76, ...  (68, 0x183350, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\104\30\0(2\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\203\30\0\16\0\20\083\30\0\6@\0\0\2\0\0\0\346\30\0\3642\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00660   424   NtReadVirtualMemory  (68, 0x1833f8, 76, ...  (68, 0x1833f8, 76, ... "\2304\30\0P3\30\0\2404\30\0X3\30\0H5\30\0`3\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2503\30\0\30\0\32\0\3203\30\0\6@\14\0\2\0\0\0xZ\374wl$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00661   424   NtReadVirtualMemory  (68, 0x183498, 76, ...  (68, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\2206\30\0H5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0P4\30\0\26\0\30\0x4\30\0\6@\10\0\2\0\0\0\3647\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00662   424   NtReadVirtualMemory  (68, 0x183538, 76, ...  (68, 0x183538, 76, ... "\3405\30\0\2304\30\0\3505\30\0\2404\30\0\2504\30\0\104\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3604\30\0\24\0\26\0\305\30\0\6@\14\0\2\0\0\0<9\30\0\224'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00663   424   NtReadVirtualMemory  (68, 0x1835e0, 76, ...  (68, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\3102\30\0\2206\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\0\0\2\0\0\0\2746\30\0\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00664   424   NtReadVirtualMemory  (68, 0x183680, 76, ...  (68, 0x183680, 76, ... "\2707\30\0\3405\30\0\3007\30\0\3505\30\0\3605\30\0\2504\30\0\0\06v\240\206v\0\360\0\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\10\0\4\0\0\0\3449\30\0\346\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00665   424   NtReadVirtualMemory  (68, 0x1837b8, 76, ...  (68, 0x1837b8, 76, ... "`8\30\0\2006\30\0h8\30\0\2106\30\0p8\30\0\300!\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3306\30\0\30\0\32\0\2267\30\0\4@\14\20\2\0\0\0\2348\30\0\3244\30\02\376};\200x\10\0", 76, ) , 76, ) == 0x0
 00666   424   NtReadVirtualMemory  (68, 0x183860, 76, ...  (68, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0\209\30\0\3107\30\0\0\04wY\324w\0\260\10\0@\0B\0\208\30\0\30\0\32\088\30\0\4@\14\0\1\0\0\0pZ\374w\3647\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00667   424   NtReadVirtualMemory  (68, 0x183900, 76, ...  (68, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\2709\30\0p8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\4@\10\0\2\0\0\0\300Z\374wt5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00668   424   NtReadVirtualMemory  (68, 0x1839a8, 76, ...  (68, 0x1839a8, 76, ... "\234\36\30\0\09\30\0\244\36\30\0\109\30\0\254\36\30\0\209\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\4@\14\0\1\0\0\0\20[\374w\2746\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00669   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1060,ParentPid=660,}, 0x0, ) == 0x0
 00670   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00671   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00672   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00673   424   NtReadVirtualMemory  (68, 0x20598, 64, ...  (68, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00674   424   NtClose  (68, ... ) == 0x0
 00675   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1088, 0}, ... 68, ) == 0x0
 00676   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 00677   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00678   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00679   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00680   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00681   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00682   424   NtReadVirtualMemory  (68, 0x182068, 76, ...  (68, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00683   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\274*\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00684   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00685   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00686   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00687   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00688   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\20(\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0r\0\0\0L&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00689   424   NtReadVirtualMemory  (68, 0x1824d0, 76, ...  (68, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\230#\30\0\200%\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00690   424   NtReadVirtualMemory  (68, 0x182570, 76, ...  (68, 0x182570, 76, ... "\20&\30\0\320$\30\0\30&\30\0\330$\30\0\340$\30\0 2\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%\30\0\24\0\26\0P%\30\0\6@\14\0\2\0\0\0<(\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00691   424   NtReadVirtualMemory  (68, 0x182610, 76, ...  (68, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0`.\30\0\330+\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\2\0\0\0l5\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00692   424   NtReadVirtualMemory  (68, 0x1826b8, 76, ...  (68, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0\220*\30\0\360)\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\14\0\2\0\0\0\224'\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00693   424   NtReadVirtualMemory  (68, 0x182758, 76, ...  (68, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0H)\30\0\260(\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\2\0\0\0t)\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00694   424   NtReadVirtualMemory  (68, 0x182800, 76, ...  (68, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\260(\30\08$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\13\0\0\0\310Z\374w\254%\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00695   424   NtReadVirtualMemory  (68, 0x1828a0, 76, ...  (68, 0x1828a0, 76, ... "8)\30\0\0(\30\0@)\30\0\10(\30\0h'\30\0\20(\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\354-\30\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00696   424   NtReadVirtualMemory  (68, 0x182938, 76, ...  (68, 0x182938, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\360)\30\0h'\30\0\0\0\262v<-\262v\0P\1\06\08\0\370(\30\0\16\0\20\0 )\30\0\6@\14\0\2\0\0\0`Z\374w\224'\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00697   424   NtReadVirtualMemory  (68, 0x1829e0, 76, ...  (68, 0x1829e0, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\310&\30\0H)\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\220)\30\0\30\0\32\0\270)\30\0\6@\10\0\11\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00698   424   NtReadVirtualMemory  (68, 0x182a80, 76, ...  (68, 0x182a80, 76, ... " +\30\0\340)\30\0(+\30\0\350)\30\00+\30\0\310&\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\08*\30\0\26\0\30\0`*\30\0\6@\14\0\7\0\0\0\254,\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00699   424   NtReadVirtualMemory  (68, 0x182b20, 76, ...  (68, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\330*\30\0\24\0\26\0\0+\30\0\6@\10\0\2\0\0\0\4,\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00700   424   NtReadVirtualMemory  (68, 0x182bc8, 76, ...  (68, 0x182bc8, 76, ... "p,\30\0 +\30\0x,\30\0(+\30\0 &\30\00+\30\0\0\0gv8\25gv\0@\16\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\2\0\0\0\314/\30\0\+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00701   424   NtReadVirtualMemory  (68, 0x182c70, 76, ...  (68, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\3400\30\0\0/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\3\0\0\0L-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00702   424   NtReadVirtualMemory  (68, 0x182d10, 76, ...  (68, 0x182d10, 76, ... "\260-\30\0p,\30\0\270-\30\0x,\30\0\240/\30\0\300-\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\310,\30\0\24\0\26\0\360,\30\0\6@\14\0\3\0\0\0\3349\30\0\254,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00703   424   NtReadVirtualMemory  (68, 0x182db0, 76, ...  (68, 0x182db0, 76, ... "P.\30\0\20-\30\0X.\30\0\30-\30\0 -\30\0`.\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h-\30\0\24\0\26\0\220-\30\0\6@\10\00\0\0\0\214.\30\0\334(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00704   424   NtReadVirtualMemory  (68, 0x182e50, 76, ...  (68, 0x182e50, 76, ... "\360.\30\0\260-\30\0\370.\30\0\270-\30\0\300-\30\0 &\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10.\30\0\26\0\30\00.\30\0\6@\14\0+\0\0\0l0\30\0\354-\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00705   424   NtReadVirtualMemory  (68, 0x182ef0, 76, ...  (68, 0x182ef0, 76, ... "\220/\30\0P.\30\0\230/\30\0X.\30\0\200,\30\0@0\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\250.\30\0\24\0\26\0\320.\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00706   424   NtReadVirtualMemory  (68, 0x182f90, 76, ...  (68, 0x182f90, 76, ... "00\30\0\360.\30\080\30\0\370.\30\0@0\30\0 -\30\0\0\0-w\306@-w\00\6\0>\0@\0H/\30\0\26\0\30\0p/\30\0\6@\14\0\15\0\0\0\141\30\0\4,\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00707   424   NtReadVirtualMemory  (68, 0x183030, 76, ...  (68, 0x183030, 76, ... "\3200\30\0\220/\30\0\3300\30\0\230/\30\0\0/\30\0\240/\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\350/\30\0\22\0\24\0\200\30\0\6@\14\0\3\0\0\0L2\30\0\214.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00708   424   NtReadVirtualMemory  (68, 0x1830d0, 76, ...  (68, 0x1830d0, 76, ... "p1\30\000\30\0x1\30\080\30\0\2001\30\0\200,\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2100\30\0\26\0\30\0\2600\30\0\6@\10\0\4\0\0\0\2541\30\0\314/\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00709   424   NtReadVirtualMemory  (68, 0x183170, 76, ...  (68, 0x183170, 76, ... "\202\30\0\3200\30\0\302\30\0\3300\30\0\2702\30\0\3400\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0(1\30\0\26\0\30\0P1\30\0\6@\14\0\10\0\0\0\374<\30\0\141\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00710   424   NtReadVirtualMemory  (68, 0x183210, 76, ...  (68, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\200%\30\0\3505\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00711   424   NtReadVirtualMemory  (68, 0x1832a8, 76, ...  (68, 0x1832a8, 76, ... "P3\30\0\202\30\0X3\30\0\302\30\0\04\30\0\2001\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\0\0\2\0\0\0\246\30\0L2\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00712   424   NtReadVirtualMemory  (68, 0x183350, 76, ...  (68, 0x183350, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0@5\30\0\04\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\03\30\0\30\0\32\0(3\30\0\6@\14\0\2\0\0\0,4\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00713   424   NtReadVirtualMemory  (68, 0x1833f0, 76, ...  (68, 0x1833f0, 76, ... "\2204\30\0P3\30\0\2304\30\0X3\30\0`3\30\0\2702\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\2503\30\0\24\0\26\0\3203\30\0\6@\14\0\3\0\0\0xZ\374w\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00714   424   NtReadVirtualMemory  (68, 0x183490, 76, ...  (68, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\2106\30\0@5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\10\0\3\0\0\0\3547\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00715   424   NtReadVirtualMemory  (68, 0x183530, 76, ...  (68, 0x183530, 76, ... "\3305\30\0\2204\30\0\3405\30\0\2304\30\0\2404\30\0`3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\14\0\3\0\0\049\30\0L&\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00716   424   NtReadVirtualMemory  (68, 0x1835d8, 76, ...  (68, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0 2\30\0\2106\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\0\0\2\0\0\0\2646\30\0\3442\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00717   424   NtReadVirtualMemory  (68, 0x183678, 76, ...  (68, 0x183678, 76, ... "\2607\30\0\3305\30\0\2707\30\0\3405\30\0\3505\30\0\2404\30\0\0\06v\240\206v\0\360\0\0<\0>\006\30\0\24\0\26\0X6\30\0\6@\10\0\4\0\0\0|:\30\0\246\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00718   424   NtReadVirtualMemory  (68, 0x1837b0, 76, ...  (68, 0x1837b0, 76, ... "X8\30\0x6\30\0`8\30\0\2006\30\0h8\30\0\230#\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3206\30\0\30\0\32\0\2167\30\0\4@\14\20\3\0\0\0\2248\30\0\3144\30\02\376};\330\324\10\0", 76, ) , 76, ) == 0x0
 00719   424   NtReadVirtualMemory  (68, 0x183858, 76, ...  (68, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\109\30\0\3007\30\0\0\04wY\324w\0\260\10\0@\0B\0\108\30\0\30\0\32\008\30\0\4@\14\0\1\0\0\0pZ\374w\3547\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00720   424   NtReadVirtualMemory  (68, 0x1838f8, 76, ...  (68, 0x1838f8, 76, ... "\2409\30\0X8\30\0\2509\30\0`8\30\0\2609\30\0h8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\4\0\0\0\300Z\374wl5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00721   424   NtReadVirtualMemory  (68, 0x1839a0, 76, ...  (68, 0x1839a0, 76, ... "@:\30\0\3708\30\0H:\30\0\09\30\0\360:\30\0\109\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0P9\30\0\30\0\32\0x9\30\0\4@\14\0\1\0\0\0\<\30\0L-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00722   424   NtReadVirtualMemory  (68, 0x183a40, 76, ...  (68, 0x183a40, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\220;\30\0\360:\30\0\0\0nZ\0\0\0\0\0@\1\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\4@\0\0\1\0\0\0\34;\30\0\2646\30\0\321\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00723   424   NtReadVirtualMemory  (68, 0x183ae0, 76, ...  (68, 0x183ae0, 76, ... "\200;\30\0@:\30\0\210;\30\0H:\30\0P:\30\0\2609\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\230:\30\0\26\0\30\0\300:\30\0\6@\10\0\1\0\0\0\274;\30\0|:\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00724   424   NtReadVirtualMemory  (68, 0x183b80, 76, ...  (68, 0x183b80, 76, ... " <\30\0\340:\30\0(<\30\0\350:\30\00<\30\0P:\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\08;\30\0\26\0\30\0`;\30\0\4@\0\0\1\0\0\0\244=\30\0\34;\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00725   424   NtReadVirtualMemory  (68, 0x183c20, 76, ...  (68, 0x183c20, 76, ... "\300<\30\0\200;\30\0\310<\30\0\210;\30\0\320<\30\0\220;\30\0\0\0\302t\220\22\302t\0\0\1\0<\0>\0\330;\30\0\24\0\26\0\0<\30\0\4@\10\0\1\0\0\0\350Z\374w\3349\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00726   424   NtReadVirtualMemory  (68, 0x183cc0, 76, ...  (68, 0x183cc0, 76, ... "h=\30\0 <\30\0p=\30\0(<\30\0x=\30\00<\30\0\0\0\301t`\36\301t\0\320\0\0>\0@\0x<\30\0\26\0\30\0\240<\30\0\4@\14\0\1\0\0\0\360Z\374w\2541\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00727   424   NtReadVirtualMemory  (68, 0x183d68, 76, ...  (68, 0x183d68, 76, ... "\10>\30\0\300<\30\0\20>\30\0\310<\30\0\30>\30\0\320<\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\30=\30\0\30\0\32\0@=\30\0\4@\14\0\1\0\0\0\20[\374w\274;\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00728   424   NtReadVirtualMemory  (68, 0x183e08, 76, ...  (68, 0x183e08, 76, ... "\234\36\30\0h=\30\0\244\36\30\0p=\30\0\254\36\30\0x=\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\2\0\0\0\0[\374w$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00729   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 00730   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00731   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00732   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00733   424   NtReadVirtualMemory  (68, 0x20598, 64, ...  (68, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00734   424   NtClose  (68, ... ) == 0x0
 00735   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1368, 0}, ... 68, ) == 0x0
 00736   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1368,ParentPid=660,}, 0x0, ) == 0x0
 00737   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00738   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00739   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00740   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\234.\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00741   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00742   424   NtReadVirtualMemory  (68, 0x182060, 76, ...  (68, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\4,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00743   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00744   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00745   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00746   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00747   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00748   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\330$\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\36\0\0\0\4%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00749   424   NtReadVirtualMemory  (68, 0x1824c8, 76, ...  (68, 0x1824c8, 76, ... "\10&\30\0($\30\0\20&\30\00$\30\08$\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) \30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) == 0x0
 00750   424   NtReadVirtualMemory  (68, 0x182608, 76, ...  (68, 0x182608, 76, ... "\360'\30\0\310$\30\0\370'\30\0\320$\30\0\0(\30\0\230#\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\300%\30\0\24\0\26\0\350%\30\0\4@\14\0\4\0\0\0\34B\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00751   424   NtReadVirtualMemory  (68, 0x1827f0, 76, ...  (68, 0x1827f0, 76, ... "h%\30\0\10&\30\0p%\30\0\20&\30\0X'\30\0\30&\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\240'\30\0\30\0\32\0\310'\30\0\4@\14\0\1\0\0\0,;\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00752   424   NtReadVirtualMemory  (68, 0x182568, 76, ...  (68, 0x182568, 76, ... "H'\30\0\360'\30\0P'\30\0\370'\30\0\310-\30\0 -\30\0\0\02t8Q2t\0\220\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\4\0\0\0\270Z\374w\270Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00753   424   NtReadVirtualMemory  (68, 0x182748, 76, ...  (68, 0x182748, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\0(\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0 %\30\0\22\0\24\0H%\30\0\6@\10\0\34\0\0\0\344&\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00754   424   NtReadVirtualMemory  (68, 0x1826a8, 76, ...  (68, 0x1826a8, 76, ... "\350(\30\0H'\30\0\360(\30\0P'\30\0\370(\30\0X'\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\230(\30\0\30\0\32\0\300(\30\0\6@\10\0\12\0\0\0\320Z\374w\204'\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00755   424   NtReadVirtualMemory  (68, 0x1828e8, 76, ...  (68, 0x1828e8, 76, ... "@)\30\0\250&\30\0H)\30\0\260&\30\0P)\30\0\270&\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\0'\30\0\26\0\30\0('\30\0\6@\10\0\6\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00756   424   NtReadVirtualMemory  (68, 0x182940, 76, ...  (68, 0x182940, 76, ... "\340)\30\0\350(\30\0\350)\30\0\360(\30\0\330+\30\0\370(\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\6@\14\0\7\0\0\0\34*\30\0\304#\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00757   424   NtReadVirtualMemory  (68, 0x1829e0, 76, ...  (68, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0 -\30\0\230*\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0\230)\30\0\24\0\26\0\300)\30\0\6@\14\0\4\0\0\0\314;\30\0|)\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00758   424   NtReadVirtualMemory  (68, 0x182a88, 76, ...  (68, 0x182a88, 76, ... "(+\30\0\340)\30\00+\30\0\350)\30\0\360)\30\0\200,\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\08*\30\0\30\0\32\0`*\30\0\6@\14\0\4\0\0\0\364-\30\0\4%\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00759   424   NtReadVirtualMemory  (68, 0x182b28, 76, ...  (68, 0x182b28, 76, ... "\310+\30\0\210*\30\0\320+\30\0\220*\30\0\200,\30\0\330+\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\340*\30\0\26\0\30\0\10+\30\0\6@\10\0\12\0\0\0, 76, ) , 76, ) == 0x0
 00760   424   NtReadVirtualMemory  (68, 0x182bc8, 76, ...  (68, 0x182bc8, 76, ... "p,\30\0(+\30\0x,\30\00+\30\08+\30\0P)\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\200+\30\0\24\0\26\0\250+\30\0\6@\14\0\11\0\0\0\3041\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00761   424   NtReadVirtualMemory  (68, 0x182c70, 76, ...  (68, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\230*\30\08+\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\4\0\0\0$6\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00762   424   NtReadVirtualMemory  (68, 0x182d10, 76, ...  (68, 0x182d10, 76, ... "\270-\30\0p,\30\0\300-\30\0x,\30\0x%\30\0\360)\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\310,\30\0\26\0\30\0\360,\30\0\6@\14\0\4\0\0\0\341\30\0$#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00763   424   NtReadVirtualMemory  (68, 0x182db8, 76, ...  (68, 0x182db8, 76, ... "`.\30\0\20-\30\0h.\30\0\30-\30\0p.\30\0x%\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0h-\30\0\30\0\32\0\220-\30\0\4@\14\0\2\0\0\0\2542\30\0\304*\30\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00764   424   NtReadVirtualMemory  (68, 0x182e60, 76, ...  (68, 0x182e60, 76, ... "\0/\30\0\270-\30\0\10/\30\0\300-\30\0\20/\30\0\310-\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\20.\30\0\30\0\32\08.\30\0\4@\14\0\12\0\0\0D4\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00765   424   NtReadVirtualMemory  (68, 0x182f00, 76, ...  (68, 0x182f00, 76, ... "\240/\30\0`.\30\0\250/\30\0h.\30\0\260/\30\0p.\30\0\0\0*t\350\24*t\0\340\0\0>\0@\0\270.\30\0\26\0\30\0\340.\30\0\4@\10\0\1\0\0\0\3444\30\0d+\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00766   424   NtReadVirtualMemory  (68, 0x182fa0, 76, ...  (68, 0x182fa0, 76, ... "@0\30\0\0/\30\0H0\30\0\10/\30\0P0\30\0\20/\30\0\0\0(t\37\22(t\0p\0\0<\0>\0X/\30\0\24\0\26\0\200/\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00767   424   NtReadVirtualMemory  (68, 0x183040, 76, ...  (68, 0x183040, 76, ... "\3400\30\0\240/\30\0\3500\30\0\250/\30\0\3600\30\0\260/\30\0\0\0@r\1\26@r\0\300\0\0<\0>\0\370/\30\0\24\0\26\0 0\30\0\4@\14\0\1\0\0\0\>\30\0\370Z\374w-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00768   424   NtReadVirtualMemory  (68, 0x1830e0, 76, ...  (68, 0x1830e0, 76, ... "\2101\30\0@0\30\0\2201\30\0H0\30\0\2301\30\0P0\30\0\0\0?r\355\23?r\0p\0\0<\0>\0\2300\30\0\24\0\26\0\3000\30\0\4@\14\0\1\0\0\0\0[\374wL-\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00769   424   NtReadVirtualMemory  (68, 0x183188, 76, ...  (68, 0x183188, 76, ... "p2\30\0\3400\30\0x2\30\0\3500\30\0 3\30\0\3600\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\3401\30\0\26\0\30\0\102\30\0\4@\10\0\2\0\0\0\2548\30\0\4,\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00770   424   NtReadVirtualMemory  (68, 0x183270, 76, ...  (68, 0x183270, 76, ... "\203\30\0\2101\30\0\303\30\0\2201\30\0\304\30\0 3\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0(2\30\0\24\0\26\0P2\30\0\4@\14\0\1\0\0\0L3\30\0\364-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00771   424   NtReadVirtualMemory  (68, 0x183310, 76, ...  (68, 0x183310, 76, ... "h3\30\0p2\30\0p3\30\0x2\30\0\2002\30\0\2301\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\3102\30\0\26\0\30\0\3602\30\0\6@\10\0\2\0\0\0\2443\30\0\2542\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00772   424   NtReadVirtualMemory  (68, 0x183368, 76, ...  (68, 0x183368, 76, ... "\104\30\0\203\30\0\204\30\0\303\30\0X5\30\0\304\30\0\0\0+t"\24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) \24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) == 0x0
 00773   424   NtReadVirtualMemory  (68, 0x183408, 76, ...  (68, 0x183408, 76, ... "\2504\30\0h3\30\0\2604\30\0p3\30\0x3\30\0\2002\30\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\3003\30\0\24\0\26\0\3503\30\0\6@\0\0\1\0\0\0\148\30\0\234.\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00774   424   NtReadVirtualMemory  (68, 0x1834a8, 76, ...  (68, 0x1834a8, 76, ... "H5\30\0\104\30\0P5\30\0\204\30\0\2306\30\0X5\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0`4\30\0\26\0\30\0\2104\30\0\4@\14\0\2\0\0\0\2045\30\0, 76, ) , 76, ) == 0x0
 00775   424   NtReadVirtualMemory  (68, 0x183548, 76, ...  (68, 0x183548, 76, ... "\3505\30\0\2504\30\0\3605\30\0\2604\30\0\2704\30\0x3\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\05\30\0\24\0\26\0(5\30\0\6@\14\0\2\0\0\0\234D\30\0\3444\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00776   424   NtReadVirtualMemory  (68, 0x1835e8, 76, ...  (68, 0x1835e8, 76, ... "\2106\30\0H5\30\0\2206\30\0P5\30\0pD\30\0@7\30\0\0\00t\11\300t\0@\1\0<\0>\0\2405\30\0\24\0\26\0\3105\30\0\4@\14\0\1\0\0\0\3046\30\0\254,\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00777   424   NtReadVirtualMemory  (68, 0x183688, 76, ...  (68, 0x183688, 76, ... "07\30\0\3505\30\087\30\0\3605\30\0\3109\30\0\2704\30\0\0\0)t\0\0\0\0\0@\0\08\0:\0@6\30\0\20\0\22\0h6\30\0\6@\0\0\1\0\0\0l7\30\0$6\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00778   424   NtReadVirtualMemory  (68, 0x183730, 76, ...  (68, 0x183730, 76, ... "\3207\30\0\2106\30\0\3307\30\0\2206\30\0\3705\30\0\3407\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\3406\30\0\30\0\32\0\107\30\0\6@\14\0\3\0\0\0\240Z\374w\3046\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00779   424   NtReadVirtualMemory  (68, 0x1837d0, 76, ...  (68, 0x1837d0, 76, ... "p8\30\007\30\0x8\30\087\30\0@7\30\0\260@\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\2107\30\0\24\0\26\0\2607\30\0\6@\14\0\1\0\0\0\310Z\374wD4\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00780   424   NtReadVirtualMemory  (68, 0x183870, 76, ...  (68, 0x183870, 76, ... "\309\30\0\3207\30\0 9\30\0\3307\30\0\220=\30\0H<\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0(8\30\0\24\0\26\0P8\30\0\6@\14\0\1\0\0\0\300Z\374w\3041\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00781   424   NtReadVirtualMemory  (68, 0x183918, 76, ...  (68, 0x183918, 76, ... "\2709\30\0p8\30\0\3009\30\0x8\30\0\0;\30\0`:\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\3108\30\0\30\0\32\0\3608\30\0\6@\14\0\1\0\0\0\3649\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00782   424   NtReadVirtualMemory  (68, 0x1839b8, 76, ...  (68, 0x1839b8, 76, ... "P:\30\0\309\30\0X:\30\0 9\30\0`:\30\0\2306\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0p9\30\0\26\0\30\0\2309\30\0\6@\10\0\1\0\0\0\214:\30\0T9\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00783   424   NtReadVirtualMemory  (68, 0x183a50, 76, ...  (68, 0x183a50, 76, ... "\360:\30\0\2709\30\0\370:\30\0\3009\30\0(9\30\0\3109\30\0\0\0\262v<-\262v\0P\1\06\08\0\20:\30\0\16\0\20\08:\30\0\6@\14\0\1\0\0\0`Z\374w\3649\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00784   424   NtReadVirtualMemory  (68, 0x183af0, 76, ...  (68, 0x183af0, 76, ... "\220;\30\0P:\30\0\230;\30\0X:\30\0\240;\30\0(9\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\250:\30\0\26\0\30\0\320:\30\0\6@\14\0\4\0\0\0\34=\30\0,(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00785   424   NtReadVirtualMemory  (68, 0x183b90, 76, ...  (68, 0x183b90, 76, ... "8<\30\0\360:\30\0@<\30\0\370:\30\0H<\30\0\0;\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\1\0\0\0t<\30\0\34*\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00786   424   NtReadVirtualMemory  (68, 0x183c38, 76, ...  (68, 0x183c38, 76, ... "\340<\30\0\220;\30\0\350<\30\0\230;\30\0\2008\30\0\240;\30\0\0\0gv8\25gv\0@\16\0@\0B\0\350;\30\0\30\0\32\0\20<\30\0\6@\10\0\1\0\0\0\374>\30\0\314;\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00787   424   NtReadVirtualMemory  (68, 0x183ce0, 76, ...  (68, 0x183ce0, 76, ... "\200=\30\08<\30\0\210=\30\0@<\30\0\20@\30\00>\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\220<\30\0\30\0\32\0\270<\30\0\6@\14\0\2\0\0\0\274=\30\0,;\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00788   424   NtReadVirtualMemory  (68, 0x183d80, 76, ...  (68, 0x183d80, 76, ... " >\30\0\340<\30\0(>\30\0\350<\30\0\320>\30\0\2008\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\08=\30\0\24\0\26\0`=\30\0\6@\14\0\2\0\0\0\350Z\374w\34=\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00789   424   NtReadVirtualMemory  (68, 0x183e20, 76, ...  (68, 0x183e20, 76, ... "\300>\30\0\200=\30\0\310>\30\0\210=\30\0\360<\30\0p?\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\330=\30\0\24\0\26\0\0>\30\0\6@\10\0\2\0\0\0\370Z\374w|0\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00790   424   NtReadVirtualMemory  (68, 0x183ec0, 76, ...  (68, 0x183ec0, 76, ... "`?\30\0 >\30\0h?\30\0(>\30\0p?\30\0\220=\30\0\0\0-w\306@-w\00\6\0>\0@\0x>\30\0\26\0\30\0\240>\30\0\6@\14\0\6\0\0\0<@\30\0t<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00791   424   NtReadVirtualMemory  (68, 0x183f60, 76, ...  (68, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\00>\30\0\320>\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\30?\30\0\22\0\24\0@?\30\0\6@\14\0\2\0\0\0\334@\30\0\2443\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00792   424   NtReadVirtualMemory  (68, 0x184000, 76, ...  (68, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0HA\30\0\360<\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0\360Z\374w\374>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00793   424   NtReadVirtualMemory  (68, 0x1840a0, 76, ...  (68, 0x1840a0, 76, ... "8A\30\0\0@\30\0@A\30\0\10@\30\0\3407\30\0\230B\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00794   424   NtReadVirtualMemory  (68, 0x184138, 76, ...  (68, 0x184138, 76, ... "\340A\30\0\240@\30\0\350A\30\0\250@\30\0\360A\30\0\20@\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\370@\30\0\16\0\20\0 A\30\0\6@\0\0\1\0\0\0\304B\30\0\334@\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00795   424   NtReadVirtualMemory  (68, 0x1841e0, 76, ...  (68, 0x1841e0, 76, ... "\210B\30\08A\30\0\220B\30\0@A\30\08C\30\0HA\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220A\30\0\30\0\32\0\270A\30\0\6@\14\0\1\0\0\0xZ\374wD&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00796   424   NtReadVirtualMemory  (68, 0x184288, 76, ...  (68, 0x184288, 76, ... "(C\30\0\340A\30\00C\30\0\350A\30\0\260@\30\08C\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08B\30\0\30\0\32\0`B\30\0\6@\0\0\1\0\0\0dC\30\0tA\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00797   424   NtReadVirtualMemory  (68, 0x184328, 76, ...  (68, 0x184328, 76, ... "`D\30\0\210B\30\0hD\30\0\220B\30\0\230B\30\0\360A\30\0\0\06v\240\206v\0\360\0\0<\0>\0\340B\30\0\24\0\26\0\10C\30\0\6@\10\0\2\0\0\0\20[\374w\304B\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00798   424   NtReadVirtualMemory  (68, 0x184460, 76, ...  (68, 0x184460, 76, ... "\10E\30\0(C\30\0\20E\30\00C\30\0\30E\30\0\3705\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\200C\30\0\30\0\32\0>D\30\0\4@\14\20\2\0\0\0DE\30\0\2045\30\02\376};`\266\11\0", 76, ) , 76, ) == 0x0
 00799   424   NtReadVirtualMemory  (68, 0x184508, 76, ...  (68, 0x184508, 76, ... "\234\36\30\0`D\30\0\244\36\30\0hD\30\0\254\36\30\0pD\30\0\0\04wY\324w\0\260\10\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\4@\14\0\1\0\0\0pZ\374w\234D\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00800   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1368,ParentPid=660,}, 0x0, ) == 0x0
 00801   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00802   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00803   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00804   424   NtReadVirtualMemory  (68, 0x20598, 64, ...  (68, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0p\0o\0o\0l\0s\0v\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00805   424   NtClose  (68, ... ) == 0x0
 00806   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1636, 0}, ... 68, ) == 0x0
 00807   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1636,ParentPid=660,}, 0x0, ) == 0x0
 00808   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00809   424   NtReadVirtualMemory  (68, 0x241ea4, 4, ...  (68, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00810   424   NtReadVirtualMemory  (68, 0x241ec0, 76, ...  (68, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00811   424   NtReadVirtualMemory  (68, 0x241f18, 76, ...  (68, 0x241f18, 76, ... "\300\37$\0\300\36$\0\310\37$\0\310\36$\0\320\37$\0\254\36$\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%$\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00812   424   NtReadVirtualMemory  (68, 0x241fc0, 76, ...  (68, 0x241fc0, 76, ... "` $\0\30\37$\0h $\0 \37$\0p $\0(\37$\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37$\0\30\0\32\0\230\37$\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00813   424   NtReadVirtualMemory  (68, 0x242060, 76, ...  (68, 0x242060, 76, ... "\10!$\0\300\37$\0\20!$\0\310\37$\0\270!$\0\320\37$\0\0\04|\237"4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) 4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) == 0x0
 00814   424   NtReadVirtualMemory  (68, 0x242108, 76, ...  (68, 0x242108, 76, ... "\250!$\0` $\0\260!$\0h $\0\370"$\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) $\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00815   424   NtReadVirtualMemory  (68, 0x2421a8, 76, ...  (68, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) $\0\10!$\0P (68, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00816   424   NtReadVirtualMemory  (68, 0x242248, 76, ...  (68, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\250!$\0\360 (68, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (68, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00817   424   NtReadVirtualMemory  (68, 0x2422e8, 76, ...  (68, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\220#$\0P (68, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (68, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00818   424   NtReadVirtualMemory  (68, 0x242388, 76, ...  (68, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\00$$\0\360 (68, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) == 0x0
 00819   424   NtReadVirtualMemory  (68, 0x242428, 76, ...  (68, 0x242428, 76, ... "\320$$\0\210#$\0\330$$\0\220#$\0`8$\0\200%$\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$$\0\30\0\32\0\250$$\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00820   424   NtReadVirtualMemory  (68, 0x2424d0, 76, ...  (68, 0x2424d0, 76, ... "p%$\0($$\0x%$\00$$\0\20($\0\230#$\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#$\0\24\0\26\0\10$$\0\6@\10\0"\0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) \0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) == 0x0
