Summary:


NtCallbackReturn(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 1 
NtOpenThreadTokenEx(>) 
 2 
NtRequestWaitReplyPort(>) 
 5 

NtCreateFile(>) 
 1 
NtResumeThread(>) 
 1 
NtQueryDefaultLocale(>) 
 2 
NtCreateEvent(>) 
 6 

NtCreateThread(>) 
 1 
NtSecureConnectPort(>) 
 1 
NtQuerySection(>) 
 2 
NtProtectVirtualMemory(>) 
 7 

NtGdiCreateBitmap(>) 
 1 
NtTestAlert(>) 
 1 
NtQueryVirtualMemory(>) 
 2 
NtQuerySystemInformation(>) 
 9 

NtGdiInit(>) 
 1 
NtUnmapViewOfSection(>) 
 1 
NtSetInformationFile(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserCallNoParam(>) 
 1 
NtSetInformationObject(>) 
 2 
NtOpenSection(>) 
 12 

NtGdiSelectBitmap(>) 
 1 
NtUserGetThreadDesktop(>) 
 1 
NtTerminateProcess(>) 
 2 
NtQueryValueKey(>) 
 12 

NtOpenDirectoryObject(>) 
 1 
NtWriteFile(>) 
 1 
NtCreateSection(>) 
 3 
NtMapViewOfSection(>) 
 13 

NtOpenKeyedEvent(>) 
 1 
NtContinue(>) 
 2 
NtDuplicateObject(>) 
 3 
NtOpenProcess(>) 
 15 

NtOpenMutant(>) 
 1 
NtCreateIoCompletion(>) 
 2 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserRegisterClassExWOW(>) 
 15 

NtOpenSymbolicLinkObject(>) 
 1 
NtFlushInstructionCache(>) 
 2 
NtOpenProcessToken(>) 
 3 
NtAllocateVirtualMemory(>) 
 18 

NtQueryObject(>) 
 1 
NtFreeVirtualMemory(>) 
 2 
NtSetInformationThread(>) 
 3 
NtOpenKey(>) 
 21 

NtQuerySymbolicLinkObject(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFsControlFile(>) 
 4 
NtQueryInformationProcess(>) 
 29 

NtQuerySystemTime(>) 
 1 
NtOpenFile(>) 
 2 
NtQueryAttributesFile(>) 
 4 
NtClose(>) 
 48 

NtQueryVolumeInformationFile(>) 
 1 
NtOpenProcessTokenEx(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtReadVirtualMemory(>) 
 694 