 00821   424   NtReadVirtualMemory  (68, 0x242570, 76, ...  (68, 0x242570, 76, ... "\20&$\0\320$$\0\30&$\0\330$$\08$$\0\3002$\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%$\0\24\0\26\0P%$\0\6@\14\0\1\0\0\0<($\0T\37$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00822   424   NtReadVirtualMemory  (68, 0x242610, 76, ...  (68, 0x242610, 76, ... "\270&$\0p%$\0\300&$\0x%$\0\0/$\0x,$\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%$\0\24\0\26\0\360%$\0\6@\14\0\1\0\0\0\146$\0\14%$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00823   424   NtReadVirtualMemory  (68, 0x2426b8, 76, ...  (68, 0x2426b8, 76, ... "X'$\0\20&$\0`'$\0\30&$\00+$\0\220*$\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&$\0\30\0\32\0\220&$\0\6@\14\0\1\0\0\0\224'$\0D!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00824   424   NtReadVirtualMemory  (68, 0x242758, 76, ...  (68, 0x242758, 76, ... "\0($\0\270&$\0\10($\0\300&$\0H)$\0\260($\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'$\0\26\0\30\08'$\0\6@\10\0\1\0\0\0t)$\0\364&$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00825   424   NtReadVirtualMemory  (68, 0x242800, 76, ...  (68, 0x242800, 76, ... "\240($\0X'$\0\250($\0`'$\0\260($\0\340$$\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'$\0\30\0\32\0\330'$\0\6@\14\0\6\0\0\0\310Z\374w\254%$\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00826   424   NtReadVirtualMemory  (68, 0x2428a0, 76, ...  (68, 0x2428a0, 76, ... "8)$\0\0($\0@)$\0\10($\0h'$\0\20($\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X($\0\26\0\30\0\200($\0\6@\10\0\1\0\0\0\214.$\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00827   424   NtReadVirtualMemory  (68, 0x242938, 76, ...  (68, 0x242938, 76, ... "\330)$\0\240($\0\340)$\0\250($\0\350)$\0h'$\0\0\0\262v<-\262v\0P\1\06\08\0\370($\0\16\0\20\0 )$\0\6@\14\0\1\0\0\0`Z\374w\224'$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00828   424   NtReadVirtualMemory  (68, 0x2429d8, 76, ...  (68, 0x2429d8, 76, ... "\200*$\08)$\0\210*$\0@)$\0\220*$\0H)$\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\220)$\0\22\0\24\0\270)$\0\6@\10\0\7\0\0\0\274*$\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00829   424   NtReadVirtualMemory  (68, 0x242a80, 76, ...  (68, 0x242a80, 76, ... " +$\0\330)$\0(+$\0\340)$\0\310&$\0\350)$\0\0\0\22w\360+\23w\0\260\10\0@\0B\00*$\0\30\0\32\0X*$\0\6@\10\0\4\0\0\0\320Z\374w\24*$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00830   424   NtReadVirtualMemory  (68, 0x242b20, 76, ...  (68, 0x242b20, 76, ... "\300+$\0\200*$\0\310+$\0\210*$\0\320+$\0\310&$\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\330*$\0\26\0\30\0\0+$\0\6@\14\0\4\0\0\0L-$\0\344!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00831   424   NtReadVirtualMemory  (68, 0x242bc0, 76, ...  (68, 0x242bc0, 76, ... "h,$\0 +$\0p,$\0(+$\0x,$\00+$\0\0\0\277qp\21\277q\0\20\1\0<\0>\0x+$\0\24\0\26\0\240+$\0\6@\10\0\1\0\0\0\244,$\0\360Z\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00832   424   NtReadVirtualMemory  (68, 0x242c68, 76, ...  (68, 0x242c68, 76, ... "\20-$\0\300+$\0\30-$\0\310+$\0 &$\0\320+$\0\0\0gv8\25gv\0@\16\0@\0B\0\30,$\0\30\0\32\0@,$\0\6@\10\0\1\0\0\0l0$\0\374+$\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00833   424   NtReadVirtualMemory  (68, 0x242d10, 76, ...  (68, 0x242d10, 76, ... "\260-$\0h,$\0\270-$\0p,$\0\2001$\0\240/$\0\0\0\356v(\25\356v\0p\3\0@\0B\0\300,$\0\30\0\32\0\350,$\0\6@\14\0\2\0\0\0\354-$\0\+$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00834   424   NtReadVirtualMemory  (68, 0x242db0, 76, ...  (68, 0x242db0, 76, ... "P.$\0\20-$\0X.$\0\30-$\0@0$\0`.$\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0h-$\0\24\0\26\0\220-$\0\6@\14\0\2\0\0\0\350Z\374wL-$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00835   424   NtReadVirtualMemory  (68, 0x242e50, 76, ...  (68, 0x242e50, 76, ... "\360.$\0\260-$\0\370.$\0\270-$\0\300-$\0\0/$\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\10.$\0\24\0\26\00.$\0\6@\10\0\6\0\0\0,/$\0\334($\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00836   424   NtReadVirtualMemory  (68, 0x242ef0, 76, ...  (68, 0x242ef0, 76, ... "\220/$\0P.$\0\230/$\0X.$\0`.$\0 &$\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\250.$\0\26\0\30\0\320.$\0\6@\14\0\2\0\0\0\141$\0\214.$\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00837   424   NtReadVirtualMemory  (68, 0x242f90, 76, ...  (68, 0x242f90, 76, ... "00$\0\360.$\080$\0\370.$\0 -$\0\3400$\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0H/$\0\24\0\26\0p/$\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00838   424   NtReadVirtualMemory  (68, 0x243030, 76, ...  (68, 0x243030, 76, ... "\3200$\0\220/$\0\3300$\0\230/$\0\3400$\0\300-$\0\0\0-w\306@-w\00\6\0>\0@\0\350/$\0\26\0\30\0\200$\0\6@\14\0\6\0\0\0\2541$\0\244,$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00839   424   NtReadVirtualMemory  (68, 0x2430d0, 76, ...  (68, 0x2430d0, 76, ... "p1$\000$\0x1$\080$\0\240/$\0@0$\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2100$\0\22\0\24\0\2600$\0\6@\14\0\2\0\0\0\3542$\0,/$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00840   424   NtReadVirtualMemory  (68, 0x243170, 76, ...  (68, 0x243170, 76, ... "\202$\0\3200$\0\302$\0\3300$\0 2$\0 -$\0\0\0=w\24 ?w\0@\177\0>\0@\0(1$\0\26\0\30\0P1$\0\6@\10\0\1\0\0\0L2$\0l0$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00841   424   NtReadVirtualMemory  (68, 0x243210, 76, ...  (68, 0x243210, 76, ... "\2602$\0p1$\0\2702$\0x1$\0X3$\0\2001$\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3101$\0\26\0\30\0\3601$\0\6@\14\0\3\0\0\0\360Z\374w\2541$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00842   424   NtReadVirtualMemory  (68, 0x2432b0, 76, ...  (68, 0x2432b0, 76, ... "H3$\0\202$\0P3$\0\302$\0\200%$\0\2106$\0\0\0\332v\33"\333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) == 0x0
 00843   424   NtReadVirtualMemory  (68, 0x243348, 76, ...  (68, 0x243348, 76, ... "\3603$\0\2602$\0\3703$\0\2702$\0\2404$\0 2$\0\0\0\323v\0\0\0\0\0@\0\06\08\0\103$\0\16\0\20\003$\0\6@\0\0\1\0\0\0\2646$\0\3542$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00844   424   NtReadVirtualMemory  (68, 0x2433f0, 76, ...  (68, 0x2433f0, 76, ... "\2204$\0H3$\0\2304$\0P3$\0\3405$\0\2404$\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2403$\0\30\0\32\0\3103$\0\6@\14\0\1\0\0\0\3144$\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00845   424   NtReadVirtualMemory  (68, 0x243490, 76, ...  (68, 0x243490, 76, ... "05$\0\3603$\085$\0\3703$\0\04$\0X3$\0\0\0\362v\317\22\362v\0P\2\0<\0>\0H4$\0\24\0\26\0p4$\0\6@\14\0\1\0\0\0xZ\374w,4$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00846   424   NtReadVirtualMemory  (68, 0x243530, 76, ...  (68, 0x243530, 76, ... "\3205$\0\2204$\0\3305$\0\2304$\0(7$\0\3405$\0\0\0,vN\25,v\0\240\10\0>\0@\0\3504$\0\26\0\30\0\205$\0\6@\10\0\1\0\0\0\2148$\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00847   424   NtReadVirtualMemory  (68, 0x2435d0, 76, ...  (68, 0x2435d0, 76, ... "x6$\005$\0\2006$\085$\0@5$\0\04$\0\0\0*v\\20*v\0\360\0\0<\0>\0\2105$\0\24\0\26\0\2605$\0\6@\14\0\1\0\0\0\300Z\374wL&$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00848   424   NtReadVirtualMemory  (68, 0x243678, 76, ...  (68, 0x243678, 76, ... "\307$\0\3205$\0 7$\0\3305$\0\3002$\0(7$\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0(6$\0\30\0\32\0P6$\0\6@\0\0\1\0\0\0T7$\0\2043$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00849   424   NtReadVirtualMemory  (68, 0x243718, 76, ...  (68, 0x243718, 76, ... "P8$\0x6$\0X8$\0\2006$\0\2106$\0@5$\0\0\06v\240\206v\0\360\0\0<\0>\0\3206$\0\24\0\26\0\3706$\0\6@\10\0\2\0\0\0\20[\374w\2646$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00850   424   NtReadVirtualMemory  (68, 0x243850, 76, ...  (68, 0x243850, 76, ... "\3708$\0\307$\0\09$\0 7$\0\109$\08$$\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0p7$\0\30\0\32\0.8$\0\4@\14\20\2\0\0\049$\0l5$\02\376};\310W\24\0", 76, ) , 76, ) == 0x0
 00851   424   NtReadVirtualMemory  (68, 0x2438f8, 76, ...  (68, 0x2438f8, 76, ... "\2309$\0P8$\0\2409$\0X8$\0\2509$\0`8$\0\0\04wY\324w\0\260\10\0@\0B\0\2508$\0\30\0\32\0\3208$\0\4@\14\0\1\0\0\0pZ\374w\2148$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00852   424   NtReadVirtualMemory  (68, 0x243998, 76, ...  (68, 0x243998, 76, ... "\234\36$\0\3708$\0\244\36$\0\09$\0\254\36$\0\109$\0\0\0\247uM\31\247u\00\12\0>\0@\0P9$\0\26\0\30\0x9$\0\4@\14\0\1\0\0\0\0[\374w\204"$\0\30\376};\0\0\0\0", 76, ) $\0\30\376};\0\0\0\0", 76, ) == 0x0
 00853   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1636,ParentPid=660,}, 0x0, ) == 0x0
 00854   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00855   424   NtReadVirtualMemory  (68, 0x241ea4, 4, ...  (68, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00856   424   NtReadVirtualMemory  (68, 0x241ec0, 76, ...  (68, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00857   424   NtReadVirtualMemory  (68, 0x205b8, 110, ...  (68, 0x205b8, 110, ... "C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0V\0M\0w\0a\0r\0e\0\\0V\0M\0w\0a\0r\0e\0 \0T\0o\0o\0l\0s\0\\0V\0M\0w\0a\0r\0e\0S\0e\0r\0v\0i\0c\0e\0.\0e\0x\0e\0\0\0", 110, ) , 110, ) == 0x0
 00858   424   NtClose  (68, ... ) == 0x0
 00859   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1852, 0}, ... 68, ) == 0x0
 00860   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1852,ParentPid=616,}, 0x0, ) == 0x0
 00861   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00862   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00863   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00864   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00865   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0X"\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00866   424   NtReadVirtualMemory  (68, 0x182060, 76, ...  (68, 0x182060, 76, ... "\0!\30\0\300\37\30\0\10!\30\0\310\37\30\0\230#\30\0\20!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\14\0\377\377\0\0\254%\30\0\374\36\30\0\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00867   424   NtReadVirtualMemory  (68, 0x182100, 76, ...  (68, 0x182100, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0p \30\0\270!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\270 \30\0\22\0\24\0\340 \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00868   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00869   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00870   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\26\0\30\0\310 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00871   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00872   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\370"\30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) \30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00873   424   NtReadVirtualMemory  (68, 0x1824d0, 76, ...  (68, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\0\370"\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) \30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) == 0x0
 00874   424   NtReadVirtualMemory  (68, 0x182570, 76, ...  (68, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0(&\30\0\340$\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0(%\30\0\26\0\30\0P%\30\0\4@\10\0\2\0\0\0\0[\374w\234 \30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00875   424   NtReadVirtualMemory  (68, 0x182618, 76, ...  (68, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\4@\14\0\1\0\0\0\360Z\374w\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00876   424   NtReadVirtualMemory  (68, 0x1826b8, 76, ...  (68, 0x1826b8, 76, ... "\234\36\30\0\30&\30\0\244\36\30\0 &\30\0\254\36\30\0(&\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\4@\14\0\1\0\0\0\310Z\374wT\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00877   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1852,ParentPid=616,}, 0x0, ) == 0x0
 00878   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00879   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00880   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00881   424   NtReadVirtualMemory  (68, 0x20598, 66, ...  (68, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0s\0e\0r\0i\0n\0i\0t\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00882   424   NtClose  (68, ... ) == 0x0
 00883   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 68, ) == 0x0
 00884   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1888,ParentPid=1852,}, 0x0, ) == 0x0
 00885   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00886   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00887   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00888   424   NtReadVirtualMemory  (68, 0x181f18, 76, ...  (68, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\41\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00889   424   NtReadVirtualMemory  (68, 0x181fc0, 76, ...  (68, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00890   424   NtReadVirtualMemory  (68, 0x182060, 76, ...  (68, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\264/\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00891   424   NtReadVirtualMemory  (68, 0x182108, 76, ...  (68, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00892   424   NtReadVirtualMemory  (68, 0x1821a8, 76, ...  (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0|:\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (68, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0|:\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00893   424   NtReadVirtualMemory  (68, 0x182248, 76, ...  (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (68, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00894   424   NtReadVirtualMemory  (68, 0x1822e8, 76, ...  (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (68, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00895   424   NtReadVirtualMemory  (68, 0x182388, 76, ...  (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (68, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00896   424   NtReadVirtualMemory  (68, 0x182428, 76, ...  (68, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\340#\30\0\26\0\30\0\10$\30\0\6@\10\0\377\377\0\0\364&\30\0\304#\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00897   424   NtReadVirtualMemory  (68, 0x1824c8, 76, ...  (68, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\08$\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0\254%\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00898   424   NtReadVirtualMemory  (68, 0x182570, 76, ...  (68, 0x182570, 76, ... "\30&\30\0\310$\30\0 &\30\0\320$\30\0(&\30\0\330$\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\320Z\374w\4%\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00899   424   NtReadVirtualMemory  (68, 0x182618, 76, ...  (68, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\370u\265*\370u\0\300\17\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\377\377\0\0hZ\374whZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00900   424   NtReadVirtualMemory  (68, 0x1826b8, 76, ...  (68, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0h'\30\0(&\30\0\0\0\234v=\5\235v\0\220\24\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\6@\14\0\377\377\0\0\24/\30\0d$\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00901   424   NtReadVirtualMemory  (68, 0x182758, 76, ...  (68, 0x182758, 76, ... "\220(\30\0\270&\30\0\230(\30\0\300&\30\0\240(\30\0\310&\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\377\377\0\0\324-\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00902   424   NtReadVirtualMemory  (68, 0x182890, 76, ...  (68, 0x182890, 76, ... "8)\30\0X'\30\0@)\30\0`'\30\0H)\30\0h'\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\260'\30\0\30\0\32\0n(\30\0\4@\14\20\14\0\0\0t)\30\0pZ\374w2\376};(=\10\0", 76, ) , 76, ) == 0x0
 00903   424   NtReadVirtualMemory  (68, 0x182938, 76, ...  (68, 0x182938, 76, ... "\330)\30\0\220(\30\0\340)\30\0\230(\30\0\350)\30\0\240(\30\0\0\04wY\324w\0\260\10\0@\0B\0\350(\30\0\30\0\32\0\20)\30\0\4@\14\0\4\0\0\0\264*\30\0\314(\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00904   424   NtReadVirtualMemory  (68, 0x1829d8, 76, ...  (68, 0x1829d8, 76, ... "x*\30\08)\30\0\200*\30\0@)\30\0(+\30\0H)\30\0\0\0\364u\320\21\364u\0\320\1\0>\0@\0\220)\30\0\26\0\30\0\270)\30\0\4@\10\0\1\0\0\0\0\30\0D!\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00905   424   NtReadVirtualMemory  (68, 0x182a78, 76, ...  (68, 0x182a78, 76, ... "\30+\30\0\330)\30\0 +\30\0\340)\30\0\10-\30\0\310+\30\0\0\0\375v%0\375v\0\200\7\0>\0@\00*\30\0\26\0\30\0X*\30\0\4@\14\0\2\0\0\0T+\30\0t)\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00906   424   NtReadVirtualMemory  (68, 0x182b18, 76, ...  (68, 0x182b18, 76, ... "\270+\30\0x*\30\0\300+\30\0\200*\30\0\310+\30\0\350)\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320*\30\0\24\0\26\0\370*\30\0\6@\14\0\2\0\0\0\224,\30\0\264*\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00907   424   NtReadVirtualMemory  (68, 0x182bb8, 76, ...  (68, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0\210*\30\0(+\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0p+\30\0\26\0\30\0\230+\30\0\6@\10\0\3\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00908   424   NtReadVirtualMemory  (68, 0x182c58, 76, ...  (68, 0x182c58, 76, ... "\370,\30\0\270+\30\0\0-\30\0\300+\30\0\350.\30\0\10-\30\0\0\0bv\316\26bv\0\340\4\0:\0<\0\20,\30\0\22\0\24\08,\30\0\4@\14\0\1\0\0\04-\30\0T+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00909   424   NtReadVirtualMemory  (68, 0x182cf8, 76, ...  (68, 0x182cf8, 76, ... "8.\30\0X,\30\0@.\30\0`,\30\0h,\30\0\210*\30\0\0\0`v\20\22`v\0\260\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\6@\10\0\1\0\0\0\3144\30\0\224,\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00910   424   NtReadVirtualMemory  (68, 0x182e38, 76, ...  (68, 0x182e38, 76, ... "\330.\30\0\370,\30\0\340.\30\0\0-\30\0\250-\30\0\210/\30\0\0\0c[\237qd[\0\0\7\0>\0@\0\360-\30\0\26\0\30\0\30.\30\0\4@\14\0\1\0\0\0d<\30\0\370Z\374w\267\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00911   424   NtReadVirtualMemory  (68, 0x182ed8, 76, ...  (68, 0x182ed8, 76, ... "x/\30\08.\30\0\200/\30\0@.\30\0\210/\30\0h,\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\220.\30\0\26\0\30\0\270.\30\0\6@\14\0\6\0\0\0\2441\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00912   424   NtReadVirtualMemory  (68, 0x182f78, 76, ...  (68, 0x182f78, 76, ... "\230-\30\0\330.\30\0\240-\30\0\340.\30\0H.\30\0\350.\30\0\0\08v4\208v\0P\0\0>\0@\00/\30\0\26\0\30\0X/\30\0\6@\14\0\1\0\0\0\3647\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00913   424   NtReadVirtualMemory  (68, 0x182d98, 76, ...  (68, 0x182d98, 76, ... " 0\30\0x/\30\0(0\30\0\200/\30\000\30\0H.\30\0\0\0\247uM\31\247u\00\12\0>\0@\0P-\30\0\26\0\30\0x-\30\0\4@\14\0\4\0\0\0\0[\374w\224'\30\0\30\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00914   424   NtReadVirtualMemory  (68, 0x183020, 76, ...  (68, 0x183020, 76, ... "\3100\30\0\230-\30\0\3200\30\0\240-\30\0\3300\30\0\250-\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0\320/\30\0\30\0\32\0\370/\30\0\4@\14\0\1\0\0\0\2043\30\0\24*\30\00\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00915   424   NtReadVirtualMemory  (68, 0x1830c8, 76, ...  (68, 0x1830c8, 76, ... "h1\30\0 0\30\0p1\30\0(0\30\0x1\30\000\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x0\30\0\30\0\32\0\2400\30\0\4@\14\0\13\0\0\0\3542\30\0T\37\30\03\376};(=\10\0", 76, ) , 76, ) == 0x0
 00916   424   NtReadVirtualMemory  (68, 0x183168, 76, ...  (68, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\4@\10\0\2\0\0\0L2\30\0\24/\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00917   424   NtReadVirtualMemory  (68, 0x183210, 76, ...  (68, 0x183210, 76, ... "\2602\30\0h1\30\0\2702\30\0p1\30\0X3\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\4@\10\0\2\0\0\0\360Z\374w\2441\30\0\25\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00918   424   NtReadVirtualMemory  (68, 0x1832b0, 76, ...  (68, 0x1832b0, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0\2404\30\0X3\30\0\0\0\231v\250\22\231v\0@\2\0>\0@\0h2\30\0\26\0\30\0\2202\30\0\4@\14\0\2\0\0\0,4\30\0\41\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00919   424   NtReadVirtualMemory  (68, 0x183348, 76, ...  (68, 0x183348, 76, ... "\3603\30\0\2602\30\0\3703\30\0\2702\30\0\3002\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0\103\30\0\16\0\20\003\30\0\6@\14\0\3\0\0\0\2348\30\0\0\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00920   424   NtReadVirtualMemory  (68, 0x1833f0, 76, ...  (68, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\210B\30\0\2106\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\4@\14\0\1\0\0\0T7\30\0\3542\30\0\27\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00921   424   NtReadVirtualMemory  (68, 0x183490, 76, ...  (68, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\3405\30\0\3002\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0H4\30\0\24\0\26\0p4\30\0\6@\14\0\1\0\0\0$@\30\04-\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00922   424   NtReadVirtualMemory  (68, 0x183530, 76, ...  (68, 0x183530, 76, ... "\3205\30\0\2204\30\0\3305\30\0\2304\30\0\2609\30\0\3405\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\10\0\7\0\0\0\146\30\0\20[\374w1\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00923   424   NtReadVirtualMemory  (68, 0x1835d0, 76, ...  (68, 0x1835d0, 76, ... "x6\30\005\30\0\2006\30\085\30\0@5\30\0\2404\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\2105\30\0\26\0\30\0\2605\30\0\6@\14\0\2\0\0\0\3349\30\0l5\30\02\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00924   424   NtReadVirtualMemory  (68, 0x183678, 76, ...  (68, 0x183678, 76, ... "\307\30\0\3205\30\0 7\30\0\3305\30\0\04\30\0(7\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0(6\30\0\30\0\32\0P6\30\0\6@\14\0\3\0\0\0\4D\30\0\240Z\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00925   424   NtReadVirtualMemory  (68, 0x183718, 76, ...  (68, 0x183718, 76, ... "\2707\30\0x6\30\0\3007\30\0\2006\30\0\2106\30\0x=\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\310Z\374w,4\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00926   424   NtReadVirtualMemory  (68, 0x1837b8, 76, ...  (68, 0x1837b8, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\230;\30\0P:\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0p7\30\0\24\0\26\0\2307\30\0\6@\14\0\1\0\0\0\304@\30\0\264/\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00927   424   NtReadVirtualMemory  (68, 0x183860, 76, ...  (68, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0P:\30\0\209\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\208\30\0\30\0\32\088\30\0\6@\14\0\1\0\0\0<9\30\0\2043\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00928   424   NtReadVirtualMemory  (68, 0x183900, 76, ...  (68, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0p8\30\0\2609\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\1\0\0\0DE\30\0\2348\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00929   424   NtReadVirtualMemory  (68, 0x1839a0, 76, ...  (68, 0x1839a0, 76, ... "@:\30\0\09\30\0H:\30\0\109\30\0\209\30\0@5\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X9\30\0\26\0\30\0\2009\30\0\6@\10\0\1\0\0\0\4=\30\0\146\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00930   424   NtReadVirtualMemory  (68, 0x183a40, 76, ...  (68, 0x183a40, 76, ... "\350:\30\0\2409\30\0\360:\30\0\2509\30\0\3107\30\0p8\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\6@\14\0\4\0\0\0$;\30\0\344!\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00931   424   NtReadVirtualMemory  (68, 0x183ae8, 76, ...  (68, 0x183ae8, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\20>\30\08<\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\230:\30\0\30\0\32\0\300:\30\0\6@\14\0\2\0\0\0\304;\30\0|:\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00932   424   NtReadVirtualMemory  (68, 0x183b88, 76, ...  (68, 0x183b88, 76, ... "(<\30\0\350:\30\00<\30\0\360:\30\0\330<\30\0\3107\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0@;\30\0\24\0\26\0h;\30\0\6@\14\0\2\0\0\0\244D\30\0$;\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00933   424   NtReadVirtualMemory  (68, 0x183c28, 76, ...  (68, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\370:\30\0\330<\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\340;\30\0\24\0\26\0\10<\30\0\6@\10\0\2\0\0\0\370Z\374wt.\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00934   424   NtReadVirtualMemory  (68, 0x183cc8, 76, ...  (68, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\230;\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\200<\30\0\22\0\24\0\250<\30\0\6@\14\0\2\0\0\0\244=\30\0\3349\30\0\23\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00935   424   NtReadVirtualMemory  (68, 0x183d68, 76, ...  (68, 0x183d68, 76, ... "\0>\30\0\310<\30\0\10>\30\0\320<\30\0(7\30\0@A\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0 =\30\0\24\0\26\0H=\30\0\6@\14\0\1\0\0\0<>\30\0\4=\30\0\21\376};\330Z\10\0", 76, ) \333v\0\0\3\0<\0>\0 =\30\0\24\0\26\0H=\30\0\6@\14\0\1\0\0\0<>\30\0\4=\30\0\21\376};\330Z\10\0", 76, ) == 0x0
 00936   424   NtReadVirtualMemory  (68, 0x183e00, 76, ...  (68, 0x183e00, 76, ... "\250>\30\0h=\30\0\260>\30\0p=\30\0X?\30\0\370:\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\300=\30\0\16\0\20\0\350=\30\0\6@\0\0\1\0\0\0lA\30\0\244=\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00937   424   NtReadVirtualMemory  (68, 0x183ea8, 76, ...  (68, 0x183ea8, 76, ... "H?\30\0\0>\30\0P?\30\0\10>\30\0\230@\30\0X?\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0X>\30\0\30\0\32\0\200>\30\0\6@\14\0\1\0\0\0\204?\30\0xZ\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00938   424   NtReadVirtualMemory  (68, 0x183f48, 76, ...  (68, 0x183f48, 76, ... "\350?\30\0\250>\30\0\360?\30\0\260>\30\0\270>\30\0\20>\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\0?\30\0\24\0\26\0(?\30\0\6@\14\0\1\0\0\0xZ\374w\344>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00939   424   NtReadVirtualMemory  (68, 0x183fe8, 76, ...  (68, 0x183fe8, 76, ... "\210@\30\0H?\30\0\220@\30\0P?\30\0\340A\30\0\230@\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240?\30\0\26\0\30\0\310?\30\0\6@\10\0\4\0\0\0,G\30\0\3144\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00940   424   NtReadVirtualMemory  (68, 0x184088, 76, ...  (68, 0x184088, 76, ... "0A\30\0\350?\30\08A\30\0\360?\30\0\370?\30\0\270>\30\0\0\0*v\\20*v\0\360\0\0<\0>\0@@\30\0\24\0\26\0h@\30\0\6@\14\0\5\0\0\0\344E\30\0\3647\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00941   424   NtReadVirtualMemory  (68, 0x184130, 76, ...  (68, 0x184130, 76, ... "\320A\30\0\210@\30\0\330A\30\0\220@\30\0x=\30\0\340A\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\340@\30\0\30\0\32\0\10A\30\0\6@\0\0\1\0\0\0\14B\30\0<>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00942   424   NtReadVirtualMemory  (68, 0x1841d0, 76, ...  (68, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0@A\30\0\370?\30\0\0\06v\240\206v\0\360\0\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\6@\10\0\2\0\0\0\C\30\0lA\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00943   424   NtReadVirtualMemory  (68, 0x184278, 76, ...  (68, 0x184278, 76, ... " C\30\0\320A\30\0(C\30\0\330A\30\0\330C\30\0\04\30\0\0\0\230v\264\20\230v\0p\0\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\270Z\374w\270Z\374w\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00944   424   NtReadVirtualMemory  (68, 0x184320, 76, ...  (68, 0x184320, 76, ... "\310C\30\0xB\30\0\320C\30\0\200B\30\0xD\30\0\330C\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\4@\14\0\1\0\0\0\204F\30\0\14B\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00945   424   NtReadVirtualMemory  (68, 0x1843c8, 76, ...  (68, 0x1843c8, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\00C\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0xC\30\0\30\0\32\0\240C\30\0\6@\14\0\1\0\0\0\240Z\374w\2646\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00946   424   NtReadVirtualMemory  (68, 0x184468, 76, ...  (68, 0x184468, 76, ... "\10E\30\0\310C\30\0\20E\30\0\320C\30\0\30E\30\00C\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0 D\30\0\24\0\26\0HD\30\0\4@\14\0\1\0\0\0\350Z\374w\304;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00947   424   NtReadVirtualMemory  (68, 0x184508, 76, ...  (68, 0x184508, 76, ... "\250E\30\0hD\30\0\260E\30\0pD\30\0\270E\30\0xD\30\0\0\0\353p\240.\353p\0p\0\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\1\0\0\0`Z\374w<9\30\0q\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00948   424   NtReadVirtualMemory  (68, 0x1845a8, 76, ...  (68, 0x1845a8, 76, ... "HF\30\0\10E\30\0PF\30\0\20E\30\0\0G\30\0\30E\30\0\0\0_`(;_`\0\320\0\0<\0>\0`E\30\0\24\0\26\0\210E\30\0\4@\10\0\1\0\0\0\300Z\374w\304@\30\0\357\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00949   424   NtReadVirtualMemory  (68, 0x184648, 76, ...  (68, 0x184648, 76, ... "\360F\30\0\250E\30\0\370F\30\0\260E\30\0\254\36\30\0\0G\30\0\0\0\352t\360\24\352t\0\0\1\0<\0>\0\0F\30\0\24\0\26\0(F\30\0\4@\10\0\1\0\0\0\20[\374w\C\30\0\37\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00950   424   NtReadVirtualMemory  (68, 0x1846f0, 76, ...  (68, 0x1846f0, 76, ... "\234\36\30\0HF\30\0\244\36\30\0PF\30\0XF\30\0\270E\30\0\0\0;v\0\26;v\0P\4\0@\0B\0\240F\30\0\30\0\32\0\310F\30\0\6@\14\0\1\0\0\0pZ\374w$@\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00951   424   NtQueryInformationProcess  (68, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1888,ParentPid=1852,}, 0x0, ) == 0x0
 00952   424   NtReadVirtualMemory  (68, 0x7ffdf00c, 4, ...  (68, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00953   424   NtReadVirtualMemory  (68, 0x181ea4, 4, ...  (68, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00954   424   NtReadVirtualMemory  (68, 0x181ec0, 76, ...  (68, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00955   424   NtReadVirtualMemory  (68, 0x20584, 48, ...  (68, 0x20584, 48, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0E\0x\0p\0l\0o\0r\0e\0r\0.\0E\0X\0E\0\0\0", 48, ) , 48, ) == 0x0
 00956   424   NtOpenProcessToken  (-1, 0x20, ... 64, ) == 0x0
 00957   424   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00958   424   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00959   424   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 72, ) }, ... 72, ) == 0x0
 00960   424   NtQueryValueKey  (72,  (72, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00961   424   NtClose  (72, ... ) == 0x0
 00962   424   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00963   424   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00964   424   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00965   424   NtQuerySystemTime  (... {17248146, 29889274}, ) == 0x0
 00966   424   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 80, ) == 0x0
 00967   424   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00968   424   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00969   424   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00970   424   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00971   424   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0
 00972   424   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 88, ) == 0x0
 00973   424   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 92, ) }, ... 92, ) == 0x0
 00974   424   NtOpenKey  (0x20019, {24, 92, 0x40, 0, 0,  (0x20019, {24, 92, 0x40, 0, 0, "ActiveComputerName"}, ... 96, ) }, ... 96, ) == 0x0
 00975   424   NtQueryValueKey  (96,  (96, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (96, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (96, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00976   424   NtClose  (96, ... ) == 0x0
 00977   424   NtClose  (92, ... ) == 0x0
 00978   424   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 92, ) == 0x0
 00979   424   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 96, ) == 0x0
 00980   424   NtDuplicateObject  (-1, 92, -1, 0x0, 0, 2, ... 100, ) == 0x0
 00981   424   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00982   424   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 104, ) == 0x0
 00983   424   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00984   424   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00985   424   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242996,  (0xc0100080, {24, 0, 0x40, 0, 1242996, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 108, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 108, {status=0x0, info=1}, ) == 0x0
 00986   424   NtSetInformationFile  (108, 1243052, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00987   424   NtSetInformationFile  (108, 1243044, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00988   424   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00989   424   NtWriteFile  (108, 85, 0, 0,  (108, 85, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00990   424   NtReadFile  (108, 85, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (108, 85, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20` \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00991   424   NtFsControlFile  (108, 85, 0x0, 0x0, 0x11c017,  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20` \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20` \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00992   424   NtFsControlFile  (108, 85, 0x0, 0x0, 0x11c017,  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0NMG:\355~\334\21\261\310\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0NMG:\355~\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 88, 1024, ... {status=0x103, info=48},  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0NMG:\355~\334\21\261\310\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0NMG:\355~\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 00993   424   NtFsControlFile  (108, 85, 0x0, 0x0, 0x11c017,  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0NMG:\355~\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , 44, 1024, ... {status=0x103, info=36},  (108, 85, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0NMG:\355~\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , ) == 0x103
 00994   424   NtClose  (104, ... ) == 0x0
 00995   424   NtClose  (108, ... ) == 0x0
 00996   424   NtAllocateVirtualMemory  (-1, 1363968, 0, 36864, 4096, 4, ... 1363968, 36864, ) == 0x0
 00997   424   NtQuerySystemInformation  (ProcessesAndThreads, 32768, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00998   424   NtFreeVirtualMemory  (-1, (0x146000), 65536, 16384, ... (0x146000), 65536, ) == 0x0
 00999   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {4, 0}, ... 108, ) == 0x0
 01000   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x0,AffinityMask=0x1,BasePriority=8,Pid=4,ParentPid=0,}, 0x0, ) == 0x0
 01001   424   NtReadVirtualMemory  (108, 0xc, 4, ...
 01002   424   NtContinue  (-133137252, 0, ...
 01001   424   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 01003   424   NtClose  (108, ... ) == 0x0
 01004   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {356, 0}, ... 108, ) == 0x0
 01005   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 01006   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 01007   424   NtReadVirtualMemory  (108, 0x261ea4, 4, ...  (108, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 01008   424   NtReadVirtualMemory  (108, 0x261ec0, 76, ...  (108, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 01009   424   NtReadVirtualMemory  (108, 0x261f18, 76, ...  (108, 0x261f18, 76, ... "\234\36&\0\300\36&\0\244\36&\0\310\36&\0\254\36&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01010   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 01011   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 01012   424   NtReadVirtualMemory  (108, 0x261ea4, 4, ...  (108, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 01013   424   NtReadVirtualMemory  (108, 0x261ec0, 76, ...  (108, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 01014   424   NtReadVirtualMemory  (108, 0x1106a0, 60, ...  (108, 0x1106a0, 60, ... "\\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0m\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 01015   424   NtClose  (108, ... ) == 0x0
 01016   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {592, 0}, ... 108, ) == 0x0
 01017   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 01018   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 01019   424   NtReadVirtualMemory  (108, 0x261ea4, 4, ...  (108, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 01020   424   NtReadVirtualMemory  (108, 0x261ec0, 76, ...  (108, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 01021   424   NtReadVirtualMemory  (108, 0x261f18, 76, ...  (108, 0x261f18, 76, ... "\270\37&\0\300\36&\0\300\37&\0\310\36&\0\310\37&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\4\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01022   424   NtReadVirtualMemory  (108, 0x261fb8, 76, ...  (108, 0x261fb8, 76, ... "X &\0\30\37&\0` &\0 \37&\0h &\0(\37&\0\0\0\264u\0\0\0\0\0\240\0\0<\0>\0p\37&\0\24\0\26\0\230\37&\0\6@\0\0\377\377\0\0pZ\374w\374\36&\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01023   424   NtReadVirtualMemory  (108, 0x262058, 76, ...  (108, 0x262058, 76, ... "\370 &\0\270\37&\0\0!&\0\300\37&\0P"&\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) &\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) == 0x0
 01024   424   NtReadVirtualMemory  (108, 0x2620f8, 76, ...  (108, 0x2620f8, 76, ... "\230!&\0X &\0\240!&\0` &\0\320$&\0\250!&\0\0\0\266u\0\0\0\0\0`\4\0<\0>\0\260 &\0\24\0\26\0\330 &\0\4@\0\0\2\0\0\0\20[\374w\20[\374w\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01025   424   NtReadVirtualMemory  (108, 0x262198, 76, ...  (108, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\370 &\0H (108, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01026   424   NtReadVirtualMemory  (108, 0x262240, 76, ...  (108, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\230!&\0\350 (108, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01027   424   NtReadVirtualMemory  (108, 0x2622e0, 76, ...  (108, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\220#&\0H (108, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\22\0\24\0\300 (108, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01028   424   NtReadVirtualMemory  (108, 0x262388, 76, ...  (108, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\00$&\0\350 (108, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01029   424   NtReadVirtualMemory  (108, 0x262428, 76, ...  (108, 0x262428, 76, ... "\300$&\0\210#&\0\310$&\0\220#&\0\230#&\0P"&\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01030   424   NtReadVirtualMemory  (108, 0x2624c0, 76, ...  (108, 0x2624c0, 76, ... "\234\36&\0($&\0\244\36&\00$&\0\254\36&\0\10!&\0\0\0\351u\212\23\351u\0\20\12\06\08\0\200$&\0\16\0\20\0\250$&\0\4@\10\0\1\0\0\0\360Z\374w\360Z\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01031   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 01032   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 01033   424   NtReadVirtualMemory  (108, 0x261ea4, 4, ...  (108, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 01034   424   NtReadVirtualMemory  (108, 0x261ec0, 76, ...  (108, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 01035   424   NtReadVirtualMemory  (108, 0x110534, 68, ...  (108, 0x110534, 68, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0s\0r\0s\0s\0.\0e\0x\0e\0\0\0", 68, ) , 68, ) == 0x0
 01036   424   NtClose  (108, ... ) == 0x0
 01037   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {616, 0}, ... 108, ) == 0x0
 01038   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 01039   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 01040   424   NtReadVirtualMemory  (108, 0x171ea4, 4, ...  (108, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 01041   424   NtReadVirtualMemory  (108, 0x171ec0, 76, ...  (108, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 01042   424   NtReadVirtualMemory  (108, 0x171f18, 76, ...  (108, 0x171f18, 76, ... "\300\37\27\0\300\36\27\0\310\37\27\0\310\36\27\0\320\37\27\0\254\36\27\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\244%\27\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01043   424   NtReadVirtualMemory  (108, 0x171fc0, 76, ...  (108, 0x171fc0, 76, ... "h \27\0\30\37\27\0p \27\0 \37\27\0\30!\27\0(\37\27\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\27\0\30\0\32\0\230\37\27\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01044   424   NtReadVirtualMemory  (108, 0x172068, 76, ...  (108, 0x172068, 76, ... "\10!\27\0\300\37\27\0\20!\27\0\310\37\27\0X"\27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) \27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01045   424   NtReadVirtualMemory  (108, 0x172108, 76, ...  (108, 0x172108, 76, ... "\250!\27\0h \27\0\260!\27\0p \27\0x \27\0\320\37\27\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \27\0\24\0\26\0\350 \27\0\6@\10\0\377\377\0\0\314(\27\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01046   424   NtReadVirtualMemory  (108, 0x1721a8, 76, ...  (108, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\10!\27\0P (108, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) == 0x0
 01047   424   NtReadVirtualMemory  (108, 0x172248, 76, ...  (108, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\250!\27\0\360 (108, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\24\0\26\0( (108, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01048   424   NtReadVirtualMemory  (108, 0x1722e8, 76, ...  (108, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\220#\27\0P (108, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\26\0\30\0\310 (108, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01049   424   NtReadVirtualMemory  (108, 0x172388, 76, ...  (108, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) \27\00$\27\0\360 (108, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01050   424   NtReadVirtualMemory  (108, 0x172428, 76, ...  (108, 0x172428, 76, ... "\310$\27\0\210#\27\0\320$\27\0\220#\27\0\230#\27\0\270!\27\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\27\0\22\0\24\0\10$\27\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01051   424   NtReadVirtualMemory  (108, 0x1724c8, 76, ...  (108, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) \27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204 (108, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01052   424   NtReadVirtualMemory  (108, 0x172568, 76, ...  (108, 0x172568, 76, ... "\10&\27\0\310$\27\0\20&\27\0\320$\27\0\300&\27\0\370"\27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) \27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) == 0x0
 01053   424   NtReadVirtualMemory  (108, 0x172608, 76, ...  (108, 0x172608, 76, ... "\260&\27\0h%\27\0\270&\27\0p%\27\0\0(\27\0`'\27\0\0\0\223u \22\223u\0\240\0\0>\0@\0\300%\27\0\26\0\30\0\350%\27\0\6@\10\0\377\377\0\0,(\27\0\330Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01054   424   NtReadVirtualMemory  (108, 0x1726b0, 76, ...  (108, 0x1726b0, 76, ... "P'\27\0\10&\27\0X'\27\0\20&\27\0`'\27\0x%\27\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0`&\27\0\30\0\32\0\210&\27\0\6@\14\0\377\377\0\0|?\27\0\244%\27\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01055   424   NtReadVirtualMemory  (108, 0x172750, 76, ...  (108, 0x172750, 76, ... "\360'\27\0\260&\27\0\370'\27\0\270&\27\0\30&\27\0\300&\27\0\0\0\247uM\31\247u\00\12\0>\0@\0\10'\27\0\26\0\30\00'\27\0\6@\14\0\377\377\0\0\3348\27\0\304#\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01056   424   NtReadVirtualMemory  (108, 0x1727f0, 76, ...  (108, 0x1727f0, 76, ... "\220(\27\0P'\27\0\230(\27\0X'\27\0\240(\27\0\30&\27\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\250'\27\0\22\0\24\0\320'\27\0\6@\14\0\377\377\0\0\330Z\374wD&\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01057   424   NtReadVirtualMemory  (108, 0x172890, 76, ...  (108, 0x172890, 76, ... "0)\27\0\360'\27\08)\27\0\370'\27\0@)\27\0\0(\27\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0H(\27\0\24\0\26\0p(\27\0\6@\10\0\377\377\0\0T<\27\0D!\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01058   424   NtReadVirtualMemory  (108, 0x172930, 76, ...  (108, 0x172930, 76, ... "\330)\27\0\220(\27\0\340)\27\0\230(\27\0\350)\27\0\240(\27\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\350(\27\0\26\0\30\0\20)\27\0\6@\14\0\377\377\0\0\24*\27\0\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01059   424   NtReadVirtualMemory  (108, 0x1729d8, 76, ...  (108, 0x1729d8, 76, ... "x*\27\00)\27\0\200*\27\08)\27\0\320+\27\0@)\27\0\0\0gv8\25gv\0@\16\0@\0B\0\210)\27\0\30\0\32\0\260)\27\0\6@\10\0\377\377\0\0\264*\27\0l)\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01060   424   NtReadVirtualMemory  (108, 0x172a78, 76, ...  (108, 0x172a78, 76, ... " +\27\0\330)\27\0(+\27\0\340)\27\0\30-\27\00+\27\0\0\0\306v\355\346\306v\0\220\2\0<\0>\00*\27\0\24\0\26\0X*\27\0\6@\14\0\377\377\0\0d0\27\0\24*\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01061   424   NtReadVirtualMemory  (108, 0x172b20, 76, ...  (108, 0x172b20, 76, ... "\300+\27\0x*\27\0\310+\27\0\200*\27\0\210*\27\0x,\27\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320*\27\0\30\0\32\0\370*\27\0\6@\14\0\377\377\0\0\344-\27\0\374\36\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01062   424   NtReadVirtualMemory  (108, 0x172bc0, 76, ...  (108, 0x172bc0, 76, ... "h,\27\0 +\27\0p,\27\0(+\27\0x,\27\0\350)\27\0\0\0\33wp\10\34w\0\240\21\0:\0<\0x+\27\0\22\0\24\0\240+\27\0\6@\10\0\377\377\0\0L2\27\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01063   424   NtReadVirtualMemory  (108, 0x172c68, 76, ...  (108, 0x172c68, 76, ... "\10-\27\0\300+\27\0\20-\27\0\310+\27\00+\27\0\320+\27\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\30,\27\0\30\0\32\0@,\27\0\6@\14\0\377\377\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01064   424   NtReadVirtualMemory  (108, 0x172d08, 76, ...  (108, 0x172d08, 76, ... "\250-\27\0h,\27\0\260-\27\0p,\27\0\270-\27\0\210*\27\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\300,\27\0\26\0\30\0\350,\27\0\6@\10\0\377\377\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01065   424   NtReadVirtualMemory  (108, 0x172da8, 76, ...  (108, 0x172da8, 76, ... "H.\27\0\10-\27\0P.\27\0\20-\27\0\370.\27\0\30-\27\0\0\06v\240\206v\0\360\0\0<\0>\0`-\27\0\24\0\26\0\210-\27\0\6@\10\0\377\377\0\0\204.\27\0\+\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01066   424   NtReadVirtualMemory  (108, 0x172e48, 76, ...  (108, 0x172e48, 76, ... "\350.\27\0\250-\27\0\360.\27\0\260-\27\0\3300\27\0\370.\27\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\0.\27\0\24\0\26\0(.\27\0\6@\10\0\377\377\0\0$/\27\0\344-\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01067   424   NtReadVirtualMemory  (108, 0x172ee8, 76, ...  (108, 0x172ee8, 76, ... "\210/\27\0H.\27\0\220/\27\0P.\27\0X.\27\0\270-\27\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\240.\27\0\26\0\30\0\310.\27\0\6@\14\0\377\377\0\0\2546\27\0\204.\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01068   424   NtReadVirtualMemory  (108, 0x172f88, 76, ...  (108, 0x172f88, 76, ... "(0\27\0\350.\27\000\27\0\360.\27\0\04\27\0 2\27\0\0\0\227u\31\32\227u\0\20\17\0<\0>\0@/\27\0\24\0\26\0h/\27\0\4@\14\0\2\0\0\0\264;\27\0\4%\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01069   424   NtReadVirtualMemory  (108, 0x173028, 76, ...  (108, 0x173028, 76, ... "\3100\27\0\210/\27\0\3200\27\0\220/\27\0\2001\27\0\3300\27\0\0\0=w\24 ?w\0@\177\0>\0@\0\340/\27\0\26\0\30\0\100\27\0\6@\10\0\21\0\0\0\41\27\0\264*\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01070   424   NtReadVirtualMemory  (108, 0x1730c8, 76, ...  (108, 0x1730c8, 76, ... "p1\27\0(0\27\0x1\27\000\27\080\27\0X.\27\0\0\0-w\306@-w\00\6\0>\0@\0\2000\27\0\26\0\30\0\2500\27\0\6@\14\0\35\0\0\0l5\27\0d0\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01071   424   NtReadVirtualMemory  (108, 0x173170, 76, ...  (108, 0x173170, 76, ... "\202\27\0\3100\27\0\302\27\0\3200\27\0\3102\27\080\27\0\0\04wY\324w\0\260\10\0@\0B\0 1\27\0\30\0\32\0H1\27\0\6@\14\0\10\0\0\0\3642\27\0$#\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01072   424   NtReadVirtualMemory  (108, 0x173210, 76, ...  (108, 0x173210, 76, ... "\2702\27\0p1\27\0\3002\27\0x1\27\0\230/\27\0\3102\27\0\0\0{\37\200F{\37\0\20\3\0<\0>\0\3101\27\0\24\0\26\0\3601\27\0\6@\14\0\2\0\0\0\3144\27\0\374+\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 01073   424   NtReadVirtualMemory  (108, 0x1732b8, 76, ...  (108, 0x1732b8, 76, ... "\3603\27\0\202\27\0\3703\27\0\302\27\0 2\27\0\2001\27\0\0\0;v\0\26;v\0P\4\0@\0B\0h2\27\0\30\0\32\0\2202\27\0\6@\14\0\3\0\0\0,4\27\0\2541\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01074   424   NtReadVirtualMemory  (108, 0x1733f0, 76, ...  (108, 0x1733f0, 76, ... "\2204\27\0\2702\27\0\2304\27\0\3002\27\0\2404\27\0\230/\27\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\203\27\0\30\0\32\0\3163\27\0\4@\14\20\3\0\0\0\34:\27\0\3642\27\02\376};\370\254\7\0", 76, ) , 76, ) == 0x0
 01075   424   NtReadVirtualMemory  (108, 0x173490, 76, ...  (108, 0x173490, 76, ... "05\27\0\3603\27\085\27\0\3703\27\0@5\27\0\04\27\0\0\0\205\37\0\0\0\0\0`\1\0>\0@\0H4\27\0\26\0\30\0p4\27\0\4@\0\0\1\0\0\0\374F\27\0L2\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 01076   424   NtReadVirtualMemory  (108, 0x173530, 76, ...  (108, 0x173530, 76, ... "\3105\27\0\2204\27\0\3205\27\0\2304\27\0\3305\27\0\2404\27\0\0\0\275vG"\276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) == 0x0
 01077   424   NtReadVirtualMemory  (108, 0x1735c8, 76, ...  (108, 0x1735c8, 76, ... "p6\27\005\27\0x6\27\085\27\0(7\27\0@5\27\0\0\0\273v\0\0\0\0\0@\0\06\08\0\2105\27\0\16\0\20\0\2605\27\0\4@\0\0\2\0\0\0\3747\27\0l5\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01078   424   NtReadVirtualMemory  (108, 0x173670, 76, ...  (108, 0x173670, 76, ... "\307\27\0\3105\27\0 7\27\0\3205\27\0\3207\27\0(7\27\0\0\0=r\240\22=r\0\240\1\0@\0B\0 6\27\0\30\0\32\0H6\27\0\4@\10\0\7\0\0\0T7\27\0$/\27\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01079   424   NtReadVirtualMemory  (108, 0x173718, 76, ...  (108, 0x173718, 76, ... "\3007\27\0p6\27\0\3107\27\0x6\27\0\2006\27\0\3305\27\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\3106\27\0\30\0\32\0\3606\27\0\6@\0\0\7\0\0\0|9\27\0\2546\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01080   424   NtReadVirtualMemory  (108, 0x1737c0, 76, ...  (108, 0x1737c0, 76, ... "\2408\27\0\307\27\0\2508\27\0 7\27\0\2608\27\0\2006\27\0\0\0\351u\212\23\351u\0\20\12\06\08\0\308\27\0\16\0\20\0@8\27\0\4@\10\0\1\0\0\0\224=\27\0\46\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01081   424   NtReadVirtualMemory  (108, 0x1738a0, 76, ...  (108, 0x1738a0, 76, ... "@9\27\0\3007\27\0H9\27\0\3107\27\0P9\27\0\3207\27\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0X8\27\0\26\0\30\0\2008\27\0\4@\10\0\5\0\0\0\0[\374w\214'\27\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01082   424   NtReadVirtualMemory  (108, 0x173940, 76, ...  (108, 0x173940, 76, ... "\3409\27\0\2408\27\0\3509\27\0\2508\27\0\3609\27\0\2608\27\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\3708\27\0\22\0\24\0 9\27\0\4@\14\0\7\0\0\0t:\27\0T7\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01083   424   NtReadVirtualMemory  (108, 0x1739e0, 76, ...  (108, 0x1739e0, 76, ... "8:\27\0@9\27\0@:\27\0H9\27\0\360:\27\0P9\27\0\0\0`v\20\22`v\0\260\1\0<\0>\0\2309\27\0\24\0\26\0\3009\27\0\4@\10\0\3\0\0\04>\27\0,4\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01084   424   NtReadVirtualMemory  (108, 0x173a38, 76, ...  (108, 0x173a38, 76, ... "\340:\27\0\3409\27\0\350:\27\0\3509\27\0(<\27\0\210;\27\0\0\0\225um\25\225u\0\220\1\0@\0B\0p7\27\0\30\0\32\0\2307\27\0\4@\14\0\6\0\0\0\34;\27\0|9\27\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01085   424   NtReadVirtualMemory  (108, 0x173ae0, 76, ...  (108, 0x173ae0, 76, ... "x;\27\08:\27\0\200;\27\0@:\27\0\210;\27\0\3609\27\0\0\0\0s\372\26\0s\00\2\0@\0B\0\220:\27\0\30\0\32\0\270:\27\0\6@\14\0\6\0\0\0\34E\27\0t:\27\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01086   424   NtReadVirtualMemory  (108, 0x173b78, 76, ...  (108, 0x173b78, 76, ... "\30<\27\0\340:\27\0 <\27\0\350:\27\0H:\27\0\360:\27\0\0\0\262q\234\21\262q\0\20\1\06\08\08;\27\0\16\0\20\0`;\27\0\6@\14\0\12\0\0\0\364<\27\0\304/\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01087   424   NtReadVirtualMemory  (108, 0x173c18, 76, ...  (108, 0x173c18, 76, ... "\270<\27\0x;\27\0\300<\27\0\200;\27\0\310<\27\0H:\27\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\320;\27\0\24\0\26\0\370;\27\0\4@\14\0\1\0\0\0\350Z\374w\314(\27\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 01088   424   NtReadVirtualMemory  (108, 0x173cb8, 76, ...  (108, 0x173cb8, 76, ... "X=\27\0\30<\27\0`=\27\0 <\27\0h=\27\0(<\27\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0p<\27\0\24\0\26\0\230<\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 01089   424   NtReadVirtualMemory  (108, 0x173d58, 76, ...  (108, 0x173d58, 76, ... "\370=\27\0\270<\27\0\0>\27\0\300<\27\0\10>\27\0\310<\27\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\20=\27\0\24\0\26\08=\27\0\4@\10\0\5\0\0\0\360Z\374w\3747\27\01\376};\220a\10\0", 76, ) , 76, ) == 0x0
 01090   424   NtReadVirtualMemory  (108, 0x173df8, 76, ...  (108, 0x173df8, 76, ... "\240>\27\0X=\27\0\250>\27\0`=\27\0\260>\27\0h=\27\0\0\0bv\316\26bv\0\340\4\0:\0<\0\260=\27\0\22\0\24\0\330=\27\0\4@\14\0\1\0\0\0TF\27\0\34:\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01091   424   NtReadVirtualMemory  (108, 0x173ea0, 76, ...  (108, 0x173ea0, 76, ... "@?\27\0\370=\27\0H?\27\0\0>\27\0\360?\27\0\10>\27\0\0\0\366ux\20\366u\0`\0\0<\0>\0\370>\27\0\24\0\26\0 ?\27\0\4@\14\0\1\0\0\0\374A\27\0xZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01092   424   NtReadVirtualMemory  (108, 0x173f40, 76, ...  (108, 0x173f40, 76, ... "\340?\27\0\240>\27\0\350?\27\0\250>\27\0\320A\27\0\220@\27\0\0\0\301q\12\23\301q\0\320\0\0@\0B\0P>\27\0\30\0\32\0x>\27\0\4@\14\0\1\0\0\0\34@\27\0\354&\27\04\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01093   424   NtReadVirtualMemory  (108, 0x173fe0, 76, ...  (108, 0x173fe0, 76, ... "\200@\27\0@?\27\0\210@\27\0H?\27\00A\27\0\260>\27\0\0\0\315q\6\22\315q\0`\1\0<\0>\0\230?\27\0\24\0\26\0\300?\27\0\6@\14\0\5\0\0\0\274@\27\0|?\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01094   424   NtReadVirtualMemory  (108, 0x174080, 76, ...  (108, 0x174080, 76, ... " A\27\0\340?\27\0(A\27\0\350?\27\0P?\27\00A\27\0\0\0\311qP\26\311q\0\300\3\0<\0>\08@\27\0\24\0\26\0`@\27\0\6@\14\0\2\0\0\0\A\27\0\34@\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01095   424   NtReadVirtualMemory  (108, 0x174120, 76, ...  (108, 0x174120, 76, ... "\300A\27\0\200@\27\0\310A\27\0\210@\27\0\220@\27\0\360?\27\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\330@\27\0\24\0\26\0\0A\27\0\6@\0\0\2\0\0\0\334C\27\0\274@\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01096   424   NtReadVirtualMemory  (108, 0x1741c0, 76, ...  (108, 0x1741c0, 76, ... "`B\27\0 A\27\0hB\27\0(A\27\0pB\27\0P?\27\0\0\0\367uB\21\367u\0\220\0\0>\0@\0xA\27\0\26\0\30\0\240A\27\0\4@\14\0\1\0\0\0xZ\374w\334>\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01097   424   NtReadVirtualMemory  (108, 0x174260, 76, ...  (108, 0x174260, 76, ... "\0C\27\0\300A\27\0\10C\27\0\310A\27\0\260C\27\0\320A\27\0\0\0\0\20\340t\0\20\0\0\2\0:\0<\0\30B\27\0\22\0\24\0@B\27\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374w\340Z\332D\0\0\0\0", 76, ) , 76, ) == 0x0
 01098   424   NtReadVirtualMemory  (108, 0x174300, 76, ...  (108, 0x174300, 76, ... "\240C\27\0`B\27\0\250C\27\0hB\27\0PD\27\0\260C\27\0\0\0\260q>\23\260q\0\360\0\0:\0<\0\270B\27\0\22\0\24\0\340B\27\0\4@\14\0\1\0\0\0\300Z\374w\364<\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01099   424   NtReadVirtualMemory  (108, 0x1743a0, 76, ...  (108, 0x1743a0, 76, ... "@D\27\0\0C\27\0HD\27\0\10C\27\0\20C\27\0pB\27\0\0\0\272qp\27\272q\0\340\4\0<\0>\0XC\27\0\24\0\26\0\200C\27\0\6@\14\0\1\0\0\0|D\27\0\A\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01100   424   NtReadVirtualMemory  (108, 0x174440, 76, ...  (108, 0x174440, 76, ... "\340D\27\0\240C\27\0\350D\27\0\250C\27\0\360D\27\0\20C\27\0\0\0\264q\0\0\0\0\0\300\2\0<\0>\0\370C\27\0\24\0\26\0 D\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 01101   424   NtReadVirtualMemory  (108, 0x1744e0, 76, ...  (108, 0x1744e0, 76, ... "\30F\27\0@D\27\0 F\27\0HD\27\0(F\27\0PD\27\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\230D\27\0\26\0\30\0\300D\27\0\4@\10\0\2\0\0\0\20[\374w\34;\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01102   424   NtReadVirtualMemory  (108, 0x174618, 76, ...  (108, 0x174618, 76, ... "\300F\27\0\340D\27\0\310F\27\0\350D\27\0\320F\27\0\360D\27\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320E\27\0\24\0\26\0\370E\27\0\6@\14\0\2\0\0\0\234G\27\04>\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01103   424   NtReadVirtualMemory  (108, 0x1746c0, 76, ...  (108, 0x1746c0, 76, ... "`G\27\0\30F\27\0hG\27\0 F\27\0pG\27\0(F\27\0\0\0\22w\360+\23w\0\260\10\0@\0B\0pF\27\0\30\0\32\0\230F\27\0\6@\10\0\2\0\0\0\320Z\374w\3144\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01104   424   NtReadVirtualMemory  (108, 0x174760, 76, ...  (108, 0x174760, 76, ... "\0H\27\0\300F\27\0\10H\27\0\310F\27\0\20H\27\0\320F\27\0\0\0\375v%0\375v\0\200\7\0>\0@\0\30G\27\0\26\0\30\0@G\27\0\4@\14\0\2\0\0\0pZ\374wTF\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01105   424   NtReadVirtualMemory  (108, 0x174800, 76, ...  (108, 0x174800, 76, ... "\234\36\27\0`G\27\0\244\36\27\0hG\27\0\254\36\27\0pG\27\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\270G\27\0\26\0\30\0\340G\27\0\4@\14\0\1\0\0\0\310Z\374w|D\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01106   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 01107   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 01108   424   NtReadVirtualMemory  (108, 0x171ea4, 4, ...  (108, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 01109   424   NtReadVirtualMemory  (108, 0x171ec0, 76, ...  (108, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 01110   424   NtReadVirtualMemory  (108, 0x20534, 74, ...  (108, 0x20534, 74, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0l\0o\0g\0o\0n\0.\0e\0x\0e\0\0\0", 74, ) , 74, ) == 0x0
 01111   424   NtClose  (108, ... ) == 0x0
 01112   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {660, 0}, ... 108, ) == 0x0
 01113   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 01114   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01115   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01116   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01117   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01118   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01119   424   NtReadVirtualMemory  (108, 0x182060, 76, ...  (108, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\300Z\374w\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01120   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01121   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01122   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01123   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01124   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01125   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0 &\30\0\330$\30\0\0\0\216u\20\24\216u\0\320\4\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\377\377\377\377\224'\30\0\374\36\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01126   424   NtReadVirtualMemory  (108, 0x1824c8, 76, ...  (108, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\08$\30\0\230#\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0`Z\374wD!\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01127   424   NtReadVirtualMemory  (108, 0x182570, 76, ...  (108, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0\310&\30\0 &\30\0\0\0\214u\203\27\214u\0\300\1\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\0[\374w\304#\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01128   424   NtReadVirtualMemory  (108, 0x182610, 76, ...  (108, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\200%\30\08$\30\0\0\06v\240\206v\0\360\0\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\10\0\377\377\0\0\334(\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01129   424   NtReadVirtualMemory  (108, 0x1826b8, 76, ...  (108, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0h'\30\0\200%\30\0\0\0w_5\21w_\0\340\0\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\10\0\377\377\0\0l+\30\0T\37\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01130   424   NtReadVirtualMemory  (108, 0x182758, 76, ...  (108, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0P)\30\0\310&\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\20'\30\0\26\0\30\08'\30\0\4@\14\0\3\0\0\0\360Z\374wd$\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01131   424   NtReadVirtualMemory  (108, 0x182800, 76, ...  (108, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\230*\30\0\360)\30\0\0\0\212u\0\0\0\0\0\360\0\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\4@\0\0\1\0\0\0\200Z\374w\200Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01132   424   NtReadVirtualMemory  (108, 0x1828a0, 76, ...  (108, 0x1828a0, 76, ... "@)\30\0\0(\30\0H)\30\0\10(\30\0\360)\30\0P)\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0X(\30\0\24\0\26\0\200(\30\0\6@\10\0\1\0\0\0|)\30\0L&\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01133   424   NtReadVirtualMemory  (108, 0x182940, 76, ...  (108, 0x182940, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\260(\30\0h'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\370(\30\0\26\0\30\0 )\30\0\6@\14\0\1\0\0\0\304*\30\0\334(\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01134   424   NtReadVirtualMemory  (108, 0x1829e0, 76, ...  (108, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0\20(\30\0\260(\30\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\230)\30\0\22\0\24\0\300)\30\0\6@\14\0\1\0\0\0\330Z\374w\330Z\374w\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01135   424   NtReadVirtualMemory  (108, 0x182a88, 76, ...  (108, 0x182a88, 76, ... "0+\30\0\340)\30\08+\30\0\350)\30\0@+\30\0\20(\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08*\30\0\30\0\32\0`*\30\0\4@\0\0\1\0\0\0\20[\374w|)\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01136   424   NtReadVirtualMemory  (108, 0x182b30, 76, ...  (108, 0x182b30, 76, ... "\234\36\30\0\210*\30\0\244\36\30\0\220*\30\0\254\36\30\0\230*\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\340*\30\0\30\0\32\0\10+\30\0\4@\14\0\2\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01137   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 01138   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01139   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01140   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01141   424   NtReadVirtualMemory  (108, 0x20598, 66, ...  (108, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0e\0r\0v\0i\0c\0e\0s\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 01142   424   NtClose  (108, ... ) == 0x0