NtReadFile(>) 
 1 
NtOpenThreadToken(>) 
 2 
NtQueryInformationToken(>) 
 5 

Trace:
 00001   484   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   484   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   484   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   484   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   484   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   484   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   484   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   484   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   484   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   484   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   484   NtClose  (12, ... ) == 0x0
 00014   484   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   484   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   484   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   484   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   484   NtClose  (16, ... ) == 0x0
 00021   484   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   484   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   484   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   484   NtClose  (16, ... ) == 0x0
 00026   484   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   484   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   484   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   484   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 480, 484, 1512, 0} "`\266\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 480, 484, 1512, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 480, 484, 1512, 0} "`\266\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   484   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   484   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   484   NtClose  (16, ... ) == 0x0
 00036   484   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   484   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   484   NtClose  (28, ... ) == 0x0
 00041   484   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   484   NtClose  (28, ... ) == 0x0
 00045   484   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   484   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   484   NtClose  (28, ... ) == 0x0
 00049   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   484   NtClose  (28, ... ) == 0x0
 00052   484   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   484   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 480, 484, 1535, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 480, 484, 1535, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 480, 484, 1535, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   484   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 8, ) == 0x0
 00057   484   NtProtectVirtualMemory  (-1, (0x408000), 4096, 8, ... (0x408000), 4096, 4, ) == 0x0
 00058   484   NtFlushInstructionCache  (-1, 4227072, 4096, ... ) == 0x0
 00059   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00061   484   NtClose  (28, ... ) == 0x0
 00062   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   484   NtClose  (28, ... ) == 0x0
 00065   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00067   484   NtClose  (28, ... ) == 0x0
 00068   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   484   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00070   484   NtClose  (28, ... ) == 0x0
 00071   484   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 4, ) == 0x0
 00072   484   NtProtectVirtualMemory  (-1, (0x408000), 4096, 4, ... (0x408000), 4096, 4, ) == 0x0
 00073   484   NtFlushInstructionCache  (-1, 4227072, 4096, ... ) == 0x0
 00074   484   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00075   484   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00076   484   NtClose  (28, ... ) == 0x0
 00077   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00078   484   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00079   484   NtClose  (28, ... ) == 0x0
 00080   484   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00081   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00082   484   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00083   484   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00084   484   NtClose  (28, ... ) == 0x0
 00085   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00086   484   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087   484   NtClose  (28, ... ) == 0x0
 00088   484   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00089   484   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00090   484   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00092   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 480, 484, 1546, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 480, 484, 1546, 0}  (24, {28, 56, new_msg, 0, 2, 2147347448, 1246412, 0} "\210\6\31\1\0\0\0\0\314\4\23\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 480, 484, 1546, 0} "XQ\26\0\0\0\0\0\0\0\0\0!\215\30\34\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00093   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094   484   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00095   484   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00096   484   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00097   484   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482208, ) == 0x0
 00098   484   NtQueryInformationToken  (-2147482208, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00099   484   NtQueryInformationToken  (-2147482208, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00100   484   NtClose  (-2147482208, ... ) == 0x0
 00101   484   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00102   484   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00103   484   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00104   484   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00105   484   NtQueryValueKey  (-2147482208,  (-2147482208, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00106   484   NtClose  (-2147482208, ... ) == 0x0
 00107   484   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00108   484   NtQueryValueKey  (-2147482208,  (-2147482208, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00109   484   NtClose  (-2147482208, ... ) == 0x0
 00110   484   NtQueryDefaultLocale  (0, -130840052, ... ) == 0x0
 00111   484   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00112   484   NtUserCallNoParam  (24, ... ) == 0x0
 00113   484   NtGdiCreateCompatibleDC  (0, ...
 00114   484   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00113   484   NtGdiCreateCompatibleDC  ... ) == 0x1a010390
 00115   484   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00116   484   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00117   484   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x90503ea
 00118   484   NtGdiCreateSolidBrush  (0, 0, ...
 00119   484   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8519680, 4096, ) == 0x0
 00118   484   NtGdiCreateSolidBrush  ... ) == 0x4c1003db
 00120   484   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00121   484   NtGdiCreateCompatibleDC  (0, ... ) == 0xb0103f8
 00122   484   NtGdiSelectBitmap  (184615928, 151323626, ... ) == 0x185000f
 00123   484   NtUserGetThreadDesktop  (484, 0, ... ) == 0x2c
 00124   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00125   484   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00126   484   NtClose  (52, ... ) == 0x0
 00127   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00128   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810cc017
 00129   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00130   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810cc01c
 00131   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00132   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810cc01e
 00133   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00134   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810c8002
 00135   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00136   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810cc018
 00137   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00138   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810cc01a
 00139   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00140   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810cc01d
 00141   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810cc026
 00143   484   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00144   484   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810cc019