 01143   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {672, 0}, ... 108, ) == 0x0
 01144   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 01145   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01146   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01147   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 01148   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\324(\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01149   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\04-\30\0\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01150   424   NtReadVirtualMemory  (108, 0x182068, 76, ...  (108, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01151   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\3144\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01152   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01153   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01154   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) == 0x0
 01155   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01156   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01157   424   NtReadVirtualMemory  (108, 0x1824c8, 76, ...  (108, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\0(\30\0 &\30\0\0\0Dt\0\0\0\0\0\220\6\0<\0>\0\200$\30\0\24\0\26\0\250$\30\0\6@\0\0\377\377\0\0t)\30\0$#\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01158   424   NtReadVirtualMemory  (108, 0x182570, 76, ...  (108, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0`'\30\0\230#\30\0\0\0yv\7\30yv\0\260\0\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\14\0\377\377\0\0\274;\30\0pZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01159   424   NtReadVirtualMemory  (108, 0x182610, 76, ...  (108, 0x182610, 76, ... "\260&\30\0p%\30\0\270&\30\0x%\30\0\330$\30\0\300&\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\377\377\0\0\34;\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01160   424   NtReadVirtualMemory  (108, 0x1826b0, 76, ...  (108, 0x1826b0, 76, ... "P'\30\0\20&\30\0X'\30\0\30&\30\0 &\30\0`'\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h&\30\0\24\0\26\0\220&\30\0\6@\10\0\377\377\0\0\214'\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01161   424   NtReadVirtualMemory  (108, 0x182750, 76, ...  (108, 0x182750, 76, ... "\360'\30\0\260&\30\0\370'\30\0\270&\30\0\300&\30\0\200%\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10'\30\0\26\0\30\00'\30\0\6@\14\0\377\377\0\0L+\30\0\354&\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01162   424   NtReadVirtualMemory  (108, 0x1827f0, 76, ...  (108, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\250(\30\0\330$\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\6@\14\0\377\377\0\0\14*\30\0\204"\30\0\26\376};\0\0\0\0", 76, ) \30\0\26\376};\0\0\0\0", 76, ) == 0x0
 01163   424   NtReadVirtualMemory  (108, 0x182898, 76, ...  (108, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0H)\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\6@\14\0\377\377\0\0\254*\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01164   424   NtReadVirtualMemory  (108, 0x182938, 76, ...  (108, 0x182938, 76, ... "\320)\30\0\230(\30\0\330)\30\0\240(\30\0\340)\30\0\250(\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\10\0\377\377\0\0t5\30\0\4%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01165   424   NtReadVirtualMemory  (108, 0x1829d0, 76, ...  (108, 0x1829d0, 76, ... "p*\30\08)\30\0x*\30\0@)\30\0 +\30\0H)\30\0\0\0\262q\234\21\262q\0\20\1\06\08\0\220)\30\0\16\0\20\0\270)\30\0\6@\14\0\377\377\0\0\224,\30\0,(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01166   424   NtReadVirtualMemory  (108, 0x182a70, 76, ...  (108, 0x182a70, 76, ... "\20+\30\0\320)\30\0\30+\30\0\330)\30\0\270!\30\0 +\30\0\0\0zv\32\22zv\00\1\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0\377\377\0\0\334-\30\0\324(\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01167   424   NtReadVirtualMemory  (108, 0x182b10, 76, ...  (108, 0x182b10, 76, ... "X,\30\0p*\30\0`,\30\0x*\30\0\200*\30\0\340)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\310*\30\0\26\0\30\0\360*\30\0\6@\10\0\377\377\0\0|.\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01168   424   NtReadVirtualMemory  (108, 0x182c58, 76, ...  (108, 0x182c58, 76, ... "\370,\30\0\20+\30\0\0-\30\0\30+\30\0\10-\30\0\270!\30\0\0\0;t\0\0\0\0\0\320\0\0>\0@\0\20,\30\0\26\0\30\08,\30\0\4@\0\0\1\0\0\0\364+\30\0\14*\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01169   424   NtReadVirtualMemory  (108, 0x182cf8, 76, ...  (108, 0x182cf8, 76, ... "\270+\30\0X,\30\0\300+\30\0`,\30\0\310+\30\0h,\30\0\0\0\317q7\177\320q\0@\4\0@\0B\0h+\30\0\30\0\32\0\220+\30\0\4@\14\0\2\0\0\0\260Z\374w\374\37\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01170   424   NtReadVirtualMemory  (108, 0x182bb8, 76, ...  (108, 0x182bb8, 76, ... "\240-\30\0\370,\30\0\250-\30\0\0-\30\0\360.\30\0\10-\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\4@\0\0\4\0\0\0\34/\30\0\224,\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01171   424   NtReadVirtualMemory  (108, 0x182da0, 76, ...  (108, 0x182da0, 76, ... "@.\30\0\270+\30\0H.\30\0\300+\30\0\260>\30\0P.\30\0\0\0Kt\232\356Kt\00\6\0@\0B\0P-\30\0\30\0\32\0x-\30\0\4@\14\0\2\0\0\0d0\30\0\254*\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01172   424   NtReadVirtualMemory  (108, 0x182e40, 76, ...  (108, 0x182e40, 76, ... "\340.\30\0\240-\30\0\350.\30\0\250-\30\0\260-\30\0x=\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\370-\30\0\26\0\30\0 .\30\0\6@\0\0\2\0\0\0\2348\30\0L+\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01173   424   NtReadVirtualMemory  (108, 0x182ee0, 76, ...  (108, 0x182ee0, 76, ... "\210/\30\0@.\30\0\220/\30\0H.\30\0 2\30\0\310+\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0\230.\30\0\26\0\30\0\300.\30\0\6@\14\0\2\0\0\0\41\30\0\364+\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01174   424   NtReadVirtualMemory  (108, 0x182f88, 76, ...  (108, 0x182f88, 76, ... "(0\30\0\340.\30\000\30\0\350.\30\0x=\30\080\30\0\0\0\326v\326/\326v\0P\1\0@\0B\08/\30\0\30\0\32\0`/\30\0\6@\14\0\11\0\0\0\264B\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01175   424   NtReadVirtualMemory  (108, 0x183028, 76, ...  (108, 0x183028, 76, ... "\3100\30\0\210/\30\0\3200\30\0\220/\30\0\230/\30\0\2609\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\340/\30\0\24\0\26\0\100\30\0\6@\14\0\3\0\0\0\310Z\374w\334-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01176   424   NtReadVirtualMemory  (108, 0x1830c8, 76, ...  (108, 0x1830c8, 76, ... "p1\30\0(0\30\0x1\30\000\30\0\2206\30\0H5\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\2000\30\0\24\0\26\0\2500\30\0\6@\14\0\3\0\0\0DE\30\0\34/\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01177   424   NtReadVirtualMemory  (108, 0x183170, 76, ...  (108, 0x183170, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0\2404\30\0\04\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0 1\30\0\30\0\32\0H1\30\0\6@\14\0\3\0\0\0L2\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01178   424   NtReadVirtualMemory  (108, 0x183210, 76, ...  (108, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\2702\30\0\360.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\3101\30\0\26\0\30\0\3601\30\0\6@\10\0\3\0\0\0\3442\30\0\2541\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01179   424   NtReadVirtualMemory  (108, 0x1832a8, 76, ...  (108, 0x1832a8, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0X3\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\14\0\3\0\0\0`Z\374wL2\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01180   424   NtReadVirtualMemory  (108, 0x183348, 76, ...  (108, 0x183348, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0\04\30\0\2702\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\03\30\0\22\0\24\0(3\30\0\6@\10\0\25\0\0\0,4\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01181   424   NtReadVirtualMemory  (108, 0x1833f0, 76, ...  (108, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\2001\30\0X3\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\6@\10\0\15\0\0\0TC\30\0\2043\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01182   424   NtReadVirtualMemory  (108, 0x183490, 76, ...  (108, 0x183490, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\0H5\30\0\2001\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\14\0\12\0\0\0\346\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01183   424   NtReadVirtualMemory  (108, 0x183538, 76, ...  (108, 0x183538, 76, ... "\3405\30\0\2204\30\0\3505\30\0\2304\30\0\3300\30\0\2404\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3504\30\0\30\0\32\0\205\30\0\6@\10\0\4\0\0\0\3747\30\0t)\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01184   424   NtReadVirtualMemory  (108, 0x1835e0, 76, ...  (108, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\209\30\007\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\14\0\4\0\0\0\2746\30\0\3144\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01185   424   NtReadVirtualMemory  (108, 0x183680, 76, ...  (108, 0x183680, 76, ... " 7\30\0\3405\30\0(7\30\0\3505\30\0\3207\30\0\3300\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\14\0\4\0\0\0lA\30\0\346\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01186   424   NtReadVirtualMemory  (108, 0x183720, 76, ...  (108, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3605\30\0p8\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\6@\10\0\4\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01187   424   NtReadVirtualMemory  (108, 0x1837c0, 76, ...  (108, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\0\2206\30\0\0\0-w\306@-w\00\6\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\6@\14\0\15\0\0\0<9\30\0t5\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01188   424   NtReadVirtualMemory  (108, 0x183860, 76, ...  (108, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\007\30\0\3207\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\308\30\0\22\0\24\0@8\30\0\6@\14\0\4\0\0\0\3349\30\0|.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01189   424   NtReadVirtualMemory  (108, 0x183900, 76, ...  (108, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0H:\30\0\3605\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\4\0\0\0,@\30\0\3747\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01190   424   NtReadVirtualMemory  (108, 0x1839a0, 76, ...  (108, 0x1839a0, 76, ... "8:\30\0\09\30\0@:\30\0\109\30\080\30\08<\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 01191   424   NtReadVirtualMemory  (108, 0x183a38, 76, ...  (108, 0x183a38, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\360:\30\0\209\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3709\30\0\16\0\20\0 :\30\0\6@\0\0\3\0\0\0d<\30\0\3349\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01192   424   NtReadVirtualMemory  (108, 0x183ae0, 76, ...  (108, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\0\220;\30\0H:\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\3\0\0\0,G\30\0L&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01193   424   NtReadVirtualMemory  (108, 0x183b80, 76, ...  (108, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0,vN\25,v\0\240\10\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\10\0\6\0\0\0\334>\30\0\254%\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01194   424   NtReadVirtualMemory  (108, 0x183c28, 76, ...  (108, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0\2609\30\0\330<\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\0\0\3\0\0\0\4=\30\0t:\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01195   424   NtReadVirtualMemory  (108, 0x183cc8, 76, ...  (108, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\220;\30\0\0\06v\240\206v\0\360\0\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\10\0\6\0\0\0\314@\30\0d<\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01196   424   NtReadVirtualMemory  (108, 0x183d68, 76, ...  (108, 0x183d68, 76, ... "\240>\30\0\310<\30\0\250>\30\0\320<\30\0P.\30\0\230/\30\0\0\0\247uM\31\247u\00\12\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\14\0\6\0\0\0\0[\374w\304#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01197   424   NtReadVirtualMemory  (108, 0x183ea0, 76, ...  (108, 0x183ea0, 76, ... "H?\30\0h=\30\0P?\30\0p=\30\0X?\30\0\260-\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300=\30\0\30\0\32\0~>\30\0\4@\14\20\2\0\0\0\204?\30\0\274;\30\02\376};\20\15\11\0", 76, ) , 76, ) == 0x0
 01198   424   NtReadVirtualMemory  (108, 0x183f48, 76, ...  (108, 0x183f48, 76, ... "\360?\30\0\240>\30\0\370?\30\0\250>\30\0\0@\30\0\260>\30\0\0\04wY\324w\0\260\10\0@\0B\0\370>\30\0\30\0\32\0 ?\30\0\4@\14\0\1\0\0\0pZ\374w\334>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01199   424   NtReadVirtualMemory  (108, 0x183ff0, 76, ...  (108, 0x183ff0, 76, ... "\220@\30\0H?\30\0\230@\30\0P?\30\0\240@\30\0X?\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\240?\30\0\30\0\32\0\310?\30\0\4@\14\0\1\0\0\0\14B\30\0<9\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01200   424   NtReadVirtualMemory  (108, 0x184090, 76, ...  (108, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0\0@\30\0\0\08t\0\0\0\0\0\360\0\0>\0@\0H@\30\0\26\0\30\0p@\30\0\4@\0\0\1\0\0\0\374C\30\0\4=\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01201   424   NtReadVirtualMemory  (108, 0x184130, 76, ...  (108, 0x184130, 76, ... "\320A\30\0\220@\30\0\330A\30\0\230@\30\0\340A\30\0\240@\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\350@\30\0\24\0\26\0\20A\30\0\4@\14\0\1\0\0\0\350Z\374w\2746\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 01202   424   NtReadVirtualMemory  (108, 0x1841d0, 76, ...  (108, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\0@A\30\0\0\0At\200\23At\0\320\2\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\4@\10\0\1\0\0\0\360Z\374w,@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01203   424   NtReadVirtualMemory  (108, 0x184278, 76, ...  (108, 0x184278, 76, ... "\30C\30\0\320A\30\0 C\30\0\330A\30\0xD\30\0(C\30\0\0\0>tG\26>t\0p\2\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\240Z\374w\304/\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01204   424   NtReadVirtualMemory  (108, 0x184318, 76, ...  (108, 0x184318, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\210B\30\0\320C\30\0\0\0]t\206\25]t\0p\13\0<\0>\0\320B\30\0\24\0\26\0\370B\30\0\6@\10\0\1\0\0\0\320Z\374w,4\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01205   424   NtReadVirtualMemory  (108, 0x1843c0, 76, ...  (108, 0x1843c0, 76, ... "hD\30\0\30C\30\0pD\30\0 C\30\0(C\30\0\340A\30\0\0\07tP\207t\0\240\0\0@\0B\0pC\30\0\30\0\32\0\230C\30\0\6@\14\0\1\0\0\0\354E\30\0\314@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01206   424   NtReadVirtualMemory  (108, 0x184468, 76, ...  (108, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\210B\30\0\0\0:tP\21:t\0\220\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\14\0\1\0\0\0\214F\30\0\330Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01207   424   NtReadVirtualMemory  (108, 0x184508, 76, ...  (108, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0\300E\30\0xD\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\2\0\0\0\300Z\374w\41\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01208   424   NtReadVirtualMemory  (108, 0x1845b0, 76, ...  (108, 0x1845b0, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0`F\30\0\30E\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\0\20[\374w\374C\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01209   424   NtReadVirtualMemory  (108, 0x184650, 76, ...  (108, 0x184650, 76, ... "\360F\30\0\260E\30\0\370F\30\0\270E\30\0\0G\30\0\300E\30\0\0\0\0\10F\30\0\24\0\26\00F\30\0\4@\14\0\1\0\0\0\330Z\374w\244D\30\0"\376};\220>\13\0", 76, ) \376};\220>\13\0", 76, ) == 0x0
 01210   424   NtReadVirtualMemory  (108, 0x1846f0, 76, ...  (108, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0\254\36\30\0`F\30\0\0\0\372\17\37]\372\17\0\20\2\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\4@\14\0\1\0\0\0xZ\374w\34;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 01211   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 01212   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01213   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01214   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 01215   424   NtReadVirtualMemory  (108, 0x20598, 60, ...  (108, 0x20598, 60, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0l\0s\0a\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 01216   424   NtClose  (108, ... ) == 0x0
 01217   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {852, 0}, ... 108, ) == 0x0
 01218   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=852,ParentPid=660,}, 0x0, ) == 0x0
 01219   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01220   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01221   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01222   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0t)\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01223   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01224   424   NtReadVirtualMemory  (108, 0x182068, 76, ...  (108, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01225   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\344!\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01226   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01227   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01228   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\310 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01229   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\0X (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01230   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0x%\30\0\330$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\04\0\0\0D&\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01231   424   NtReadVirtualMemory  (108, 0x1824c8, 76, ...  (108, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\08$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01232   424   NtReadVirtualMemory  (108, 0x182568, 76, ...  (108, 0x182568, 76, ... "\10&\30\0\310$\30\0\20&\30\0\320$\30\0\270!\30\08$\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0 %\30\0\26\0\30\0H%\30\0\6@\14\0\5\0\0\0\304/\30\0\374\36\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01233   424   NtReadVirtualMemory  (108, 0x182608, 76, ...  (108, 0x182608, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\270!\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\300%\30\0\26\0\30\0\350%\30\0\4@\14\0\1\0\0\0\0[\374wd$\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01234   424   NtReadVirtualMemory  (108, 0x1826a8, 76, ...  (108, 0x1826a8, 76, ... "P'\30\0\10&\30\0X'\30\0\20&\30\0`'\30\0\30&\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\4@\10\0\5\0\0\0\24*\30\0\204"\30\01\376};\0\0\0\0", 76, ) \30\01\376};\0\0\0\0", 76, ) == 0x0
 01235   424   NtReadVirtualMemory  (108, 0x182750, 76, ...  (108, 0x182750, 76, ... "\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0(\30\0\270&\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\0'\30\0\30\0\32\0('\30\0\4@\14\0\1\0\0\0\244,\30\0\304#\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01236   424   NtReadVirtualMemory  (108, 0x1827f0, 76, ...  (108, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\330+\30\0`'\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\4@\14\0\3\0\0\0\246\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01237   424   NtReadVirtualMemory  (108, 0x182898, 76, ...  (108, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0\2509\30\0H)\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01238   424   NtReadVirtualMemory  (108, 0x182938, 76, ...  (108, 0x182938, 76, ... "\330)\30\0\230(\30\0\340)\30\0\240(\30\0\250(\30\0\2504\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\14\0\1\0\0\0\4,\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01239   424   NtReadVirtualMemory  (108, 0x1829d8, 76, ...  (108, 0x1829d8, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\2101\30\0@0\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\220)\30\0\24\0\26\0\270)\30\0\6@\14\0\1\0\0\0T7\30\0\344&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01240   424   NtReadVirtualMemory  (108, 0x182a80, 76, ...  (108, 0x182a80, 76, ... " +\30\0\330)\30\0(+\30\0\340)\30\0\370.\30\0X.\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\00*\30\0\30\0\32\0X*\30\0\6@\14\0\1\0\0\0\+\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01241   424   NtReadVirtualMemory  (108, 0x182b20, 76, ...  (108, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\20-\30\0x,\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\330*\30\0\26\0\30\0\0+\30\0\6@\10\0\1\0\0\0<-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01242   424   NtReadVirtualMemory  (108, 0x182bc8, 76, ...  (108, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0x,\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\14\0\6\0\0\0\310Z\374wt)\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01243   424   NtReadVirtualMemory  (108, 0x182c68, 76, ...  (108, 0x182c68, 76, ... "\0-\30\0\310+\30\0\10-\30\0\320+\30\00+\30\0\330+\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\10\0\2\0\0\0\2243\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01244   424   NtReadVirtualMemory  (108, 0x182d00, 76, ...  (108, 0x182d00, 76, ... "\240-\30\0h,\30\0\250-\30\0p,\30\0\260-\30\00+\30\0\0\0\262v<-\262v\0P\1\06\08\0\300,\30\0\16\0\20\0\350,\30\0\6@\14\0\1\0\0\0`Z\374w\+\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01245   424   NtReadVirtualMemory  (108, 0x182da0, 76, ...  (108, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0X.\30\0\20-\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0X-\30\0\22\0\24\0\200-\30\0\6@\10\0\13\0\0\0\204.\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01246   424   NtReadVirtualMemory  (108, 0x182e48, 76, ...  (108, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\220*\30\0\260-\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\10\0\6\0\0\0\320Z\374w\334-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01247   424   NtReadVirtualMemory  (108, 0x182ee8, 76, ...  (108, 0x182ee8, 76, ... "\210/\30\0H.\30\0\220/\30\0P.\30\0\230/\30\0\220*\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\14\0\4\0\0\0\241\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01248   424   NtReadVirtualMemory  (108, 0x182f88, 76, ...  (108, 0x182f88, 76, ... "00\30\0\350.\30\080\30\0\360.\30\0@0\30\0\370.\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0@/\30\0\24\0\26\0h/\30\0\6@\10\0\1\0\0\0l0\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01249   424   NtReadVirtualMemory  (108, 0x183030, 76, ...  (108, 0x183030, 76, ... "\3300\30\0\210/\30\0\3400\30\0\220/\30\0\350)\30\0\230/\30\0\0\0gv8\25gv\0@\16\0@\0B\0\340/\30\0\30\0\32\0\100\30\0\6@\10\0\1\0\0\0\3642\30\0\304/\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01250   424   NtReadVirtualMemory  (108, 0x1830d8, 76, ...  (108, 0x1830d8, 76, ... "x1\30\000\30\0\2001\30\080\30\0\104\30\0(2\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2100\30\0\30\0\32\0\2600\30\0\6@\14\0\2\0\0\0\2641\30\0$/\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01251   424   NtReadVirtualMemory  (108, 0x183178, 76, ...  (108, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0\3102\30\0\350)\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\001\30\0\24\0\26\0X1\30\0\6@\14\0\2\0\0\0\304;\30\0\241\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01252   424   NtReadVirtualMemory  (108, 0x183218, 76, ...  (108, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0\3500\30\0h3\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3201\30\0\24\0\26\0\3701\30\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01253   424   NtReadVirtualMemory  (108, 0x1832b8, 76, ...  (108, 0x1832b8, 76, ... "X3\30\0\302\30\0`3\30\0 2\30\0h3\30\0\2101\30\0\0\0-w\306@-w\00\6\0>\0@\0p2\30\0\26\0\30\0\2302\30\0\6@\14\0\6\0\0\044\30\0l0\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01254   424   NtReadVirtualMemory  (108, 0x183358, 76, ...  (108, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0(2\30\0\3102\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\203\30\0\22\0\24\083\30\0\6@\14\0\2\0\0\0\3244\30\0\244,\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01255   424   NtReadVirtualMemory  (108, 0x1833f8, 76, ...  (108, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0@5\30\0\3500\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2603\30\0\26\0\30\0\3303\30\0\6@\10\0\1\0\0\0\360Z\374w\3642\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01256   424   NtReadVirtualMemory  (108, 0x183498, 76, ...  (108, 0x183498, 76, ... "05\30\0\3703\30\085\30\0\04\30\0H)\30\0\3207\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 01257   424   NtReadVirtualMemory  (108, 0x183530, 76, ...  (108, 0x183530, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\3505\30\0\104\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3604\30\0\16\0\20\0\305\30\0\6@\0\0\1\0\0\0\3747\30\0\3244\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01258   424   NtReadVirtualMemory  (108, 0x1835d8, 76, ...  (108, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0(7\30\0@5\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\14\0\1\0\0\0xZ\374w,(\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01259   424   NtReadVirtualMemory  (108, 0x183678, 76, ...  (108, 0x183678, 76, ... "\307\30\0\3305\30\0 7\30\0\3405\30\0p8\30\0(7\30\0\0\0,vN\25,v\0\240\10\0>\0@\006\30\0\26\0\30\0X6\30\0\6@\10\0\1\0\0\0\3249\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01260   424   NtReadVirtualMemory  (108, 0x183718, 76, ...  (108, 0x183718, 76, ... "\3007\30\0x6\30\0\3107\30\0\2006\30\0\2106\30\0\3505\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\300Z\374w\24*\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01261   424   NtReadVirtualMemory  (108, 0x1837c0, 76, ...  (108, 0x1837c0, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\2504\30\0p8\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0p7\30\0\30\0\32\0\2307\30\0\6@\0\0\1\0\0\0\2348\30\0l5\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01262   424   NtReadVirtualMemory  (108, 0x183860, 76, ...  (108, 0x183860, 76, ... "\2309\30\0\3007\30\0\2409\30\0\3107\30\0\3207\30\0\2106\30\0\0\06v\240\206v\0\360\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\6@\10\0\2\0\0\0\34;\30\0\3747\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01263   424   NtReadVirtualMemory  (108, 0x183998, 76, ...  (108, 0x183998, 76, ... "@:\30\0`8\30\0H:\30\0h8\30\0P:\30\0\250(\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\2708\30\0\30\0\32\0v9\30\0\4@\14\20\2\0\0\0|:\30\0\2646\30\02\376};\360e\12\0", 76, ) , 76, ) == 0x0
 01264   424   NtReadVirtualMemory  (108, 0x183a40, 76, ...  (108, 0x183a40, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\360:\30\0\2509\30\0\0\04wY\324w\0\260\10\0@\0B\0\3609\30\0\30\0\32\0\30:\30\0\4@\14\0\1\0\0\0d<\30\0\3249\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01265   424   NtReadVirtualMemory  (108, 0x183ae0, 76, ...  (108, 0x183ae0, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\230;\30\0P:\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\230:\30\0\24\0\26\0\300:\30\0\4@\14\0\1\0\0\0\20[\374w\2348\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01266   424   NtReadVirtualMemory  (108, 0x183b88, 76, ...  (108, 0x183b88, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0\374v!\21\374v\0P\0\0@\0B\08;\30\0\30\0\32\0`;\30\0\4@\14\0\1\0\0\0\350Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01267   424   NtReadVirtualMemory  (108, 0x183c28, 76, ...  (108, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\254\36\30\0x=\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\340;\30\0\26\0\30\0\10<\30\0\4@\14\0\2\0\0\0\4=\30\0|:\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01268   424   NtReadVirtualMemory  (108, 0x183cc8, 76, ...  (108, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0\230;\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\14\0\2\0\0\0pZ\374wd<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01269   424   NtReadVirtualMemory  (108, 0x183d68, 76, ...  (108, 0x183d68, 76, ... "\234\36\30\0\310<\30\0\244\36\30\0\320<\30\08<\30\0\330<\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\10\0\2\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01270   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=852,ParentPid=660,}, 0x0, ) == 0x0
 01271   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01272   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01273   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01274   424   NtReadVirtualMemory  (108, 0x20598, 64, ...  (108, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 01275   424   NtClose  (108, ... ) == 0x0
 01276   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {972, 0}, ... 108, ) == 0x0
 01277   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=972,ParentPid=660,}, 0x0, ) == 0x0
 01278   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01279   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01280   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01281   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364+\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01282   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01283   424   NtReadVirtualMemory  (108, 0x182068, 76, ...  (108, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01284   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\41\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01285   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\261\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 01286   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0:\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01287   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0q\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01288   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) == 0x0
 01289   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0(\2\0\0\224,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01290   424   NtReadVirtualMemory  (108, 0x1824c8, 76, ...  (108, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\0\230#\30\08$\30\0\0\0-w\306@-w\00\6\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0@\0\0\0\244%\30\0\304#\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01291   424   NtReadVirtualMemory  (108, 0x182568, 76, ...  (108, 0x182568, 76, ... "\240&\30\0\310$\30\0\250&\30\0\320$\30\0\260&\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0 %\30\0\26\0\30\0H%\30\0\4@\10\0\24\0\0\0\2441\30\0\4%\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01292   424   NtReadVirtualMemory  (108, 0x1826a0, 76, ...  (108, 0x1826a0, 76, ... "H'\30\0h%\30\0P'\30\0p%\30\0X'\30\0x%\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300%\30\0\30\0\32\0~&\30\0\4@\14\20\10\0\0\0\204'\30\0pZ\374w2\376};H\315\10\0", 76, ) , 76, ) == 0x0
 01293   424   NtReadVirtualMemory  (108, 0x182748, 76, ...  (108, 0x182748, 76, ... "\350'\30\0\240&\30\0\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0\04wY\324w\0\260\10\0@\0B\0\370&\30\0\30\0\32\0 '\30\0\4@\14\0\1\0\0\0L7\30\0\334&\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01294   424   NtReadVirtualMemory  (108, 0x1827e8, 76, ...  (108, 0x1827e8, 76, ... "\220(\30\0H'\30\0\230(\30\0P'\30\0\200*\30\0X'\30\0\0\06v\240\206v\0\360\0\0<\0>\0\240'\30\0\24\0\26\0\310'\30\0\4@\10\0#\0\0\0\14*\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01295   424   NtReadVirtualMemory  (108, 0x182890, 76, ...  (108, 0x182890, 76, ... "0)\30\0\350'\30\08)\30\0\360'\30\0\109\30\0(+\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0@(\30\0\30\0\32\0h(\30\0\4@\14\0\17\0\0\0l)\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01296   424   NtReadVirtualMemory  (108, 0x182930, 76, ...  (108, 0x182930, 76, ... "\320)\30\0\220(\30\0\330)\30\0\230(\30\0X.\30\0\340)\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350(\30\0\24\0\26\0\20)\30\0\6@\14\0\21\0\0\0lS\30\0\314(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01297   424   NtReadVirtualMemory  (108, 0x1829d0, 76, ...  (108, 0x1829d0, 76, ... "p*\30\00)\30\0x*\30\08)\30\0@)\30\0\200*\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210)\30\0\24\0\26\0\260)\30\0\6@\10\0e\0\0\0\254*\30\0$(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01298   424   NtReadVirtualMemory  (108, 0x182a70, 76, ...  (108, 0x182a70, 76, ... "\30+\30\0\320)\30\0 +\30\0\330)\30\0\340)\30\0\370'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0-\0\0\0$/\30\0\14*\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01299   424   NtReadVirtualMemory  (108, 0x182b18, 76, ...  (108, 0x182b18, 76, ... "\270+\30\0p*\30\0\300+\30\0x*\30\0\240(\30\0\310+\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310*\30\0\30\0\32\0\360*\30\0\6@\14\0!\0\0\0\C\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01300   424   NtReadVirtualMemory  (108, 0x182bb8, 76, ...  (108, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0(+\30\0\3505\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p+\30\0\24\0\26\0\230+\30\0\6@\14\0\15\0\0\0\204.\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01301   424   NtReadVirtualMemory  (108, 0x182c58, 76, ...  (108, 0x182c58, 76, ... "\0-\30\0\270+\30\0\10-\30\0\300+\30\0h3\30\0 2\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20,\30\0\24\0\26\08,\30\0\6@\14\0\16\0\0\0\3547\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01302   424   NtReadVirtualMemory  (108, 0x182d00, 76, ...  (108, 0x182d00, 76, ... "\240-\30\0X,\30\0\250-\30\0`,\30\0\3300\30\080\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260,\30\0\30\0\32\0\330,\30\0\6@\14\0\17\0\0\0\334-\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01303   424   NtReadVirtualMemory  (108, 0x182da0, 76, ...  (108, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0\220/\30\0\370.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X-\30\0\26\0\30\0\200-\30\0\6@\10\0\17\0\0\0\274/\30\0<-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01304   424   NtReadVirtualMemory  (108, 0x182e48, 76, ...  (108, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\370.\30\0@)\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\14\0_\0\0\0\214?\30\0\364+\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01305   424   NtReadVirtualMemory  (108, 0x182ee8, 76, ...  (108, 0x182ee8, 76, ... "\200/\30\0H.\30\0\210/\30\0P.\30\0\260-\30\0X.\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\10\0\26\0\0\0\3244\30\0\254*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01306   424   NtReadVirtualMemory  (108, 0x182f80, 76, ...  (108, 0x182f80, 76, ... "(0\30\0\350.\30\000\30\0\360.\30\080\30\0\260-\30\0\0\0\262v<-\262v\0P\1\06\08\0@/\30\0\16\0\20\0h/\30\0\6@\14\0\22\0\0\0\244D\30\0\334-\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01307   424   NtReadVirtualMemory  (108, 0x183028, 76, ...  (108, 0x183028, 76, ... "\3100\30\0\200/\30\0\3200\30\0\210/\30\0\20-\30\0\220/\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\330/\30\0\30\0\32\0\00\30\0\6@\10\0r\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01308   424   NtReadVirtualMemory  (108, 0x1830c8, 76, ...  (108, 0x1830c8, 76, ... "h1\30\0(0\30\0p1\30\000\30\0x1\30\0\20-\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\2000\30\0\26\0\30\0\2500\30\0\6@\14\0*\0\0\0\3642\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01309   424   NtReadVirtualMemory  (108, 0x183168, 76, ...  (108, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\6@\10\0\20\0\0\0L2\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01310   424   NtReadVirtualMemory  (108, 0x183210, 76, ...  (108, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0h,\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\6@\10\0\23\0\0\0t5\30\0\2441\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01311   424   NtReadVirtualMemory  (108, 0x1832b8, 76, ...  (108, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0H5\30\0\104\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\6@\14\0\17\0\0\0\2243\30\0\41\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01312   424   NtReadVirtualMemory  (108, 0x183358, 76, ...  (108, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\2504\30\0h,\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\203\30\0\24\0\26\083\30\0\6@\14\0\17\0\0\0\3249\30\0\3642\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01313   424   NtReadVirtualMemory  (108, 0x1833f8, 76, ...  (108, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0\3102\30\0\2504\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\2603\30\0\24\0\26\0\3303\30\0\6@\10\0\16\0\0\0TO\30\0\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01314   424   NtReadVirtualMemory  (108, 0x183498, 76, ...  (108, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\104\30\0h3\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0P4\30\0\22\0\24\0x4\30\0\6@\14\0\16\0\0\0\246\30\0$/\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01315   424   NtReadVirtualMemory  (108, 0x183538, 76, ...  (108, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2006\30\0\3102\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\14\08\0\0\0\34;\30\0L2\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01316   424   NtReadVirtualMemory  (108, 0x1835d8, 76, ...  (108, 0x1835d8, 76, ... "p6\30\085\30\0x6\30\0@5\30\0\310+\30\0h8\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 01317   424   NtReadVirtualMemory  (108, 0x183670, 76, ...  (108, 0x183670, 76, ... "\207\30\0\3305\30\0\307\30\0\3405\30\0\3007\30\0H5\30\0\0\0\323v\0\0\0\0\0@\0\06\08\006\30\0\16\0\20\0X6\30\0\6@\0\0\14\0\0\0\2248\30\0\246\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01318   424   NtReadVirtualMemory  (108, 0x183710, 76, ...  (108, 0x183710, 76, ... "\2607\30\0p6\30\0\2707\30\0x6\30\0h8\30\0\3007\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3106\30\0\26\0\30\0\3606\30\0\6@\10\0\31\0\0\0,@\30\0\204'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01319   424   NtReadVirtualMemory  (108, 0x1837b0, 76, ...  (108, 0x1837b0, 76, ... "X8\30\0\207\30\0`8\30\0\307\30\0 7\30\0\2006\30\0\0\0*v\\20*v\0\360\0\0<\0>\0h7\30\0\24\0\26\0\2207\30\0\6@\14\0\23\0\0\0\244=\30\0\224,\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01320   424   NtReadVirtualMemory  (108, 0x183858, 76, ...  (108, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\3505\30\0 7\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\108\30\0\30\0\32\008\30\0\6@\0\0\21\0\0\0d<\30\0\2546\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01321   424   NtReadVirtualMemory  (108, 0x1838f8, 76, ...  (108, 0x1838f8, 76, ... "\2309\30\0X8\30\0\2409\30\0`8\30\0\2509\30\0\240(\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\3\0\0\0\274;\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01322   424   NtReadVirtualMemory  (108, 0x183998, 76, ...  (108, 0x183998, 76, ... "8:\30\0\3708\30\0@:\30\0\09\30\0\220;\30\0\109\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0P9\30\0\24\0\26\0x9\30\0\4@\14\0\1\0\0\0t:\30\0\2243\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 01323   424   NtReadVirtualMemory  (108, 0x183a38, 76, ...  (108, 0x183a38, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\330<\30\08<\30\0\0\0\361t\1\225\361t\0\0\1\0<\0>\0\3609\30\0\24\0\26\0\30:\30\0\4@\14\0\1\0\0\0\4=\30\0\3249\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01324   424   NtReadVirtualMemory  (108, 0x183ae0, 76, ...  (108, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\08<\30\0\220;\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\1\0\0\0\24B\30\0t5\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01325   424   NtReadVirtualMemory  (108, 0x183b80, 76, ...  (108, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\360:\30\0\2509\30\0\0\0\247uM\31\247u\00\12\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\14\0\14\0\0\0\274c\30\049\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01326   424   NtReadVirtualMemory  (108, 0x183c28, 76, ...  (108, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0H:\30\0\360:\30\0\0\0=r\240\22=r\0\240\1\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\10\0\1\0\0\0\354>\30\0\2248\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01327   424   NtReadVirtualMemory  (108, 0x183cc8, 76, ...  (108, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0H:\30\0\0\0\363t\0\0\0\0\0\300\0\0>\0@\0\200<\30\0\26\0\30\0\250<\30\0\4@\0\0\1\0\0\0\204[\30\0t:\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01328   424   NtReadVirtualMemory  (108, 0x183d68, 76, ...  (108, 0x183d68, 76, ... "\10>\30\0\310<\30\0\20>\30\0\320<\30\0\30>\30\0\330<\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0 =\30\0\24\0\26\0H=\30\0\4@\0\0\1\0\0\0D>\30\0\3547\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01329   424   NtReadVirtualMemory  (108, 0x183e08, 76, ...  (108, 0x183e08, 76, ... "\260>\30\0h=\30\0\270>\30\0p=\30\0\300>\30\0x=\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\6\0\0\0\374C\30\0\244=\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01330   424   NtReadVirtualMemory  (108, 0x183eb0, 76, ...  (108, 0x183eb0, 76, ... "P?\30\0\10>\30\0X?\30\0\20>\30\0`?\30\0\30>\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`>\30\0\30\0\32\0\210>\30\0\4@\14\0\1\0\0\0DE\30\0d<\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01331   424   NtReadVirtualMemory  (108, 0x183f50, 76, ...  (108, 0x183f50, 76, ... "\360?\30\0\260>\30\0\370?\30\0\270>\30\0\240@\30\0\300>\30\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\10?\30\0\26\0\30\00?\30\0\4@\14\0\1\0\0\0\264B\30\0\204.\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01332   424   NtReadVirtualMemory  (108, 0x183ff0, 76, ...  (108, 0x183ff0, 76, ... "\220@\30\0P?\30\0\230@\30\0X?\30\0\210B\30\0@A\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\250?\30\0\26\0\30\0\320?\30\0\4@\14\0\4\0\0\0\314@\30\0L7\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01333   424   NtReadVirtualMemory  (108, 0x184090, 76, ...  (108, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0`?\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0H@\30\0\24\0\26\0p@\30\0\6@\14\0\15\0\0\0\354E\30\0,@\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01334   424   NtReadVirtualMemory  (108, 0x184130, 76, ...  (108, 0x184130, 76, ... "\330A\30\0\220@\30\0\340A\30\0\230@\30\0\0@\30\0\240@\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\350@\30\0\26\0\30\0\20A\30\0\6@\10\0\20\0\0\0\254L\30\0\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01335   424   NtReadVirtualMemory  (108, 0x1841d8, 76, ...  (108, 0x1841d8, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\00C\30\0\0\0\35u\335\243\35u\0\220\2\0@\0B\0\210A\30\0\30\0\32\0\260A\30\0\4@\14\0\1\0\0\0\364O\30\0\34;\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01336   424   NtReadVirtualMemory  (108, 0x184278, 76, ...  (108, 0x184278, 76, ... " C\30\0\330A\30\0(C\30\0\340A\30\00C\30\0\0@\30\0\0\0zv\32\22zv\00\1\0>\0@\00B\30\0\26\0\30\0XB\30\0\6@\14\0\2\0\0\0|b\30\0\214?\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01337   424   NtReadVirtualMemory  (108, 0x184320, 76, ...  (108, 0x184320, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\350A\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\6@\14\0\3\0\0\0\354_\30\0T+\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01338   424   NtReadVirtualMemory  (108, 0x1843c0, 76, ...  (108, 0x1843c0, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\0xD\30\0\350A\30\0\0\0\365t\10\21\365t\0P\0\0<\0>\0xC\30\0\24\0\26\0\240C\30\0\4@\14\0\1\0\0\0dJ\30\0D>\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01339   424   NtReadVirtualMemory  (108, 0x184468, 76, ...  (108, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\320C\30\0\0\0\213p\275#\213p\0\300\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\10\0\1\0\0\0\254T\30\0\274/\30\0>\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01340   424   NtReadVirtualMemory  (108, 0x184508, 76, ...  (108, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0hF\30\0xD\30\0\0\0\27u\0\0\0\0\0\0\2\0<\0>\0\300D\30\0\24\0\26\0\350D\30\0\4@\0\0\1\0\0\0\224F\30\0\354>\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01341   424   NtReadVirtualMemory  (108, 0x1845b0, 76, ...  (108, 0x1845b0, 76, ... "XF\30\0\10E\30\0`F\30\0\20E\30\0\220I\30\0\350H\30\0\0\0\372t~\23\372t\0\0\1\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\04G\30\0\314@\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01342   424   NtReadVirtualMemory  (108, 0x184658, 76, ...  (108, 0x184658, 76, ... "\370F\30\0\260E\30\0\0G\30\0\270E\30\0HH\30\0\30E\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\10F\30\0\30\0\32\00F\30\0\6@\14\0\3\0\0\0tH\30\0DE\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01343   424   NtReadVirtualMemory  (108, 0x1846f8, 76, ...  (108, 0x1846f8, 76, ... "\230G\30\0XF\30\0\240G\30\0`F\30\0\350H\30\0\250G\30\0\0\05u\240\245u\0\0\3\0>\0@\0\260F\30\0\26\0\30\0\330F\30\0\6@\14\0\1\0\0\0\324G\30\0\354E\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01344   424   NtReadVirtualMemory  (108, 0x184798, 76, ...  (108, 0x184798, 76, ... "8H\30\0\370F\30\0@H\30\0\0G\30\0\10G\30\0HH\30\0\0\0Mu$\25Mu\0`\7\0>\0@\0PG\30\0\26\0\30\0xG\30\0\6@\14\0\1\0\0\0\X\30\04G\30\0\33\376};X\241\13\0", 76, ) , 76, ) == 0x0
 01345   424   NtReadVirtualMemory  (108, 0x184838, 76, ...  (108, 0x184838, 76, ... "\330H\30\0\230G\30\0\340H\30\0\240G\30\0\250G\30\0hF\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\360G\30\0\26\0\30\0\30H\30\0\6@\10\0\4\0\0\0\274I\30\0\224F\30\0\26\376};X\241\13\0", 76, ) , 76, ) == 0x0
 01346   424   NtReadVirtualMemory  (108, 0x1848d8, 76, ...  (108, 0x1848d8, 76, ... "\200I\30\08H\30\0\210I\30\0@H\30\0\300E\30\0\10G\30\0\0\0qi\320\22qi\0\320\17\0:\0<\0\220H\30\0\22\0\24\0\270H\30\0\6@\10\0\1\0\0\0$R\30\0\200Z\374w\210\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01347   424   NtReadVirtualMemory  (108, 0x184980, 76, ...  (108, 0x184980, 76, ... "(J\30\0\330H\30\00J\30\0\340H\30\08J\30\0\300E\30\0\0\0\354t\0\0\0\0\0P\0\0@\0B\00I\30\0\30\0\32\0XI\30\0\4@\0\0\1\0\0\0\14K\30\0tH\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01348   424   NtReadVirtualMemory  (108, 0x184a28, 76, ...  (108, 0x184a28, 76, ... "\320J\30\0\200I\30\0\330J\30\0\210I\30\0\340K\30\0\220I\30\0\0\0Lr\3662Lr\0\360\0\0@\0B\0\330I\30\0\30\0\32\0\0J\30\0\4@\10\0\1\0\0\0\354M\30\0\374C\30\0,\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01349   424   NtReadVirtualMemory  (108, 0x184ad0, 76, ...  (108, 0x184ad0, 76, ... "\320K\30\0(J\30\0\330K\30\00J\30\0\300M\30\0\200L\30\0\0\0zY7\255zY\0\300\1\0F\0H\0\200J\30\0\24\0\26\0\262J\30\0\4@\14\0\1\0\0\0\14L\30\0\274I\30\0\325\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01350   424   NtReadVirtualMemory  (108, 0x184bd0, 76, ...  (108, 0x184bd0, 76, ... "pL\30\0\320J\30\0xL\30\0\330J\30\0\200L\30\08J\30\0\0\0)u\222\217)u\0\200\3\0J\0L\0xK\30\0\30\0\32\0\252K\30\0\6@\14\0\20\0\0\0LM\30\0\14K\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01351   424   NtReadVirtualMemory  (108, 0x184c70, 76, ...  (108, 0x184c70, 76, ... "\20M\30\0\320K\30\0\30M\30\0\330K\30\0\340J\30\0\340K\30\0\0\0>u\231s@u\0\200\6\0<\0>\0(L\30\0\24\0\26\0PL\30\0\6@\10\0\1\0\0\0\10[\374wlA\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01352   424   NtReadVirtualMemory  (108, 0x184d10, 76, ...  (108, 0x184d10, 76, ... "\260M\30\0pL\30\0\270M\30\0xL\30\0\210N\30\0\300M\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\310L\30\0\26\0\30\0\360L\30\0\4@\0\0\3\0\0\0\14T\30\0\14L\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01353   424   NtReadVirtualMemory  (108, 0x184db0, 76, ...  (108, 0x184db0, 76, ... "xN\30\0\20M\30\0\200N\30\0\30M\30\0 M\30\0\340J\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0hM\30\0\26\0\30\0\220M\30\0\6@\14\0\3\0\0\0\354P\30\0dJ\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01354   424   NtReadVirtualMemory  (108, 0x184e78, 76, ...  (108, 0x184e78, 76, ... "\30O\30\0\260M\30\0 O\30\0\270M\30\0(O\30\0 M\30\0\0\0\364t\354!\364t\0\240\0\0^\0b\0\10N\30\0\24\0\30\0RN\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01355   424   NtReadVirtualMemory  (108, 0x184f18, 76, ...  (108, 0x184f18, 76, ... "\270O\30\0xN\30\0\300O\30\0\200N\30\0\310O\30\0\210N\30\0\0\0\7u\24\31\7u\0`\1\0<\0>\0\320N\30\0\24\0\26\0\370N\30\0\4@\14\0\1\0\0\0L_\30\044\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01356   424   NtReadVirtualMemory  (108, 0x184fb8, 76, ...  (108, 0x184fb8, 76, ... "\20P\30\0\30O\30\0\30P\30\0 O\30\0 P\30\0(O\30\0\0\0\32uh\342\32u\0\240\2\0:\0<\0pO\30\0\22\0\24\0\230O\30\0\4@\14\0\1\0\0\0LP\30\0\24B\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01357   424   NtReadVirtualMemory  (108, 0x185010, 76, ...  (108, 0x185010, 76, ... "\260P\30\0\270O\30\0\270P\30\0\300O\30\0\300P\30\0\310O\30\0\0\0\322s\0\0\0\0\0\220\0\0@\0B\0(K\30\0\30\0\32\0PK\30\0\4@\0\0\1\0\0\0\214Q\30\0\364O\30\0$\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01358   424   NtReadVirtualMemory  (108, 0x1850b0, 76, ...  (108, 0x1850b0, 76, ... "PQ\30\0\20P\30\0XQ\30\0\30P\30\0`Q\30\0 P\30\0\0\0\366t\0\0\0\0\0\260\0\0<\0>\0hP\30\0\24\0\26\0\220P\30\0\4@\0\0\1\0\0\0\374X\30\0\354M\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01359   424   NtReadVirtualMemory  (108, 0x185150, 76, ...  (108, 0x185150, 76, ... "\350Q\30\0\260P\30\0\360Q\30\0\270P\30\0\370Q\30\0\300P\30\0\0\0\11u\0\0\0\0\0p\1\0<\0>\0\10Q\30\0\24\0\26\00Q\30\0\4@\0\0\1\0\0\0DU\30\0LP\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01360   424   NtReadVirtualMemory  (108, 0x1851e8, 76, ...  (108, 0x1851e8, 76, ... "\210R\30\0PQ\30\0\220R\30\0XQ\30\0\230R\30\0`Q\30\0\0\0\267v!\226\271v\0\320\3\04\06\0\250Q\30\0\14\0\16\0\320Q\30\0\4@\14\0\3\0\0\0\304R\30\0\24I\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01361   424   NtReadVirtualMemory  (108, 0x185288, 76, ...  (108, 0x185288, 76, ... "0S\30\0\350Q\30\08S\30\0\360Q\30\0@S\30\0\370Q\30\0\0\0\370tg0\370t\0\200\0\0:\0<\0@R\30\0\22\0\24\0hR\30\0\4@\14\0\1\0\0\0Lg\30\0$R\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01362   424   NtReadVirtualMemory  (108, 0x185330, 76, ...  (108, 0x185330, 76, ... "\320S\30\0\210R\30\0\330S\30\0\220R\30\0\200T\30\0\230R\30\0\0\0\371t\0\21\371t\0\220\0\0@\0B\0\340R\30\0\30\0\32\0\10S\30\0\4@\10\0\1\0\0\0xZ\374wl)\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01363   424   NtReadVirtualMemory  (108, 0x1853d0, 76, ...  (108, 0x1853d0, 76, ... "pT\30\00S\30\0xT\30\08S\30\0XV\30\0\30U\30\0\0\0\0u\31\222\0u\0\260\1\0>\0@\0\210S\30\0\26\0\30\0\260S\30\0\4@\14\0\1\0\0\0$W\30\0LM\30\0\35\376};p\244\14\0", 76, ) , 76, ) == 0x0
 01364   424   NtReadVirtualMemory  (108, 0x185470, 76, ...  (108, 0x185470, 76, ... "\10U\30\0\320S\30\0\20U\30\0\330S\30\0\270U\30\0@S\30\0\0\0&u\305H&u\0p\2\0>\0@\0(T\30\0\26\0\30\0PT\30\0\6@\10\0\1\0\0\0\254]\30\0\244D\30\0\34\376};p\244\14\0", 76, ) , 76, ) == 0x0
 01365   424   NtReadVirtualMemory  (108, 0x185508, 76, ...  (108, 0x185508, 76, ... "\250U\30\0pT\30\0\260U\30\0xT\30\0\340S\30\0\270U\30\0\0\0\273v\0\0\0\0\0@\0\06\08\0\310T\30\0\16\0\20\0\360T\30\0\6@\0\0\1\0\0\0\344U\30\0\214Q\30\0\23\376};p\244\14\0", 76, ) , 76, ) == 0x0
 01366   424   NtReadVirtualMemory  (108, 0x1855a8, 76, ...  (108, 0x1855a8, 76, ... "HV\30\0\10U\30\0PV\30\0\20U\30\0\30U\30\0\200T\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0`U\30\0\24\0\26\0\210U\30\0\6@\14\0\2\0\0\0\204V\30\0DU\30\0\22\376};p\244\14\0", 76, ) , 76, ) == 0x0
 01367   424   NtReadVirtualMemory  (108, 0x185648, 76, ...  (108, 0x185648, 76, ... "\350V\30\0\250U\30\0\360V\30\0\260U\30\0\370V\30\0\340S\30\0\0\0-r\201\22-r\0\300\0\08\0:\0\0V\30\0\20\0\22\0(V\30\0\4@\14\0\1\0\0\0\274W\30\0\344U\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01368   424   NtReadVirtualMemory  (108, 0x1856e8, 76, ...  (108, 0x1856e8, 76, ... "\200W\30\0HV\30\0\210W\30\0PV\30\0\220W\30\0XV\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\240V\30\0\24\0\26\0\310V\30\0\4@\14\0\1\0\0\0\234Y\30\0\14T\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01369   424   NtReadVirtualMemory  (108, 0x185780, 76, ...  (108, 0x185780, 76, ... " X\30\0\350V\30\0(X\30\0\360V\30\0pY\30\0\370V\30\0\0\0\351u\212\23\351u\0\20\12\06\08\0@W\30\0\16\0\20\0hW\30\0\4@\10\0\1\0\0\0\d\30\0\204V\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01370   424   NtReadVirtualMemory  (108, 0x185820, 76, ...  (108, 0x185820, 76, ... "\300X\30\0\200W\30\0\310X\30\0\210W\30\0\260Z\30\0\20Z\30\0\0\0suh"su\0\320\21\0>\0@\0\330W\30\0\26\0\30\0\0X\30\0\4@\14\0\2\0\0\00\320\21\0>\0@\0\330W\30\0\26\0\30\0\0X\30\0\4@\14\0\2\0\0\030\0\324G\30\0\31\376};\0\0\0\0", 76, ) == 0x0
 01371   424   NtReadVirtualMemory  (108, 0x1858c0, 76, ...  (108, 0x1858c0, 76, ... "`Y\30\0 X\30\0hY\30\0(X\30\0\20Z\30\0pY\30\0\0\0\17u@\22\17u\0 \1\0<\0>\0xX\30\0\24\0\26\0\240X\30\0\6@\14\0\2\0\0\0$\\30\0\354P\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01372   424   NtReadVirtualMemory  (108, 0x185960, 76, ...  (108, 0x185960, 76, ... "\0Z\30\0\300X\30\0\10Z\30\0\310X\30\0\320X\30\0\220W\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\0\30Y\30\0\26\0\30\0@Y\30\0\6@\0\0\2\0\0\0\254e\30\0$W\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01373   424   NtReadVirtualMemory  (108, 0x185a00, 76, ...  (108, 0x185a00, 76, ... "\240Z\30\0`Y\30\0\250Z\30\0hY\30\00X\30\0\320X\30\0\0\0\23u*\24\23u\00\1\0>\0@\0\270Y\30\0\26\0\30\0\340Y\30\0\6@\14\0\2\0\0\0\334Z\30\0\X\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01374   424   NtReadVirtualMemory  (108, 0x185aa0, 76, ...  (108, 0x185aa0, 76, ... "H[\30\0\0Z\30\0P[\30\0\10Z\30\0X[\30\00X\30\0\0\0\374t\0\0\0\0\0\0\1\0>\0@\0XZ\30\0\26\0\30\0\200Z\30\0\4@\0\0\3\0\0\0\34c\30\0, 76, ) , 76, ) == 0x0
 01375   424   NtReadVirtualMemory  (108, 0x185b48, 76, ...  (108, 0x185b48, 76, ... "\350[\30\0\240Z\30\0\360[\30\0\250Z\30\0\370[\30\0\260Z\30\0\0\0\13u\320\21\13u\0\20\1\0@\0B\0\370Z\30\0\30\0\32\0 [\30\0\4@\14\0\1\0\0\0T^\30\0\4=\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01376   424   NtReadVirtualMemory  (108, 0x185be8, 76, ...  (108, 0x185be8, 76, ... "\310\\30\0H[\30\0\320\\30\0P[\30\0\330\\30\0X[\30\0\0\0\15uP\21\15u\0p\1\0<\0>\0\240[\30\0\24\0\26\0\310[\30\0\4@\10\0\1\0\0\0\254^\30\0\374X\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01377   424   NtReadVirtualMemory  (108, 0x185cc8, 76, ...  (108, 0x185cc8, 76, ... "p]\30\0\350[\30\0x]\30\0\360[\30\0\200]\30\0\370[\30\0\0\0\376t\0\0\0\0\0\360\0\0>\0@\0\200\\30\0\26\0\30\0\250\\30\0\4@\0\0\1\0\0\0hZ\374whZ\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01378   424   NtReadVirtualMemory  (108, 0x185d70, 76, ...  (108, 0x185d70, 76, ... "\30^\30\0\310\\30\0 ^\30\0\320\\30\0(^\30\0\330\\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0 ]\30\0\30\0\32\0H]\30\0\4@\14\0\1\0\0\0\214`\30\0\254T\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01379   424   NtReadVirtualMemory  (108, 0x185e18, 76, ...  (108, 0x185e18, 76, ... "p^\30\0p]\30\0x^\30\0x]\30\0\200^\30\0\200]\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\310]\30\0\30\0\32\0\360]\30\0\4@\14\0\1\0\0\0\324a\30\0\204[\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01380   424   NtReadVirtualMemory  (108, 0x185e70, 76, ...  (108, 0x185e70, 76, ... "\20_\30\0\30^\30\0\30_\30\0 ^\30\0\300_\30\0(^\30\0\0\0@v:\222@v\0\260\37\06\08\0@\\30\0\16\0\20\0h\\30\0\4@\14\0\1\0\0\04a\30\0$\\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01381   424   NtReadVirtualMemory  (108, 0x185f10, 76, ...  (108, 0x185f10, 76, ... "\260_\30\0p^\30\0\270_\30\0x^\30\0\250a\30\0\10a\30\0\0\0-u\230`-u\0\240\3\0>\0@\0\310^\30\0\26\0\30\0\360^\30\0\4@\14\0\1\0\0\0\370Z\374wTO\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01382   424   NtReadVirtualMemory  (108, 0x185fb0, 76, ...  (108, 0x185fb0, 76, ... "P`\30\0\20_\30\0X`\30\0\30_\30\0``\30\0\200^\30\0\0\0\367t\0\0\0\0\0P\0\0<\0>\0h_\30\0\24\0\26\0\220_\30\0\6@\0\0\1\0\0\0\240Z\374w\C\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01383   424   NtReadVirtualMemory  (108, 0x186050, 76, ...  (108, 0x186050, 76, ... "\370`\30\0\260_\30\0\0a\30\0\270_\30\0\10a\30\0\300_\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\10`\30\0\22\0\24\00`\30\0\6@\10\0\1\0\0\0`Z\374w\254]\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01384   424   NtReadVirtualMemory  (108, 0x1860f8, 76, ...  (108, 0x1860f8, 76, ... "\230a\30\0P`\30\0\240a\30\0X`\30\0 _\30\0``\30\0\0\0\21u\260Q\21u\0\300\1\0@\0B\0\250`\30\0\30\0\32\0\320`\30\0\6@\14\0\1\0\0\0\300Z\374w\254^\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01385   424   NtReadVirtualMemory  (108, 0x186198, 76, ...  (108, 0x186198, 76, ... "@b\30\0\370`\30\0Hb\30\0\0a\30\0\360b\30\0 _\30\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0Pa\30\0\24\0\26\0xa\30\0\4@\10\0\1\0\0\0\j\30\0T^\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01386   424   NtReadVirtualMemory  (108, 0x186240, 76, ...  (108, 0x186240, 76, ... "\340b\30\0\230a\30\0\350b\30\0\240a\30\00d\30\0\360b\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\360a\30\0\30\0\32\0\30b\30\0\4@\14\0\2\0\0\0dk\30\0\264B\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01387   424   NtReadVirtualMemory  (108, 0x1862e0, 76, ...  (108, 0x1862e0, 76, ... "\200c\30\0@b\30\0\210c\30\0Hb\30\0Pb\30\0\250a\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\230b\30\0\24\0\26\0\300b\30\0\6@\14\0\2\0\0\0pZ\374w\334Z\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01388   424   NtReadVirtualMemory  (108, 0x186380, 76, ...  (108, 0x186380, 76, ... " d\30\0\340b\30\0(d\30\0\350b\30\0\320d\30\00d\30\0\0\0\4u\300\276\4u\0\360\1\08\0:\08c\30\0\20\0\22\0`c\30\0\4@\14\0\1\0\0\0\0[\374w\274;\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01389   424   NtReadVirtualMemory  (108, 0x186420, 76, ...  (108, 0x186420, 76, ... "\300d\30\0\200c\30\0\310d\30\0\210c\30\0\220c\30\0Pb\30\0\0\0\360t\222E\360t\0\240\0\0>\0@\0\330c\30\0\26\0\30\0\0d\30\0\6@\14\0\1\0\0\0\360Z\374w\274W\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01390   424   NtReadVirtualMemory  (108, 0x1864c0, 76, ...  (108, 0x1864c0, 76, ... "pe\30\0 d\30\0xe\30\0(d\30\0\200e\30\0\220c\30\0\0\0\210hw:\212h\0\360\3\0>\0@\0xd\30\0\26\0\30\0\240d\30\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374wk\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01391   424   NtReadVirtualMemory  (108, 0x186570, 76, ...  (108, 0x186570, 76, ... "pf\30\0\300d\30\0xf\30\0\310d\30\0 h\30\0\320d\30\0\0\0\357t\14\22\357t\0\240\0\0J\0L\0\30e\30\0\30\0\32\0Je\30\0\4@\14\0\1\0\0\0\254f\30\0\234Y\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01392   424   NtReadVirtualMemory  (108, 0x186670, 76, ...  (108, 0x186670, 76, ... "\20g\30\0pe\30\0\30g\30\0xe\30\0\320h\30\0 g\30\0\0\0Eu\26\0Ju\0p\7\0J\0L\0\30f\30\0\30\0\32\0Jf\30\0\4@\14\0\1\0\0\0\374h\30\0\254e\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01393   424   NtReadVirtualMemory  (108, 0x186710, 76, ...  (108, 0x186710, 76, ... "\20h\30\0pf\30\0\30h\30\0xf\30\0\200f\30\0 h\30\0\0\01u\0\2713u\0\300\3\0F\0H\0\310e\30\0\24\0\26\0\372e\30\0\6@\14\0\4\0\0\0\200Z\374w\304R\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01394   424   NtReadVirtualMemory  (108, 0x186810, 76, ...  (108, 0x186810, 76, ... "\300h\30\0\20g\30\0\310h\30\0\30g\30\0 g\30\0\200e\30\0\0\0iu\317\254mu\0 \11\0J\0L\0\270g\30\0\30\0\32\0\352g\30\0\6@\14\0\10\0\0\0\210Z\374w\210Z\374w\32\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01395   424   NtReadVirtualMemory  (108, 0x1868c0, 76, ...  (108, 0x1868c0, 76, ... "pi\30\0\20h\30\0xi\30\0\30h\30\0\200i\30\0\200f\30\0\0\0\355t\16\246\355t\0\360\0\0H\0J\0hh\30\0\26\0\30\0\232h\30\0\4@\10\0\1\0\0\0\254i\30\0\254f\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01396   424   NtReadVirtualMemory  (108, 0x186970, 76, ...  (108, 0x186970, 76, ... " j\30\0\300h\30\0(j\30\0\310h\30\00j\30\0\320h\30\0\0\0\2u\254\365\2u\0\260\1\0J\0L\0\30i\30\0\30\0\32\0Ji\30\0\4@\14\0\1\0\0\0\14k\30\0\374h\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01397   424   NtReadVirtualMemory  (108, 0x186a20, 76, ...  (108, 0x186a20, 76, ... "\320j\30\0pi\30\0\330j\30\0xi\30\08k\30\0\200i\30\0\0\0 uh\251!u\0@\2\0J\0L\0\310i\30\0\30\0\32\0\372i\30\0\4@\14\0\1\0\0\0\350Z\374w\324a\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01398   424   NtReadVirtualMemory  (108, 0x186ad0, 76, ...  (108, 0x186ad0, 76, ... "(k\30\0 j\30\00k\30\0(j\30\0\350k\30\08k\30\0\0\0\177Yy\17\204Y\0p\6\0J\0L\0xj\30\0\30\0\32\0\252j\30\0\4@\14\0\1\0\0\0\24l\30\0\254i\30\0\322\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01399   424   NtReadVirtualMemory  (108, 0x186b28, 76, ...  (108, 0x186b28, 76, ... "\330k\30\0\320j\30\0\340k\30\0\330j\30\0\340j\30\00j\30\0\0\0w_5\21w_\0\340\0\0@\0B\0hg\30\0\30\0\32\0\220g\30\0\6@\10\0\2\0\0\0ll\30\0|b\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01400   424   NtReadVirtualMemory  (108, 0x186bd8, 76, ...  (108, 0x186bd8, 76, ... "0l\30\0(k\30\08l\30\00k\30\0@l\30\0\340j\30\0\0\09u\36\315;u\0 \4\0H\0J\0\200k\30\0\26\0\30\0\262k\30\0\4@\14\0\1\0\0\0\20[\374w\14k\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01401   424   NtReadVirtualMemory  (108, 0x186c30, 76, ...  (108, 0x186c30, 76, ... "\234\36\30\0\330k\30\0\244\36\30\0\340k\30\0\254\36\30\0\350k\30\0\0\0_u\261\245bu\0\20\11\0>\0@\0\310f\30\0\26\0\30\0\360f\30\0\4@\14\0\1\0\0\0\310Z\374wdk\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01402   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=972,ParentPid=660,}, 0x0, ) == 0x0
 01403   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01404   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01405   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01406   424   NtReadVirtualMemory  (108, 0x20598, 64, ...  (108, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 01407   424   NtClose  (108, ... ) == 0x0
 01408   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1060, 0}, ... 108, ) == 0x0
 01409   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1060,ParentPid=660,}, 0x0, ) == 0x0
 01410   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01411   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01412   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01413   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01414   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01415   424   NtReadVirtualMemory  (108, 0x182068, 76, ...  (108, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0`"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01416   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\260!\30\0h \30\0\270!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\244,\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01417   424   NtReadVirtualMemory  (108, 0x1821b0, 76, ...  (108, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) \30\0\10!\30\0X (108, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01418   424   NtReadVirtualMemory  (108, 0x182250, 76, ...  (108, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\260!\30\0\370 (108, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\00 (108, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01419   424   NtReadVirtualMemory  (108, 0x1822f0, 76, ...  (108, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\230#\30\0X (108, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\320 (108, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01420   424   NtReadVirtualMemory  (108, 0x182390, 76, ...  (108, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\08$\30\0\370 (108, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01421   424   NtReadVirtualMemory  (108, 0x182430, 76, ...  (108, 0x182430, 76, ... "\320$\30\0\220#\30\0\330$\30\0\230#\30\0X)\30\0\340$\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350#\30\0\24\0\26\0\20$\30\0\6@\14\0\3\0\0\044\30\0\354!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01422   424   NtReadVirtualMemory  (108, 0x1824d0, 76, ...  (108, 0x1824d0, 76, ... "p%\30\00$\30\0x%\30\08$\30\0@$\30\0\200%\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210$\30\0\24\0\26\0\260$\30\0\6@\10\0\16\0\0\0\254%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01423   424   NtReadVirtualMemory  (108, 0x182570, 76, ...  (108, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0\340$\30\0\0#\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(%\30\0\26\0\30\0P%\30\0\6@\14\0\10\0\0\0$*\30\0\14%\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01424   424   NtReadVirtualMemory  (108, 0x182618, 76, ...  (108, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\300!\30\0\310&\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01425   424   NtReadVirtualMemory  (108, 0x1826b8, 76, ...  (108, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0(&\30\0\3102\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p&\30\0\24\0\26\0\230&\30\0\6@\14\0\2\0\0\0\204)\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01426   424   NtReadVirtualMemory  (108, 0x182758, 76, ...  (108, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0\10/\30\0\300-\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20'\30\0\24\0\26\08'\30\0\6@\14\0\2\0\0\0t5\30\0\214"\30\0\22\376};\0\0\0\0", 76, ) \30\0\22\376};\0\0\0\0", 76, ) == 0x0
 01427   424   NtReadVirtualMemory  (108, 0x182800, 76, ...  (108, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0x,\30\0\330+\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\2\0\0\0\334(\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01428   424   NtReadVirtualMemory  (108, 0x1828a0, 76, ...  (108, 0x1828a0, 76, ... "H)\30\0\0(\30\0P)\30\0\10(\30\0\220*\30\0\370)\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\274*\30\0<(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01429   424   NtReadVirtualMemory  (108, 0x182948, 76, ...  (108, 0x182948, 76, ... "\350)\30\0\240(\30\0\360)\30\0\250(\30\0\370)\30\0@$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370(\30\0\30\0\32\0 )\30\0\6@\14\0\13\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01430   424   NtReadVirtualMemory  (108, 0x1829e8, 76, ...  (108, 0x1829e8, 76, ... "\200*\30\0H)\30\0\210*\30\0P)\30\0\260(\30\0X)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240)\30\0\26\0\30\0\310)\30\0\6@\10\0\2\0\0\0\241\30\0\254%\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01431   424   NtReadVirtualMemory  (108, 0x182a80, 76, ...  (108, 0x182a80, 76, ... " +\30\0\350)\30\0(+\30\0\360)\30\00+\30\0\260(\30\0\0\0\262v<-\262v\0P\1\06\08\0@*\30\0\16\0\20\0h*\30\0\6@\14\0\2\0\0\0`Z\374w\334(\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01432   424   NtReadVirtualMemory  (108, 0x182b20, 76, ...  (108, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\330*\30\0\22\0\24\0\0+\30\0\6@\10\0\15\0\0\0\4,\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01433   424   NtReadVirtualMemory  (108, 0x182bc8, 76, ...  (108, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0\20(\30\00+\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\10\0\0\0\320Z\374w\+\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01434   424   NtReadVirtualMemory  (108, 0x182c68, 76, ...  (108, 0x182c68, 76, ... "\10-\30\0\310+\30\0\20-\30\0\320+\30\0\30-\30\0\20(\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\14\0\7\0\0\0\224.\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01435   424   NtReadVirtualMemory  (108, 0x182d08, 76, ...  (108, 0x182d08, 76, ... "\260-\30\0h,\30\0\270-\30\0p,\30\0\300-\30\0x,\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\300,\30\0\24\0\26\0\350,\30\0\6@\10\0\2\0\0\0\354-\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01436   424   NtReadVirtualMemory  (108, 0x182db0, 76, ...  (108, 0x182db0, 76, ... "X.\30\0\10-\30\0`.\30\0\20-\30\0h'\30\0\30-\30\0\0\0gv8\25gv\0@\16\0@\0B\0`-\30\0\30\0\32\0\210-\30\0\6@\10\0\2\0\0\0t0\30\0D-\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01437   424   NtReadVirtualMemory  (108, 0x182e58, 76, ...  (108, 0x182e58, 76, ... "\370.\30\0\260-\30\0\0/\30\0\270-\30\0\2101\30\0\250/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\10.\30\0\30\0\32\00.\30\0\6@\14\0\3\0\0\04/\30\0\244,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01438   424   NtReadVirtualMemory  (108, 0x182ef8, 76, ...  (108, 0x182ef8, 76, ... "\230/\30\0X.\30\0\240/\30\0`.\30\0H0\30\0h'\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\260.\30\0\24\0\26\0\330.\30\0\6@\14\0\3\0\0\0\350Z\374w\224.\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01439   424   NtReadVirtualMemory  (108, 0x182f98, 76, ...  (108, 0x182f98, 76, ... "80\30\0\370.\30\0@0\30\0\0/\30\0h.\30\0\3500\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0P/\30\0\24\0\26\0x/\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01440   424   NtReadVirtualMemory  (108, 0x183038, 76, ...  (108, 0x183038, 76, ... "\3300\30\0\230/\30\0\3400\30\0\240/\30\0\3500\30\0\10/\30\0\0\0-w\306@-w\00\6\0>\0@\0\360/\30\0\26\0\30\0\300\30\0\6@\14\0\11\0\0\0\2641\30\0\354-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01441   424   NtReadVirtualMemory  (108, 0x1830d8, 76, ...  (108, 0x1830d8, 76, ... "x1\30\080\30\0\2001\30\0@0\30\0\250/\30\0H0\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2200\30\0\22\0\24\0\2700\30\0\6@\14\0\3\0\0\0\3642\30\0$*\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01442   424   NtReadVirtualMemory  (108, 0x183178, 76, ...  (108, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0(2\30\0h.\30\0\0\0=w\24 ?w\0@\177\0>\0@\001\30\0\26\0\30\0X1\30\0\6@\10\0\2\0\0\0T2\30\0t0\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01443   424   NtReadVirtualMemory  (108, 0x183218, 76, ...  (108, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0`3\30\0\2101\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3201\30\0\26\0\30\0\3701\30\0\6@\14\0\6\0\0\0\360Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01444   424   NtReadVirtualMemory  (108, 0x1832b8, 76, ...  (108, 0x1832b8, 76, ... "P3\30\0\302\30\0X3\30\0 2\30\0\310&\30\0\3605\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 01445   424   NtReadVirtualMemory  (108, 0x183350, 76, ...  (108, 0x183350, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\104\30\0(2\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\203\30\0\16\0\20\083\30\0\6@\0\0\2\0\0\0\346\30\0\3642\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01446   424   NtReadVirtualMemory  (108, 0x1833f8, 76, ...  (108, 0x1833f8, 76, ... "\2304\30\0P3\30\0\2404\30\0X3\30\0H5\30\0`3\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2503\30\0\30\0\32\0\3203\30\0\6@\14\0\2\0\0\0xZ\374wl$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01447   424   NtReadVirtualMemory  (108, 0x183498, 76, ...  (108, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\2206\30\0H5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0P4\30\0\26\0\30\0x4\30\0\6@\10\0\2\0\0\0\3647\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01448   424   NtReadVirtualMemory  (108, 0x183538, 76, ...  (108, 0x183538, 76, ... "\3405\30\0\2304\30\0\3505\30\0\2404\30\0\2504\30\0\104\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3604\30\0\24\0\26\0\305\30\0\6@\14\0\2\0\0\0<9\30\0\224'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01449   424   NtReadVirtualMemory  (108, 0x1835e0, 76, ...  (108, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\3102\30\0\2206\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\0\0\2\0\0\0\2746\30\0\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01450   424   NtReadVirtualMemory  (108, 0x183680, 76, ...  (108, 0x183680, 76, ... "\2707\30\0\3405\30\0\3007\30\0\3505\30\0\3605\30\0\2504\30\0\0\06v\240\206v\0\360\0\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\10\0\4\0\0\0\3449\30\0\346\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01451   424   NtReadVirtualMemory  (108, 0x1837b8, 76, ...  (108, 0x1837b8, 76, ... "`8\30\0\2006\30\0h8\30\0\2106\30\0p8\30\0\300!\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3306\30\0\30\0\32\0\2267\30\0\4@\14\20\2\0\0\0\2348\30\0\3244\30\02\376};\200x\10\0", 76, ) , 76, ) == 0x0
 01452   424   NtReadVirtualMemory  (108, 0x183860, 76, ...  (108, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0\209\30\0\3107\30\0\0\04wY\324w\0\260\10\0@\0B\0\208\30\0\30\0\32\088\30\0\4@\14\0\1\0\0\0pZ\374w\3647\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01453   424   NtReadVirtualMemory  (108, 0x183900, 76, ...  (108, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\2709\30\0p8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\4@\10\0\2\0\0\0\300Z\374wt5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01454   424   NtReadVirtualMemory  (108, 0x1839a8, 76, ...  (108, 0x1839a8, 76, ... "\234\36\30\0\09\30\0\244\36\30\0\109\30\0\254\36\30\0\209\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\4@\14\0\1\0\0\0\20[\374w\2746\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01455   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1060,ParentPid=660,}, 0x0, ) == 0x0
 01456   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01457   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01458   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01459   424   NtReadVirtualMemory  (108, 0x20598, 64, ...  (108, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 01460   424   NtClose  (108, ... ) == 0x0
 01461   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1088, 0}, ... 108, ) == 0x0
 01462   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 01463   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01464   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01465   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01466   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01467   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01468   424   NtReadVirtualMemory  (108, 0x182068, 76, ...  (108, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01469   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\274*\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01470   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 01471   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01472   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01473   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01474   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\20(\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0r\0\0\0L&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01475   424   NtReadVirtualMemory  (108, 0x1824d0, 76, ...  (108, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\230#\30\0\200%\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01476   424   NtReadVirtualMemory  (108, 0x182570, 76, ...  (108, 0x182570, 76, ... "\20&\30\0\320$\30\0\30&\30\0\330$\30\0\340$\30\0 2\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%\30\0\24\0\26\0P%\30\0\6@\14\0\2\0\0\0<(\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01477   424   NtReadVirtualMemory  (108, 0x182610, 76, ...  (108, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0`.\30\0\330+\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\2\0\0\0l5\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01478   424   NtReadVirtualMemory  (108, 0x1826b8, 76, ...  (108, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0\220*\30\0\360)\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\14\0\2\0\0\0\224'\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01479   424   NtReadVirtualMemory  (108, 0x182758, 76, ...  (108, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0H)\30\0\260(\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\2\0\0\0t)\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01480   424   NtReadVirtualMemory  (108, 0x182800, 76, ...  (108, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\260(\30\08$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\13\0\0\0\310Z\374w\254%\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01481   424   NtReadVirtualMemory  (108, 0x1828a0, 76, ...  (108, 0x1828a0, 76, ... "8)\30\0\0(\30\0@)\30\0\10(\30\0h'\30\0\20(\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\354-\30\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01482   424   NtReadVirtualMemory  (108, 0x182938, 76, ...  (108, 0x182938, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\360)\30\0h'\30\0\0\0\262v<-\262v\0P\1\06\08\0\370(\30\0\16\0\20\0 )\30\0\6@\14\0\2\0\0\0`Z\374w\224'\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01483   424   NtReadVirtualMemory  (108, 0x1829e0, 76, ...  (108, 0x1829e0, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\310&\30\0H)\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\220)\30\0\30\0\32\0\270)\30\0\6@\10\0\11\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01484   424   NtReadVirtualMemory  (108, 0x182a80, 76, ...  (108, 0x182a80, 76, ... " +\30\0\340)\30\0(+\30\0\350)\30\00+\30\0\310&\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\08*\30\0\26\0\30\0`*\30\0\6@\14\0\7\0\0\0\254,\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01485   424   NtReadVirtualMemory  (108, 0x182b20, 76, ...  (108, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\330*\30\0\24\0\26\0\0+\30\0\6@\10\0\2\0\0\0\4,\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01486   424   NtReadVirtualMemory  (108, 0x182bc8, 76, ...  (108, 0x182bc8, 76, ... "p,\30\0 +\30\0x,\30\0(+\30\0 &\30\00+\30\0\0\0gv8\25gv\0@\16\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\2\0\0\0\314/\30\0\+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01487   424   NtReadVirtualMemory  (108, 0x182c70, 76, ...  (108, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\3400\30\0\0/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\3\0\0\0L-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01488   424   NtReadVirtualMemory  (108, 0x182d10, 76, ...  (108, 0x182d10, 76, ... "\260-\30\0p,\30\0\270-\30\0x,\30\0\240/\30\0\300-\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\310,\30\0\24\0\26\0\360,\30\0\6@\14\0\3\0\0\0\3349\30\0\254,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01489   424   NtReadVirtualMemory  (108, 0x182db0, 76, ...  (108, 0x182db0, 76, ... "P.\30\0\20-\30\0X.\30\0\30-\30\0 -\30\0`.\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h-\30\0\24\0\26\0\220-\30\0\6@\10\00\0\0\0\214.\30\0\334(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01490   424   NtReadVirtualMemory  (108, 0x182e50, 76, ...  (108, 0x182e50, 76, ... "\360.\30\0\260-\30\0\370.\30\0\270-\30\0\300-\30\0 &\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10.\30\0\26\0\30\00.\30\0\6@\14\0+\0\0\0l0\30\0\354-\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01491   424   NtReadVirtualMemory  (108, 0x182ef0, 76, ...  (108, 0x182ef0, 76, ... "\220/\30\0P.\30\0\230/\30\0X.\30\0\200,\30\0@0\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\250.\30\0\24\0\26\0\320.\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01492   424   NtReadVirtualMemory  (108, 0x182f90, 76, ...  (108, 0x182f90, 76, ... "00\30\0\360.\30\080\30\0\370.\30\0@0\30\0 -\30\0\0\0-w\306@-w\00\6\0>\0@\0H/\30\0\26\0\30\0p/\30\0\6@\14\0\15\0\0\0\141\30\0\4,\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01493   424   NtReadVirtualMemory  (108, 0x183030, 76, ...  (108, 0x183030, 76, ... "\3200\30\0\220/\30\0\3300\30\0\230/\30\0\0/\30\0\240/\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\350/\30\0\22\0\24\0\200\30\0\6@\14\0\3\0\0\0L2\30\0\214.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01494   424   NtReadVirtualMemory  (108, 0x1830d0, 76, ...  (108, 0x1830d0, 76, ... "p1\30\000\30\0x1\30\080\30\0\2001\30\0\200,\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2100\30\0\26\0\30\0\2600\30\0\6@\10\0\4\0\0\0\2541\30\0\314/\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01495   424   NtReadVirtualMemory  (108, 0x183170, 76, ...  (108, 0x183170, 76, ... "\202\30\0\3200\30\0\302\30\0\3300\30\0\2702\30\0\3400\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0(1\30\0\26\0\30\0P1\30\0\6@\14\0\10\0\0\0\374<\30\0\141\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01496   424   NtReadVirtualMemory  (108, 0x183210, 76, ...  (108, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\200%\30\0\3505\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 01497   424   NtReadVirtualMemory  (108, 0x1832a8, 76, ...  (108, 0x1832a8, 76, ... "P3\30\0\202\30\0X3\30\0\302\30\0\04\30\0\2001\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\0\0\2\0\0\0\246\30\0L2\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01498   424   NtReadVirtualMemory  (108, 0x183350, 76, ...  (108, 0x183350, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0@5\30\0\04\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\03\30\0\30\0\32\0(3\30\0\6@\14\0\2\0\0\0,4\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01499   424   NtReadVirtualMemory  (108, 0x1833f0, 76, ...  (108, 0x1833f0, 76, ... "\2204\30\0P3\30\0\2304\30\0X3\30\0`3\30\0\2702\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\2503\30\0\24\0\26\0\3203\30\0\6@\14\0\3\0\0\0xZ\374w\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01500   424   NtReadVirtualMemory  (108, 0x183490, 76, ...  (108, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\2106\30\0@5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\10\0\3\0\0\0\3547\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01501   424   NtReadVirtualMemory  (108, 0x183530, 76, ...  (108, 0x183530, 76, ... "\3305\30\0\2204\30\0\3405\30\0\2304\30\0\2404\30\0`3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\14\0\3\0\0\049\30\0L&\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01502   424   NtReadVirtualMemory  (108, 0x1835d8, 76, ...  (108, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0 2\30\0\2106\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\0\0\2\0\0\0\2646\30\0\3442\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01503   424   NtReadVirtualMemory  (108, 0x183678, 76, ...  (108, 0x183678, 76, ... "\2607\30\0\3305\30\0\2707\30\0\3405\30\0\3505\30\0\2404\30\0\0\06v\240\206v\0\360\0\0<\0>\006\30\0\24\0\26\0X6\30\0\6@\10\0\4\0\0\0|:\30\0\246\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01504   424   NtReadVirtualMemory  (108, 0x1837b0, 76, ...  (108, 0x1837b0, 76, ... "X8\30\0x6\30\0`8\30\0\2006\30\0h8\30\0\230#\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3206\30\0\30\0\32\0\2167\30\0\4@\14\20\3\0\0\0\2248\30\0\3144\30\02\376};\330\324\10\0", 76, ) , 76, ) == 0x0
 01505   424   NtReadVirtualMemory  (108, 0x183858, 76, ...  (108, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\109\30\0\3007\30\0\0\04wY\324w\0\260\10\0@\0B\0\108\30\0\30\0\32\008\30\0\4@\14\0\1\0\0\0pZ\374w\3547\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01506   424   NtReadVirtualMemory  (108, 0x1838f8, 76, ...  (108, 0x1838f8, 76, ... "\2409\30\0X8\30\0\2509\30\0`8\30\0\2609\30\0h8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\4\0\0\0\300Z\374wl5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01507   424   NtReadVirtualMemory  (108, 0x1839a0, 76, ...  (108, 0x1839a0, 76, ... "@:\30\0\3708\30\0H:\30\0\09\30\0\360:\30\0\109\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0P9\30\0\30\0\32\0x9\30\0\4@\14\0\1\0\0\0\<\30\0L-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01508   424   NtReadVirtualMemory  (108, 0x183a40, 76, ...  (108, 0x183a40, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\220;\30\0\360:\30\0\0\0nZ\0\0\0\0\0@\1\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\4@\0\0\1\0\0\0\34;\30\0\2646\30\0\321\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01509   424   NtReadVirtualMemory  (108, 0x183ae0, 76, ...  (108, 0x183ae0, 76, ... "\200;\30\0@:\30\0\210;\30\0H:\30\0P:\30\0\2609\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\230:\30\0\26\0\30\0\300:\30\0\6@\10\0\1\0\0\0\274;\30\0|:\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01510   424   NtReadVirtualMemory  (108, 0x183b80, 76, ...  (108, 0x183b80, 76, ... " <\30\0\340:\30\0(<\30\0\350:\30\00<\30\0P:\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\08;\30\0\26\0\30\0`;\30\0\4@\0\0\1\0\0\0\244=\30\0\34;\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01511   424   NtReadVirtualMemory  (108, 0x183c20, 76, ...  (108, 0x183c20, 76, ... "\300<\30\0\200;\30\0\310<\30\0\210;\30\0\320<\30\0\220;\30\0\0\0\302t\220\22\302t\0\0\1\0<\0>\0\330;\30\0\24\0\26\0\0<\30\0\4@\10\0\1\0\0\0\350Z\374w\3349\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01512   424   NtReadVirtualMemory  (108, 0x183cc0, 76, ...  (108, 0x183cc0, 76, ... "h=\30\0 <\30\0p=\30\0(<\30\0x=\30\00<\30\0\0\0\301t`\36\301t\0\320\0\0>\0@\0x<\30\0\26\0\30\0\240<\30\0\4@\14\0\1\0\0\0\360Z\374w\2541\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01513   424   NtReadVirtualMemory  (108, 0x183d68, 76, ...  (108, 0x183d68, 76, ... "\10>\30\0\300<\30\0\20>\30\0\310<\30\0\30>\30\0\320<\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\30=\30\0\30\0\32\0@=\30\0\4@\14\0\1\0\0\0\20[\374w\274;\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01514   424   NtReadVirtualMemory  (108, 0x183e08, 76, ...  (108, 0x183e08, 76, ... "\234\36\30\0h=\30\0\244\36\30\0p=\30\0\254\36\30\0x=\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\2\0\0\0\0[\374w$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01515   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 01516   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01517   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01518   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01519   424   NtReadVirtualMemory  (108, 0x20598, 64, ...  (108, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 01520   424   NtClose  (108, ... ) == 0x0
 01521   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1368, 0}, ... 108, ) == 0x0
 01522   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1368,ParentPid=660,}, 0x0, ) == 0x0
 01523   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01524   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01525   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01526   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\234.\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01527   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01528   424   NtReadVirtualMemory  (108, 0x182060, 76, ...  (108, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\4,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01529   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01530   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01531   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01532   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01533   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01534   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\330$\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\36\0\0\0\4%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01535   424   NtReadVirtualMemory  (108, 0x1824c8, 76, ...  (108, 0x1824c8, 76, ... "\10&\30\0($\30\0\20&\30\00$\30\08$\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) \30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) == 0x0
 01536   424   NtReadVirtualMemory  (108, 0x182608, 76, ...  (108, 0x182608, 76, ... "\360'\30\0\310$\30\0\370'\30\0\320$\30\0\0(\30\0\230#\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\300%\30\0\24\0\26\0\350%\30\0\4@\14\0\4\0\0\0\34B\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01537   424   NtReadVirtualMemory  (108, 0x1827f0, 76, ...  (108, 0x1827f0, 76, ... "h%\30\0\10&\30\0p%\30\0\20&\30\0X'\30\0\30&\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\240'\30\0\30\0\32\0\310'\30\0\4@\14\0\1\0\0\0,;\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01538   424   NtReadVirtualMemory  (108, 0x182568, 76, ...  (108, 0x182568, 76, ... "H'\30\0\360'\30\0P'\30\0\370'\30\0\310-\30\0 -\30\0\0\02t8Q2t\0\220\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\4\0\0\0\270Z\374w\270Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 01539   424   NtReadVirtualMemory  (108, 0x182748, 76, ...  (108, 0x182748, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\0(\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0 %\30\0\22\0\24\0H%\30\0\6@\10\0\34\0\0\0\344&\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01540   424   NtReadVirtualMemory  (108, 0x1826a8, 76, ...  (108, 0x1826a8, 76, ... "\350(\30\0H'\30\0\360(\30\0P'\30\0\370(\30\0X'\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\230(\30\0\30\0\32\0\300(\30\0\6@\10\0\12\0\0\0\320Z\374w\204'\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01541   424   NtReadVirtualMemory  (108, 0x1828e8, 76, ...  (108, 0x1828e8, 76, ... "@)\30\0\250&\30\0H)\30\0\260&\30\0P)\30\0\270&\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\0'\30\0\26\0\30\0('\30\0\6@\10\0\6\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01542   424   NtReadVirtualMemory  (108, 0x182940, 76, ...  (108, 0x182940, 76, ... "\340)\30\0\350(\30\0\350)\30\0\360(\30\0\330+\30\0\370(\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\6@\14\0\7\0\0\0\34*\30\0\304#\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01543   424   NtReadVirtualMemory  (108, 0x1829e0, 76, ...  (108, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0 -\30\0\230*\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0\230)\30\0\24\0\26\0\300)\30\0\6@\14\0\4\0\0\0\314;\30\0|)\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01544   424   NtReadVirtualMemory  (108, 0x182a88, 76, ...  (108, 0x182a88, 76, ... "(+\30\0\340)\30\00+\30\0\350)\30\0\360)\30\0\200,\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\08*\30\0\30\0\32\0`*\30\0\6@\14\0\4\0\0\0\364-\30\0\4%\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01545   424   NtReadVirtualMemory  (108, 0x182b28, 76, ...  (108, 0x182b28, 76, ... "\310+\30\0\210*\30\0\320+\30\0\220*\30\0\200,\30\0\330+\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\340*\30\0\26\0\30\0\10+\30\0\6@\10\0\12\0\0\0, 76, ) , 76, ) == 0x0
 01546   424   NtReadVirtualMemory  (108, 0x182bc8, 76, ...  (108, 0x182bc8, 76, ... "p,\30\0(+\30\0x,\30\00+\30\08+\30\0P)\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\200+\30\0\24\0\26\0\250+\30\0\6@\14\0\11\0\0\0\3041\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01547   424   NtReadVirtualMemory  (108, 0x182c70, 76, ...  (108, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\230*\30\08+\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\4\0\0\0$6\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01548   424   NtReadVirtualMemory  (108, 0x182d10, 76, ...  (108, 0x182d10, 76, ... "\270-\30\0p,\30\0\300-\30\0x,\30\0x%\30\0\360)\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\310,\30\0\26\0\30\0\360,\30\0\6@\14\0\4\0\0\0\341\30\0$#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01549   424   NtReadVirtualMemory  (108, 0x182db8, 76, ...  (108, 0x182db8, 76, ... "`.\30\0\20-\30\0h.\30\0\30-\30\0p.\30\0x%\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0h-\30\0\30\0\32\0\220-\30\0\4@\14\0\2\0\0\0\2542\30\0\304*\30\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01550   424   NtReadVirtualMemory  (108, 0x182e60, 76, ...  (108, 0x182e60, 76, ... "\0/\30\0\270-\30\0\10/\30\0\300-\30\0\20/\30\0\310-\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\20.\30\0\30\0\32\08.\30\0\4@\14\0\12\0\0\0D4\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01551   424   NtReadVirtualMemory  (108, 0x182f00, 76, ...  (108, 0x182f00, 76, ... "\240/\30\0`.\30\0\250/\30\0h.\30\0\260/\30\0p.\30\0\0\0*t\350\24*t\0\340\0\0>\0@\0\270.\30\0\26\0\30\0\340.\30\0\4@\10\0\1\0\0\0\3444\30\0d+\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01552   424   NtReadVirtualMemory  (108, 0x182fa0, 76, ...  (108, 0x182fa0, 76, ... "@0\30\0\0/\30\0H0\30\0\10/\30\0P0\30\0\20/\30\0\0\0(t\37\22(t\0p\0\0<\0>\0X/\30\0\24\0\26\0\200/\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01553   424   NtReadVirtualMemory  (108, 0x183040, 76, ...  (108, 0x183040, 76, ... "\3400\30\0\240/\30\0\3500\30\0\250/\30\0\3600\30\0\260/\30\0\0\0@r\1\26@r\0\300\0\0<\0>\0\370/\30\0\24\0\26\0 0\30\0\4@\14\0\1\0\0\0\>\30\0\370Z\374w-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01554   424   NtReadVirtualMemory  (108, 0x1830e0, 76, ...  (108, 0x1830e0, 76, ... "\2101\30\0@0\30\0\2201\30\0H0\30\0\2301\30\0P0\30\0\0\0?r\355\23?r\0p\0\0<\0>\0\2300\30\0\24\0\26\0\3000\30\0\4@\14\0\1\0\0\0\0[\374wL-\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01555   424   NtReadVirtualMemory  (108, 0x183188, 76, ...  (108, 0x183188, 76, ... "p2\30\0\3400\30\0x2\30\0\3500\30\0 3\30\0\3600\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\3401\30\0\26\0\30\0\102\30\0\4@\10\0\2\0\0\0\2548\30\0\4,\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01556   424   NtReadVirtualMemory  (108, 0x183270, 76, ...  (108, 0x183270, 76, ... "\203\30\0\2101\30\0\303\30\0\2201\30\0\304\30\0 3\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0(2\30\0\24\0\26\0P2\30\0\4@\14\0\1\0\0\0L3\30\0\364-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01557   424   NtReadVirtualMemory  (108, 0x183310, 76, ...  (108, 0x183310, 76, ... "h3\30\0p2\30\0p3\30\0x2\30\0\2002\30\0\2301\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\3102\30\0\26\0\30\0\3602\30\0\6@\10\0\2\0\0\0\2443\30\0\2542\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01558   424   NtReadVirtualMemory  (108, 0x183368, 76, ...  (108, 0x183368, 76, ... "\104\30\0\203\30\0\204\30\0\303\30\0X5\30\0\304\30\0\0\0+t"\24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) \24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) == 0x0
 01559   424   NtReadVirtualMemory  (108, 0x183408, 76, ...  (108, 0x183408, 76, ... "\2504\30\0h3\30\0\2604\30\0p3\30\0x3\30\0\2002\30\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\3003\30\0\24\0\26\0\3503\30\0\6@\0\0\1\0\0\0\148\30\0\234.\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01560   424   NtReadVirtualMemory  (108, 0x1834a8, 76, ...  (108, 0x1834a8, 76, ... "H5\30\0\104\30\0P5\30\0\204\30\0\2306\30\0X5\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0`4\30\0\26\0\30\0\2104\30\0\4@\14\0\2\0\0\0\2045\30\0, 76, ) , 76, ) == 0x0
 01561   424   NtReadVirtualMemory  (108, 0x183548, 76, ...  (108, 0x183548, 76, ... "\3505\30\0\2504\30\0\3605\30\0\2604\30\0\2704\30\0x3\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\05\30\0\24\0\26\0(5\30\0\6@\14\0\2\0\0\0\234D\30\0\3444\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01562   424   NtReadVirtualMemory  (108, 0x1835e8, 76, ...  (108, 0x1835e8, 76, ... "\2106\30\0H5\30\0\2206\30\0P5\30\0pD\30\0@7\30\0\0\00t\11\300t\0@\1\0<\0>\0\2405\30\0\24\0\26\0\3105\30\0\4@\14\0\1\0\0\0\3046\30\0\254,\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01563   424   NtReadVirtualMemory  (108, 0x183688, 76, ...  (108, 0x183688, 76, ... "07\30\0\3505\30\087\30\0\3605\30\0\3109\30\0\2704\30\0\0\0)t\0\0\0\0\0@\0\08\0:\0@6\30\0\20\0\22\0h6\30\0\6@\0\0\1\0\0\0l7\30\0$6\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01564   424   NtReadVirtualMemory  (108, 0x183730, 76, ...  (108, 0x183730, 76, ... "\3207\30\0\2106\30\0\3307\30\0\2206\30\0\3705\30\0\3407\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\3406\30\0\30\0\32\0\107\30\0\6@\14\0\3\0\0\0\240Z\374w\3046\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01565   424   NtReadVirtualMemory  (108, 0x1837d0, 76, ...  (108, 0x1837d0, 76, ... "p8\30\007\30\0x8\30\087\30\0@7\30\0\260@\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\2107\30\0\24\0\26\0\2607\30\0\6@\14\0\1\0\0\0\310Z\374wD4\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01566   424   NtReadVirtualMemory  (108, 0x183870, 76, ...  (108, 0x183870, 76, ... "\309\30\0\3207\30\0 9\30\0\3307\30\0\220=\30\0H<\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0(8\30\0\24\0\26\0P8\30\0\6@\14\0\1\0\0\0\300Z\374w\3041\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01567   424   NtReadVirtualMemory  (108, 0x183918, 76, ...  (108, 0x183918, 76, ... "\2709\30\0p8\30\0\3009\30\0x8\30\0\0;\30\0`:\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\3108\30\0\30\0\32\0\3608\30\0\6@\14\0\1\0\0\0\3649\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01568   424   NtReadVirtualMemory  (108, 0x1839b8, 76, ...  (108, 0x1839b8, 76, ... "P:\30\0\309\30\0X:\30\0 9\30\0`:\30\0\2306\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0p9\30\0\26\0\30\0\2309\30\0\6@\10\0\1\0\0\0\214:\30\0T9\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01569   424   NtReadVirtualMemory  (108, 0x183a50, 76, ...  (108, 0x183a50, 76, ... "\360:\30\0\2709\30\0\370:\30\0\3009\30\0(9\30\0\3109\30\0\0\0\262v<-\262v\0P\1\06\08\0\20:\30\0\16\0\20\08:\30\0\6@\14\0\1\0\0\0`Z\374w\3649\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01570   424   NtReadVirtualMemory  (108, 0x183af0, 76, ...  (108, 0x183af0, 76, ... "\220;\30\0P:\30\0\230;\30\0X:\30\0\240;\30\0(9\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\250:\30\0\26\0\30\0\320:\30\0\6@\14\0\4\0\0\0\34=\30\0,(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01571   424   NtReadVirtualMemory  (108, 0x183b90, 76, ...  (108, 0x183b90, 76, ... "8<\30\0\360:\30\0@<\30\0\370:\30\0H<\30\0\0;\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\1\0\0\0t<\30\0\34*\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01572   424   NtReadVirtualMemory  (108, 0x183c38, 76, ...  (108, 0x183c38, 76, ... "\340<\30\0\220;\30\0\350<\30\0\230;\30\0\2008\30\0\240;\30\0\0\0gv8\25gv\0@\16\0@\0B\0\350;\30\0\30\0\32\0\20<\30\0\6@\10\0\1\0\0\0\374>\30\0\314;\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01573   424   NtReadVirtualMemory  (108, 0x183ce0, 76, ...  (108, 0x183ce0, 76, ... "\200=\30\08<\30\0\210=\30\0@<\30\0\20@\30\00>\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\220<\30\0\30\0\32\0\270<\30\0\6@\14\0\2\0\0\0\274=\30\0,;\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01574   424   NtReadVirtualMemory  (108, 0x183d80, 76, ...  (108, 0x183d80, 76, ... " >\30\0\340<\30\0(>\30\0\350<\30\0\320>\30\0\2008\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\08=\30\0\24\0\26\0`=\30\0\6@\14\0\2\0\0\0\350Z\374w\34=\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01575   424   NtReadVirtualMemory  (108, 0x183e20, 76, ...  (108, 0x183e20, 76, ... "\300>\30\0\200=\30\0\310>\30\0\210=\30\0\360<\30\0p?\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\330=\30\0\24\0\26\0\0>\30\0\6@\10\0\2\0\0\0\370Z\374w|0\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01576   424   NtReadVirtualMemory  (108, 0x183ec0, 76, ...  (108, 0x183ec0, 76, ... "`?\30\0 >\30\0h?\30\0(>\30\0p?\30\0\220=\30\0\0\0-w\306@-w\00\6\0>\0@\0x>\30\0\26\0\30\0\240>\30\0\6@\14\0\6\0\0\0<@\30\0t<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01577   424   NtReadVirtualMemory  (108, 0x183f60, 76, ...  (108, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\00>\30\0\320>\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\30?\30\0\22\0\24\0@?\30\0\6@\14\0\2\0\0\0\334@\30\0\2443\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01578   424   NtReadVirtualMemory  (108, 0x184000, 76, ...  (108, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0HA\30\0\360<\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0\360Z\374w\374>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01579   424   NtReadVirtualMemory  (108, 0x1840a0, 76, ...  (108, 0x1840a0, 76, ... "8A\30\0\0@\30\0@A\30\0\10@\30\0\3407\30\0\230B\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 01580   424   NtReadVirtualMemory  (108, 0x184138, 76, ...  (108, 0x184138, 76, ... "\340A\30\0\240@\30\0\350A\30\0\250@\30\0\360A\30\0\20@\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\370@\30\0\16\0\20\0 A\30\0\6@\0\0\1\0\0\0\304B\30\0\334@\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01581   424   NtReadVirtualMemory  (108, 0x1841e0, 76, ...  (108, 0x1841e0, 76, ... "\210B\30\08A\30\0\220B\30\0@A\30\08C\30\0HA\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220A\30\0\30\0\32\0\270A\30\0\6@\14\0\1\0\0\0xZ\374wD&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01582   424   NtReadVirtualMemory  (108, 0x184288, 76, ...  (108, 0x184288, 76, ... "(C\30\0\340A\30\00C\30\0\350A\30\0\260@\30\08C\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08B\30\0\30\0\32\0`B\30\0\6@\0\0\1\0\0\0dC\30\0tA\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01583   424   NtReadVirtualMemory  (108, 0x184328, 76, ...  (108, 0x184328, 76, ... "`D\30\0\210B\30\0hD\30\0\220B\30\0\230B\30\0\360A\30\0\0\06v\240\206v\0\360\0\0<\0>\0\340B\30\0\24\0\26\0\10C\30\0\6@\10\0\2\0\0\0\20[\374w\304B\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01584   424   NtReadVirtualMemory  (108, 0x184460, 76, ...  (108, 0x184460, 76, ... "\10E\30\0(C\30\0\20E\30\00C\30\0\30E\30\0\3705\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\200C\30\0\30\0\32\0>D\30\0\4@\14\20\2\0\0\0DE\30\0\2045\30\02\376};`\266\11\0", 76, ) , 76, ) == 0x0
 01585   424   NtReadVirtualMemory  (108, 0x184508, 76, ...  (108, 0x184508, 76, ... "\234\36\30\0`D\30\0\244\36\30\0hD\30\0\254\36\30\0pD\30\0\0\04wY\324w\0\260\10\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\4@\14\0\1\0\0\0pZ\374w\234D\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01586   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1368,ParentPid=660,}, 0x0, ) == 0x0
 01587   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01588   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01589   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 01590   424   NtReadVirtualMemory  (108, 0x20598, 64, ...  (108, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0p\0o\0o\0l\0s\0v\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 01591   424   NtClose  (108, ... ) == 0x0
 01592   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1636, 0}, ... 108, ) == 0x0
 01593   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1636,ParentPid=660,}, 0x0, ) == 0x0
 01594   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 01595   424   NtReadVirtualMemory  (108, 0x241ea4, 4, ...  (108, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 01596   424   NtReadVirtualMemory  (108, 0x241ec0, 76, ...  (108, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 01597   424   NtReadVirtualMemory  (108, 0x241f18, 76, ...  (108, 0x241f18, 76, ... "\300\37$\0\300\36$\0\310\37$\0\310\36$\0\320\37$\0\254\36$\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%$\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01598   424   NtReadVirtualMemory  (108, 0x241fc0, 76, ...  (108, 0x241fc0, 76, ... "` $\0\30\37$\0h $\0 \37$\0p $\0(\37$\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37$\0\30\0\32\0\230\37$\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01599   424   NtReadVirtualMemory  (108, 0x242060, 76, ...  (108, 0x242060, 76, ... "\10!$\0\300\37$\0\20!$\0\310\37$\0\270!$\0\320\37$\0\0\04|\237"4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) 4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) == 0x0
 01600   424   NtReadVirtualMemory  (108, 0x242108, 76, ...  (108, 0x242108, 76, ... "\250!$\0` $\0\260!$\0h $\0\370"$\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) $\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01601   424   NtReadVirtualMemory  (108, 0x2421a8, 76, ...  (108, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) $\0\10!$\0P (108, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01602   424   NtReadVirtualMemory  (108, 0x242248, 76, ...  (108, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\250!$\0\360 (108, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (108, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01603   424   NtReadVirtualMemory  (108, 0x2422e8, 76, ...  (108, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\220#$\0P (108, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (108, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01604   424   NtReadVirtualMemory  (108, 0x242388, 76, ...  (108, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\00$$\0\360 (108, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) == 0x0
 01605   424   NtReadVirtualMemory  (108, 0x242428, 76, ...  (108, 0x242428, 76, ... "\320$$\0\210#$\0\330$$\0\220#$\0`8$\0\200%$\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$$\0\30\0\32\0\250$$\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01606   424   NtReadVirtualMemory  (108, 0x2424d0, 76, ...  (108, 0x2424d0, 76, ... "p%$\0($$\0x%$\00$$\0\20($\0\230#$\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#$\0\24\0\26\0\10$$\0\6@\10\0"\0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) \0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) == 0x0
 01607   424   NtReadVirtualMemory  (108, 0x242570, 76, ...  (108, 0x242570, 76, ... "\20&$\0\320$$\0\30&$\0\330$$\08$$\0\3002$\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%$\0\24\0\26\0P%$\0\6@\14\0\1\0\0\0<($\0T\37$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01608   424   NtReadVirtualMemory  (108, 0x242610, 76, ...  (108, 0x242610, 76, ... "\270&$\0p%$\0\300&$\0x%$\0\0/$\0x,$\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%$\0\24\0\26\0\360%$\0\6@\14\0\1\0\0\0\146$\0\14%$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01609   424   NtReadVirtualMemory  (108, 0x2426b8, 76, ...  (108, 0x2426b8, 76, ... "X'$\0\20&$\0`'$\0\30&$\00+$\0\220*$\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&$\0\30\0\32\0\220&$\0\6@\14\0\1\0\0\0\224'$\0D!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01610   424   NtReadVirtualMemory  (108, 0x242758, 76, ...  (108, 0x242758, 76, ... "\0($\0\270&$\0\10($\0\300&$\0H)$\0\260($\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'$\0\26\0\30\08'$\0\6@\10\0\1\0\0\0t)$\0\364&$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01611   424   NtReadVirtualMemory  (108, 0x242800, 76, ...  (108, 0x242800, 76, ... "\240($\0X'$\0\250($\0`'$\0\260($\0\340$$\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'$\0\30\0\32\0\330'$\0\6@\14\0\6\0\0\0\310Z\374w\254%$\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01612   424   NtReadVirtualMemory  (108, 0x2428a0, 76, ...  (108, 0x2428a0, 76, ... "8)$\0\0($\0@)$\0\10($\0h'$\0\20($\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X($\0\26\0\30\0\200($\0\6@\10\0\1\0\0\0\214.$\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01613   424   NtReadVirtualMemory  (108, 0x242938, 76, ...  (108, 0x242938, 76, ... "\330)$\0\240($\0\340)$\0\250($\0\350)$\0h'$\0\0\0\262v<-\262v\0P\1\06\08\0\370($\0\16\0\20\0 )$\0\6@\14\0\1\0\0\0`Z\374w\224'$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01614   424   NtReadVirtualMemory  (108, 0x2429d8, 76, ...  (108, 0x2429d8, 76, ... "\200*$\08)$\0\210*$\0@)$\0\220*$\0H)$\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\220)$\0\22\0\24\0\270)$\0\6@\10\0\7\0\0\0\274*$\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01615   424   NtReadVirtualMemory  (108, 0x242a80, 76, ...  (108, 0x242a80, 76, ... " +$\0\330)$\0(+$\0\340)$\0\310&$\0\350)$\0\0\0\22w\360+\23w\0\260\10\0@\0B\00*$\0\30\0\32\0X*$\0\6@\10\0\4\0\0\0\320Z\374w\24*$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01616   424   NtReadVirtualMemory  (108, 0x242b20, 76, ...  (108, 0x242b20, 76, ... "\300+$\0\200*$\0\310+$\0\210*$\0\320+$\0\310&$\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\330*$\0\26\0\30\0\0+$\0\6@\14\0\4\0\0\0L-$\0\344!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01617   424   NtReadVirtualMemory  (108, 0x242bc0, 76, ...  (108, 0x242bc0, 76, ... "h,$\0 +$\0p,$\0(+$\0x,$\00+$\0\0\0\277qp\21\277q\0\20\1\0<\0>\0x+$\0\24\0\26\0\240+$\0\6@\10\0\1\0\0\0\244,$\0\360Z\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01618   424   NtReadVirtualMemory  (108, 0x242c68, 76, ...  (108, 0x242c68, 76, ... "\20-$\0\300+$\0\30-$\0\310+$\0 &$\0\320+$\0\0\0gv8\25gv\0@\16\0@\0B\0\30,$\0\30\0\32\0@,$\0\6@\10\0\1\0\0\0l0$\0\374+$\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01619   424   NtReadVirtualMemory  (108, 0x242d10, 76, ...  (108, 0x242d10, 76, ... "\260-$\0h,$\0\270-$\0p,$\0\2001$\0\240/$\0\0\0\356v(\25\356v\0p\3\0@\0B\0\300,$\0\30\0\32\0\350,$\0\6@\14\0\2\0\0\0\354-$\0\+$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01620   424   NtReadVirtualMemory  (108, 0x242db0, 76, ...  (108, 0x242db0, 76, ... "P.$\0\20-$\0X.$\0\30-$\0@0$\0`.$\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0h-$\0\24\0\26\0\220-$\0\6@\14\0\2\0\0\0\350Z\374wL-$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01621   424   NtReadVirtualMemory  (108, 0x242e50, 76, ...  (108, 0x242e50, 76, ... "\360.$\0\260-$\0\370.$\0\270-$\0\300-$\0\0/$\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\10.$\0\24\0\26\00.$\0\6@\10\0\6\0\0\0,/$\0\334($\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01622   424   NtReadVirtualMemory  (108, 0x242ef0, 76, ...  (108, 0x242ef0, 76, ... "\220/$\0P.$\0\230/$\0X.$\0`.$\0 &$\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\250.$\0\26\0\30\0\320.$\0\6@\14\0\2\0\0\0\141$\0\214.$\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01623   424   NtReadVirtualMemory  (108, 0x242f90, 76, ...  (108, 0x242f90, 76, ... "00$\0\360.$\080$\0\370.$\0 -$\0\3400$\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0H/$\0\24\0\26\0p/$\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01624   424   NtReadVirtualMemory  (108, 0x243030, 76, ...  (108, 0x243030, 76, ... "\3200$\0\220/$\0\3300$\0\230/$\0\3400$\0\300-$\0\0\0-w\306@-w\00\6\0>\0@\0\350/$\0\26\0\30\0\200$\0\6@\14\0\6\0\0\0\2541$\0\244,$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01625   424   NtReadVirtualMemory  (108, 0x2430d0, 76, ...  (108, 0x2430d0, 76, ... "p1$\000$\0x1$\080$\0\240/$\0@0$\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2100$\0\22\0\24\0\2600$\0\6@\14\0\2\0\0\0\3542$\0,/$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01626   424   NtReadVirtualMemory  (108, 0x243170, 76, ...  (108, 0x243170, 76, ... "\202$\0\3200$\0\302$\0\3300$\0 2$\0 -$\0\0\0=w\24 ?w\0@\177\0>\0@\0(1$\0\26\0\30\0P1$\0\6@\10\0\1\0\0\0L2$\0l0$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01627   424   NtReadVirtualMemory  (108, 0x243210, 76, ...  (108, 0x243210, 76, ... "\2602$\0p1$\0\2702$\0x1$\0X3$\0\2001$\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3101$\0\26\0\30\0\3601$\0\6@\14\0\3\0\0\0\360Z\374w\2541$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01628   424   NtReadVirtualMemory  (108, 0x2432b0, 76, ...  (108, 0x2432b0, 76, ... "H3$\0\202$\0P3$\0\302$\0\200%$\0\2106$\0\0\0\332v\33"\333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) == 0x0
 01629   424   NtReadVirtualMemory  (108, 0x243348, 76, ...  (108, 0x243348, 76, ... "\3603$\0\2602$\0\3703$\0\2702$\0\2404$\0 2$\0\0\0\323v\0\0\0\0\0@\0\06\08\0\103$\0\16\0\20\003$\0\6@\0\0\1\0\0\0\2646$\0\3542$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01630   424   NtReadVirtualMemory  (108, 0x2433f0, 76, ...  (108, 0x2433f0, 76, ... "\2204$\0H3$\0\2304$\0P3$\0\3405$\0\2404$\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2403$\0\30\0\32\0\3103$\0\6@\14\0\1\0\0\0\3144$\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01631   424   NtReadVirtualMemory  (108, 0x243490, 76, ...  (108, 0x243490, 76, ... "05$\0\3603$\085$\0\3703$\0\04$\0X3$\0\0\0\362v\317\22\362v\0P\2\0<\0>\0H4$\0\24\0\26\0p4$\0\6@\14\0\1\0\0\0xZ\374w,4$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01632   424   NtReadVirtualMemory  (108, 0x243530, 76, ...  (108, 0x243530, 76, ... "\3205$\0\2204$\0\3305$\0\2304$\0(7$\0\3405$\0\0\0,vN\25,v\0\240\10\0>\0@\0\3504$\0\26\0\30\0\205$\0\6@\10\0\1\0\0\0\2148$\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01633   424   NtReadVirtualMemory  (108, 0x2435d0, 76, ...  (108, 0x2435d0, 76, ... "x6$\005$\0\2006$\085$\0@5$\0\04$\0\0\0*v\\20*v\0\360\0\0<\0>\0\2105$\0\24\0\26\0\2605$\0\6@\14\0\1\0\0\0\300Z\374wL&$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01634   424   NtReadVirtualMemory  (108, 0x243678, 76, ...  (108, 0x243678, 76, ... "\307$\0\3205$\0 7$\0\3305$\0\3002$\0(7$\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0(6$\0\30\0\32\0P6$\0\6@\0\0\1\0\0\0T7$\0\2043$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01635   424   NtReadVirtualMemory  (108, 0x243718, 76, ...  (108, 0x243718, 76, ... "P8$\0x6$\0X8$\0\2006$\0\2106$\0@5$\0\0\06v\240\206v\0\360\0\0<\0>\0\3206$\0\24\0\26\0\3706$\0\6@\10\0\2\0\0\0\20[\374w\2646$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01636   424   NtReadVirtualMemory  (108, 0x243850, 76, ...  (108, 0x243850, 76, ... "\3708$\0\307$\0\09$\0 7$\0\109$\08$$\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0p7$\0\30\0\32\0.8$\0\4@\14\20\2\0\0\049$\0l5$\02\376};\310W\24\0", 76, ) , 76, ) == 0x0
 01637   424   NtReadVirtualMemory  (108, 0x2438f8, 76, ...  (108, 0x2438f8, 76, ... "\2309$\0P8$\0\2409$\0X8$\0\2509$\0`8$\0\0\04wY\324w\0\260\10\0@\0B\0\2508$\0\30\0\32\0\3208$\0\4@\14\0\1\0\0\0pZ\374w\2148$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01638   424   NtReadVirtualMemory  (108, 0x243998, 76, ...  (108, 0x243998, 76, ... "\234\36$\0\3708$\0\244\36$\0\09$\0\254\36$\0\109$\0\0\0\247uM\31\247u\00\12\0>\0@\0P9$\0\26\0\30\0x9$\0\4@\14\0\1\0\0\0\0[\374w\204"$\0\30\376};\0\0\0\0", 76, ) $\0\30\376};\0\0\0\0", 76, ) == 0x0
 01639   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1636,ParentPid=660,}, 0x0, ) == 0x0
 01640   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 01641   424   NtReadVirtualMemory  (108, 0x241ea4, 4, ...  (108, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 01642   424   NtReadVirtualMemory  (108, 0x241ec0, 76, ...  (108, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 01643   424   NtReadVirtualMemory  (108, 0x205b8, 110, ...  (108, 0x205b8, 110, ... "C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0V\0M\0w\0a\0r\0e\0\\0V\0M\0w\0a\0r\0e\0 \0T\0o\0o\0l\0s\0\\0V\0M\0w\0a\0r\0e\0S\0e\0r\0v\0i\0c\0e\0.\0e\0x\0e\0\0\0", 110, ) , 110, ) == 0x0
 01644   424   NtClose  (108, ... ) == 0x0
 01645   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1852, 0}, ... 108, ) == 0x0
 01646   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1852,ParentPid=616,}, 0x0, ) == 0x0
 01647   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01648   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01649   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 01650   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01651   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0X"\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01652   424   NtReadVirtualMemory  (108, 0x182060, 76, ...  (108, 0x182060, 76, ... "\0!\30\0\300\37\30\0\10!\30\0\310\37\30\0\230#\30\0\20!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\14\0\377\377\0\0\254%\30\0\374\36\30\0\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01653   424   NtReadVirtualMemory  (108, 0x182100, 76, ...  (108, 0x182100, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0p \30\0\270!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\270 \30\0\22\0\24\0\340 \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01654   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01655   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01656   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\26\0\30\0\310 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01657   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01658   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\370"\30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) \30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) == 0x0
 01659   424   NtReadVirtualMemory  (108, 0x1824d0, 76, ...  (108, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\0\370"\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) \30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) == 0x0
 01660   424   NtReadVirtualMemory  (108, 0x182570, 76, ...  (108, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0(&\30\0\340$\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0(%\30\0\26\0\30\0P%\30\0\4@\10\0\2\0\0\0\0[\374w\234 \30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01661   424   NtReadVirtualMemory  (108, 0x182618, 76, ...  (108, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\4@\14\0\1\0\0\0\360Z\374w\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01662   424   NtReadVirtualMemory  (108, 0x1826b8, 76, ...  (108, 0x1826b8, 76, ... "\234\36\30\0\30&\30\0\244\36\30\0 &\30\0\254\36\30\0(&\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\4@\14\0\1\0\0\0\310Z\374wT\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01663   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1852,ParentPid=616,}, 0x0, ) == 0x0
 01664   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01665   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01666   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 01667   424   NtReadVirtualMemory  (108, 0x20598, 66, ...  (108, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0s\0e\0r\0i\0n\0i\0t\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 01668   424   NtClose  (108, ... ) == 0x0
 01669   424   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 108, ) == 0x0
 01670   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1888,ParentPid=1852,}, 0x0, ) == 0x0
 01671   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01672   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01673   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01674   424   NtReadVirtualMemory  (108, 0x181f18, 76, ...  (108, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\41\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01675   424   NtReadVirtualMemory  (108, 0x181fc0, 76, ...  (108, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01676   424   NtReadVirtualMemory  (108, 0x182060, 76, ...  (108, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\264/\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01677   424   NtReadVirtualMemory  (108, 0x182108, 76, ...  (108, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01678   424   NtReadVirtualMemory  (108, 0x1821a8, 76, ...  (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0|:\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (108, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0|:\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01679   424   NtReadVirtualMemory  (108, 0x182248, 76, ...  (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (108, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01680   424   NtReadVirtualMemory  (108, 0x1822e8, 76, ...  (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (108, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 01681   424   NtReadVirtualMemory  (108, 0x182388, 76, ...  (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (108, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 01682   424   NtReadVirtualMemory  (108, 0x182428, 76, ...  (108, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\340#\30\0\26\0\30\0\10$\30\0\6@\10\0\377\377\0\0\364&\30\0\304#\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01683   424   NtReadVirtualMemory  (108, 0x1824c8, 76, ...  (108, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\08$\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0\254%\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01684   424   NtReadVirtualMemory  (108, 0x182570, 76, ...  (108, 0x182570, 76, ... "\30&\30\0\310$\30\0 &\30\0\320$\30\0(&\30\0\330$\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\320Z\374w\4%\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01685   424   NtReadVirtualMemory  (108, 0x182618, 76, ...  (108, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\370u\265*\370u\0\300\17\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\377\377\0\0hZ\374whZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01686   424   NtReadVirtualMemory  (108, 0x1826b8, 76, ...  (108, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0h'\30\0(&\30\0\0\0\234v=\5\235v\0\220\24\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\6@\14\0\377\377\0\0\24/\30\0d$\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01687   424   NtReadVirtualMemory  (108, 0x182758, 76, ...  (108, 0x182758, 76, ... "\220(\30\0\270&\30\0\230(\30\0\300&\30\0\240(\30\0\310&\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\377\377\0\0\324-\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01688   424   NtReadVirtualMemory  (108, 0x182890, 76, ...  (108, 0x182890, 76, ... "8)\30\0X'\30\0@)\30\0`'\30\0H)\30\0h'\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\260'\30\0\30\0\32\0n(\30\0\4@\14\20\14\0\0\0t)\30\0pZ\374w2\376};(=\10\0", 76, ) , 76, ) == 0x0
 01689   424   NtReadVirtualMemory  (108, 0x182938, 76, ...  (108, 0x182938, 76, ... "\330)\30\0\220(\30\0\340)\30\0\230(\30\0\350)\30\0\240(\30\0\0\04wY\324w\0\260\10\0@\0B\0\350(\30\0\30\0\32\0\20)\30\0\4@\14\0\4\0\0\0\264*\30\0\314(\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01690   424   NtReadVirtualMemory  (108, 0x1829d8, 76, ...  (108, 0x1829d8, 76, ... "x*\30\08)\30\0\200*\30\0@)\30\0(+\30\0H)\30\0\0\0\364u\320\21\364u\0\320\1\0>\0@\0\220)\30\0\26\0\30\0\270)\30\0\4@\10\0\1\0\0\0\0\30\0D!\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01691   424   NtReadVirtualMemory  (108, 0x182a78, 76, ...  (108, 0x182a78, 76, ... "\30+\30\0\330)\30\0 +\30\0\340)\30\0\10-\30\0\310+\30\0\0\0\375v%0\375v\0\200\7\0>\0@\00*\30\0\26\0\30\0X*\30\0\4@\14\0\2\0\0\0T+\30\0t)\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01692   424   NtReadVirtualMemory  (108, 0x182b18, 76, ...  (108, 0x182b18, 76, ... "\270+\30\0x*\30\0\300+\30\0\200*\30\0\310+\30\0\350)\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320*\30\0\24\0\26\0\370*\30\0\6@\14\0\2\0\0\0\224,\30\0\264*\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01693   424   NtReadVirtualMemory  (108, 0x182bb8, 76, ...  (108, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0\210*\30\0(+\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0p+\30\0\26\0\30\0\230+\30\0\6@\10\0\3\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01694   424   NtReadVirtualMemory  (108, 0x182c58, 76, ...  (108, 0x182c58, 76, ... "\370,\30\0\270+\30\0\0-\30\0\300+\30\0\350.\30\0\10-\30\0\0\0bv\316\26bv\0\340\4\0:\0<\0\20,\30\0\22\0\24\08,\30\0\4@\14\0\1\0\0\04-\30\0T+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01695   424   NtReadVirtualMemory  (108, 0x182cf8, 76, ...  (108, 0x182cf8, 76, ... "8.\30\0X,\30\0@.\30\0`,\30\0h,\30\0\210*\30\0\0\0`v\20\22`v\0\260\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\6@\10\0\1\0\0\0\3144\30\0\224,\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01696   424   NtReadVirtualMemory  (108, 0x182e38, 76, ...  (108, 0x182e38, 76, ... "\330.\30\0\370,\30\0\340.\30\0\0-\30\0\250-\30\0\210/\30\0\0\0c[\237qd[\0\0\7\0>\0@\0\360-\30\0\26\0\30\0\30.\30\0\4@\14\0\1\0\0\0d<\30\0\370Z\374w\267\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01697   424   NtReadVirtualMemory  (108, 0x182ed8, 76, ...  (108, 0x182ed8, 76, ... "x/\30\08.\30\0\200/\30\0@.\30\0\210/\30\0h,\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\220.\30\0\26\0\30\0\270.\30\0\6@\14\0\6\0\0\0\2441\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01698   424   NtReadVirtualMemory  (108, 0x182f78, 76, ...  (108, 0x182f78, 76, ... "\230-\30\0\330.\30\0\240-\30\0\340.\30\0H.\30\0\350.\30\0\0\08v4\208v\0P\0\0>\0@\00/\30\0\26\0\30\0X/\30\0\6@\14\0\1\0\0\0\3647\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01699   424   NtReadVirtualMemory  (108, 0x182d98, 76, ...  (108, 0x182d98, 76, ... " 0\30\0x/\30\0(0\30\0\200/\30\000\30\0H.\30\0\0\0\247uM\31\247u\00\12\0>\0@\0P-\30\0\26\0\30\0x-\30\0\4@\14\0\4\0\0\0\0[\374w\224'\30\0\30\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01700   424   NtReadVirtualMemory  (108, 0x183020, 76, ...  (108, 0x183020, 76, ... "\3100\30\0\230-\30\0\3200\30\0\240-\30\0\3300\30\0\250-\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0\320/\30\0\30\0\32\0\370/\30\0\4@\14\0\1\0\0\0\2043\30\0\24*\30\00\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01701   424   NtReadVirtualMemory  (108, 0x1830c8, 76, ...  (108, 0x1830c8, 76, ... "h1\30\0 0\30\0p1\30\0(0\30\0x1\30\000\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x0\30\0\30\0\32\0\2400\30\0\4@\14\0\13\0\0\0\3542\30\0T\37\30\03\376};(=\10\0", 76, ) , 76, ) == 0x0
 01702   424   NtReadVirtualMemory  (108, 0x183168, 76, ...  (108, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\4@\10\0\2\0\0\0L2\30\0\24/\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01703   424   NtReadVirtualMemory  (108, 0x183210, 76, ...  (108, 0x183210, 76, ... "\2602\30\0h1\30\0\2702\30\0p1\30\0X3\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\4@\10\0\2\0\0\0\360Z\374w\2441\30\0\25\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01704   424   NtReadVirtualMemory  (108, 0x1832b0, 76, ...  (108, 0x1832b0, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0\2404\30\0X3\30\0\0\0\231v\250\22\231v\0@\2\0>\0@\0h2\30\0\26\0\30\0\2202\30\0\4@\14\0\2\0\0\0,4\30\0\41\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01705   424   NtReadVirtualMemory  (108, 0x183348, 76, ...  (108, 0x183348, 76, ... "\3603\30\0\2602\30\0\3703\30\0\2702\30\0\3002\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0\103\30\0\16\0\20\003\30\0\6@\14\0\3\0\0\0\2348\30\0\0\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01706   424   NtReadVirtualMemory  (108, 0x1833f0, 76, ...  (108, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\210B\30\0\2106\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\4@\14\0\1\0\0\0T7\30\0\3542\30\0\27\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01707   424   NtReadVirtualMemory  (108, 0x183490, 76, ...  (108, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\3405\30\0\3002\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0H4\30\0\24\0\26\0p4\30\0\6@\14\0\1\0\0\0$@\30\04-\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01708   424   NtReadVirtualMemory  (108, 0x183530, 76, ...  (108, 0x183530, 76, ... "\3205\30\0\2204\30\0\3305\30\0\2304\30\0\2609\30\0\3405\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\10\0\7\0\0\0\146\30\0\20[\374w1\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01709   424   NtReadVirtualMemory  (108, 0x1835d0, 76, ...  (108, 0x1835d0, 76, ... "x6\30\005\30\0\2006\30\085\30\0@5\30\0\2404\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\2105\30\0\26\0\30\0\2605\30\0\6@\14\0\2\0\0\0\3349\30\0l5\30\02\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01710   424   NtReadVirtualMemory  (108, 0x183678, 76, ...  (108, 0x183678, 76, ... "\307\30\0\3205\30\0 7\30\0\3305\30\0\04\30\0(7\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0(6\30\0\30\0\32\0P6\30\0\6@\14\0\3\0\0\0\4D\30\0\240Z\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01711   424   NtReadVirtualMemory  (108, 0x183718, 76, ...  (108, 0x183718, 76, ... "\2707\30\0x6\30\0\3007\30\0\2006\30\0\2106\30\0x=\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\310Z\374w,4\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01712   424   NtReadVirtualMemory  (108, 0x1837b8, 76, ...  (108, 0x1837b8, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\230;\30\0P:\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0p7\30\0\24\0\26\0\2307\30\0\6@\14\0\1\0\0\0\304@\30\0\264/\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01713   424   NtReadVirtualMemory  (108, 0x183860, 76, ...  (108, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0P:\30\0\209\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\208\30\0\30\0\32\088\30\0\6@\14\0\1\0\0\0<9\30\0\2043\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01714   424   NtReadVirtualMemory  (108, 0x183900, 76, ...  (108, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0p8\30\0\2609\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\1\0\0\0DE\30\0\2348\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01715   424   NtReadVirtualMemory  (108, 0x1839a0, 76, ...  (108, 0x1839a0, 76, ... "@:\30\0\09\30\0H:\30\0\109\30\0\209\30\0@5\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X9\30\0\26\0\30\0\2009\30\0\6@\10\0\1\0\0\0\4=\30\0\146\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01716   424   NtReadVirtualMemory  (108, 0x183a40, 76, ...  (108, 0x183a40, 76, ... "\350:\30\0\2409\30\0\360:\30\0\2509\30\0\3107\30\0p8\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\6@\14\0\4\0\0\0$;\30\0\344!\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01717   424   NtReadVirtualMemory  (108, 0x183ae8, 76, ...  (108, 0x183ae8, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\20>\30\08<\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\230:\30\0\30\0\32\0\300:\30\0\6@\14\0\2\0\0\0\304;\30\0|:\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01718   424   NtReadVirtualMemory  (108, 0x183b88, 76, ...  (108, 0x183b88, 76, ... "(<\30\0\350:\30\00<\30\0\360:\30\0\330<\30\0\3107\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0@;\30\0\24\0\26\0h;\30\0\6@\14\0\2\0\0\0\244D\30\0$;\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01719   424   NtReadVirtualMemory  (108, 0x183c28, 76, ...  (108, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\370:\30\0\330<\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\340;\30\0\24\0\26\0\10<\30\0\6@\10\0\2\0\0\0\370Z\374wt.\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01720   424   NtReadVirtualMemory  (108, 0x183cc8, 76, ...  (108, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\230;\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\200<\30\0\22\0\24\0\250<\30\0\6@\14\0\2\0\0\0\244=\30\0\3349\30\0\23\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01721   424   NtReadVirtualMemory  (108, 0x183d68, 76, ...  (108, 0x183d68, 76, ... "\0>\30\0\310<\30\0\10>\30\0\320<\30\0(7\30\0@A\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0 =\30\0\24\0\26\0H=\30\0\6@\14\0\1\0\0\0<>\30\0\4=\30\0\21\376};\330Z\10\0", 76, ) \333v\0\0\3\0<\0>\0 =\30\0\24\0\26\0H=\30\0\6@\14\0\1\0\0\0<>\30\0\4=\30\0\21\376};\330Z\10\0", 76, ) == 0x0
 01722   424   NtReadVirtualMemory  (108, 0x183e00, 76, ...  (108, 0x183e00, 76, ... "\250>\30\0h=\30\0\260>\30\0p=\30\0X?\30\0\370:\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\300=\30\0\16\0\20\0\350=\30\0\6@\0\0\1\0\0\0lA\30\0\244=\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01723   424   NtReadVirtualMemory  (108, 0x183ea8, 76, ...  (108, 0x183ea8, 76, ... "H?\30\0\0>\30\0P?\30\0\10>\30\0\230@\30\0X?\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0X>\30\0\30\0\32\0\200>\30\0\6@\14\0\1\0\0\0\204?\30\0xZ\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01724   424   NtReadVirtualMemory  (108, 0x183f48, 76, ...  (108, 0x183f48, 76, ... "\350?\30\0\250>\30\0\360?\30\0\260>\30\0\270>\30\0\20>\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\0?\30\0\24\0\26\0(?\30\0\6@\14\0\1\0\0\0xZ\374w\344>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01725   424   NtReadVirtualMemory  (108, 0x183fe8, 76, ...  (108, 0x183fe8, 76, ... "\210@\30\0H?\30\0\220@\30\0P?\30\0\340A\30\0\230@\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240?\30\0\26\0\30\0\310?\30\0\6@\10\0\4\0\0\0,G\30\0\3144\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01726   424   NtReadVirtualMemory  (108, 0x184088, 76, ...  (108, 0x184088, 76, ... "0A\30\0\350?\30\08A\30\0\360?\30\0\370?\30\0\270>\30\0\0\0*v\\20*v\0\360\0\0<\0>\0@@\30\0\24\0\26\0h@\30\0\6@\14\0\5\0\0\0\344E\30\0\3647\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01727   424   NtReadVirtualMemory  (108, 0x184130, 76, ...  (108, 0x184130, 76, ... "\320A\30\0\210@\30\0\330A\30\0\220@\30\0x=\30\0\340A\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\340@\30\0\30\0\32\0\10A\30\0\6@\0\0\1\0\0\0\14B\30\0<>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01728   424   NtReadVirtualMemory  (108, 0x1841d0, 76, ...  (108, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0@A\30\0\370?\30\0\0\06v\240\206v\0\360\0\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\6@\10\0\2\0\0\0\C\30\0lA\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 01729   424   NtReadVirtualMemory  (108, 0x184278, 76, ...  (108, 0x184278, 76, ... " C\30\0\320A\30\0(C\30\0\330A\30\0\330C\30\0\04\30\0\0\0\230v\264\20\230v\0p\0\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\270Z\374w\270Z\374w\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01730   424   NtReadVirtualMemory  (108, 0x184320, 76, ...  (108, 0x184320, 76, ... "\310C\30\0xB\30\0\320C\30\0\200B\30\0xD\30\0\330C\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\4@\14\0\1\0\0\0\204F\30\0\14B\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01731   424   NtReadVirtualMemory  (108, 0x1843c8, 76, ...  (108, 0x1843c8, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\00C\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0xC\30\0\30\0\32\0\240C\30\0\6@\14\0\1\0\0\0\240Z\374w\2646\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01732   424   NtReadVirtualMemory  (108, 0x184468, 76, ...  (108, 0x184468, 76, ... "\10E\30\0\310C\30\0\20E\30\0\320C\30\0\30E\30\00C\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0 D\30\0\24\0\26\0HD\30\0\4@\14\0\1\0\0\0\350Z\374w\304;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 01733   424   NtReadVirtualMemory  (108, 0x184508, 76, ...  (108, 0x184508, 76, ... "\250E\30\0hD\30\0\260E\30\0pD\30\0\270E\30\0xD\30\0\0\0\353p\240.\353p\0p\0\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\1\0\0\0`Z\374w<9\30\0q\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01734   424   NtReadVirtualMemory  (108, 0x1845a8, 76, ...  (108, 0x1845a8, 76, ... "HF\30\0\10E\30\0PF\30\0\20E\30\0\0G\30\0\30E\30\0\0\0_`(;_`\0\320\0\0<\0>\0`E\30\0\24\0\26\0\210E\30\0\4@\10\0\1\0\0\0\300Z\374w\304@\30\0\357\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01735   424   NtReadVirtualMemory  (108, 0x184648, 76, ...  (108, 0x184648, 76, ... "\360F\30\0\250E\30\0\370F\30\0\260E\30\0\254\36\30\0\0G\30\0\0\0\352t\360\24\352t\0\0\1\0<\0>\0\0F\30\0\24\0\26\0(F\30\0\4@\10\0\1\0\0\0\20[\374w\C\30\0\37\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01736   424   NtReadVirtualMemory  (108, 0x1846f0, 76, ...  (108, 0x1846f0, 76, ... "\234\36\30\0HF\30\0\244\36\30\0PF\30\0XF\30\0\270E\30\0\0\0;v\0\26;v\0P\4\0@\0B\0\240F\30\0\30\0\32\0\310F\30\0\6@\14\0\1\0\0\0pZ\374w$@\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 01737   424   NtQueryInformationProcess  (108, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1888,ParentPid=1852,}, 0x0, ) == 0x0
 01738   424   NtReadVirtualMemory  (108, 0x7ffdf00c, 4, ...  (108, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 01739   424   NtReadVirtualMemory  (108, 0x181ea4, 4, ...  (108, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 01740   424   NtReadVirtualMemory  (108, 0x181ec0, 76, ...  (108, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 01741   424   NtReadVirtualMemory  (108, 0x20584, 48, ...  (108, 0x20584, 48, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0E\0x\0p\0l\0o\0r\0e\0r\0.\0E\0X\0E\0\0\0", 48, ) , 48, ) == 0x0
 01742   424   NtOpenProcess  (0x1f0fff, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 104, ) == 0x0
 01743   424   NtCreateSection  (0xf0007, 0x0, {45056, 0}, 4, 134217728, 0, ... 112, ) == 0x0
 01744   424   NtMapViewOfSection  (112, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x870000), {0, 0}, 45056, ) == 0x0
 01745   424   NtMapViewOfSection  (112, 104, (0x0), 0, 0, 0x0, 45056, 1, 0, 4, ... (0xe70000), 0x0, 45056, ) == 0x0
 01746   424   NtAllocateVirtualMemory  (104, 0, 0, 1048576, 8192, 4, ... 20774912, 1048576, ) == 0x0
 01747   424   NtAllocateVirtualMemory  (104, 21815296, 0, 8192, 4096, 4, ... 21815296, 8192, ) == 0x0
 01748   424   NtProtectVirtualMemory  (104, (0x14ce000), 4096, 260, ... (0x14ce000), 4096, 4, ) == 0x0
 01749   424   NtCreateThread  (0x1f03ff, 0x0, 104, 1243204, 1243920, 1, ... 116, {1888, 588}, ) == 0x0
 01750   424   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1332920, 0, 2010004014, 1332616}  (24, {28, 56, new_msg, 0, 1332920, 0, 2010004014, 1332616} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\0\0\0`\7\0\0L\2\0\0" ... {28, 56, reply, 0, 420, 424, 1493, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\0\0\0`\7\0\0L\2\0\0" )  ... {28, 56, reply, 0, 420, 424, 1493, 0}  (24, {28, 56, new_msg, 0, 1332920, 0, 2010004014, 1332616} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\0\0\0`\7\0\0L\2\0\0" ... {28, 56, reply, 0, 420, 424, 1493, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\0\0\0`\7\0\0L\2\0\0" )  ) == 0x0
 01751   424   NtResumeThread  (116, ... 1, ) == 0x0
 01752   424   NtClose  (116, ... ) == 0x0
 01753   424   NtUnmapViewOfSection  (-1, 0x870000, ... ) == 0x0
 01754   424   NtClose  (112, ... ) == 0x0
 01755   424   NtClose  (104, ... ) == 0x0
 01756   424   NtTerminateProcess  (0, 0, ... ) == 0x0
 01757   424   NtFreeVirtualMemory  (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED
 01758   424   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 420, 424, 1494, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 420, 424, 1494, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 420, 424, 1494, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01759   424   NtTerminateProcess  (-1, 0, ...
 01760   424   NtClose  (44, ... ) == 0x0