 00145   484   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ...
 00146   484   NtAllocateVirtualMemory  (-1, 5472256, 0, 4096, 4096, 32, ... 5472256, 4096, ) == 0x0
 00145   484   NtUserRegisterClassExWOW  ... ) == 0x810cc020
 00147   484   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc022
 00148   484   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc023
 00149   484   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc024
 00150   484   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc025
 00151   484   NtCallbackReturn  (0, 0, 0, ...
 00152   484   NtGdiInit  (... ) == 0x1
 00153   484   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00154   484   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00155   484   NtTestAlert  (... ) == 0x0
 00156   484   NtContinue  (1244464, 1, ...
 00157   484   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x407240,}, 4, ... ) == 0x0
 00158   484   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00159   484   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00160   484   NtClose  (52, ... ) == 0x0
 00161   484   NtProtectVirtualMemory  (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0
 00162   484   NtProtectVirtualMemory  (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0
 00163   484   NtOpenProcessToken  (-1, 0x20, ... 52, ) == 0x0
 00164   484   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00165   484   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00166   484   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 56, ) }, ... 56, ) == 0x0
 00167   484   NtQueryValueKey  (56,  (56, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00168   484   NtClose  (56, ... ) == 0x0
 00169   484   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00170   484   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 56, ) == 0x0
 00171   484   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00172   484   NtQuerySystemTime  (... {718293472, 29868093}, ) == 0x0
 00173   484   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00174   484   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00175   484   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00176   484   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00177   484   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00178   484   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00179   484   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00180   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00181   484   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 76, ) }, ... 76, ) == 0x0
 00182   484   NtOpenKey  (0x20019, {24, 76, 0x40, 0, 0,  (0x20019, {24, 76, 0x40, 0, 0, "ActiveComputerName"}, ... 80, ) }, ... 80, ) == 0x0
 00183   484   NtQueryValueKey  (80,  (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (80, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00184   484   NtClose  (80, ... ) == 0x0
 00185   484   NtClose  (76, ... ) == 0x0
 00186   484   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 76, ) == 0x0
 00187   484   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 80, ) == 0x0
 00188   484   NtDuplicateObject  (-1, 76, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00189   484   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00190   484   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 88, ) == 0x0
 00191   484   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00192   484   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00193   484   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00194   484   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242964,  (0xc0100080, {24, 0, 0x40, 0, 1242964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 92, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 92, {status=0x0, info=1}, ) == 0x0
 00195   484   NtSetInformationFile  (92, 1243020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00196   484   NtSetInformationFile  (92, 1243012, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00197   484   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00198   484   NtWriteFile  (92, 69, 0, 0,  (92, 69, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00199   484   NtReadFile  (92, 69, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (92, 69, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20v\37\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00200   484   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20v\37\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\376\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20v\37\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00201   484   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0\13b\34d0,\334\21\261\306\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\13b\34d0,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 88, 1024, ... {status=0x103, info=48},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\2\0\0\0@\0\0\0\0\0\37\0\0\0\0\0\13b\34d0,\334\21\261\306\0\14)\371\246\305\30\0\32\0\3608\24\0\15\0\0\0\0\0\0\0\14\0\0\0a\0d\0v\0a\0p\0i\03\02\0.\0d\0l\0l\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\13b\34d0,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 00202   484   NtFsControlFile  (92, 69, 0x0, 0x0, 0x11c017,  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\13b\34d0,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , 44, 1024, ... {status=0x103, info=36},  (92, 69, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\13b\34d0,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\0\0\300", ) , ) == 0x103
 00203   484   NtClose  (88, ... ) == 0x0
 00204   484   NtClose  (92, ... ) == 0x0
 00205   484   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "psapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00206   484   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00207   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\psapi.dll"}, 1237820, ... ) }, 1237820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00208   484   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "psapi.dll"}, 1237820, ... ) }, 1237820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00209   484   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 1237820, ... ) }, 1237820, ... ) == 0x0
 00210   484   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00211   484   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00212   484   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00213   484   NtOpenProcessToken  (-1, 0x8, ... 96, ) == 0x0
 00214   484   NtQueryInformationToken  (96, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00215   484   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00216   484   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 100, ) }, ... 100, ) == 0x0
 00217   484   NtQueryValueKey  (100,  (100, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (100, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00218   484   NtClose  (100, ... ) == 0x0
 00219   484   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00220   484   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00221   484   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00222   484   NtClose  (100, ... ) == 0x0
 00223   484   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224   484   NtClose  (96, ... ) == 0x0
 00225   484   NtClose  (92, ... ) == 0x0
 00226   484   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bf0000), 0x0, 45056, ) == 0x0
 00227   484   NtClose  (88, ... ) == 0x0
 00228   484   NtAllocateVirtualMemory  (-1, 1335296, 0, 36864, 4096, 4, ... 1335296, 36864, ) == 0x0
 00229   484   NtQuerySystemInformation  (ProcessesAndThreads, 32768, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00230   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {4, 0}, ... 88, ) == 0x0
 00231   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x0,AffinityMask=0x1,BasePriority=8,Pid=4,ParentPid=0,}, 0x0, ) == 0x0
 00232   484   NtReadVirtualMemory  (88, 0xc, 4, ...
 00233   484   NtContinue  (-130843492, 0, ...
 00232   484   NtReadVirtualMemory  ... ) == STATUS_PARTIAL_COPY
 00234   484   NtClose  (88, ... ) == 0x0
 00235   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {356, 0}, ... 88, ) == 0x0
 00236   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00237   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00238   484   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00239   484   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00240   484   NtReadVirtualMemory  (88, 0x261f18, 76, ...  (88, 0x261f18, 76, ... "\234\36&\0\300\36&\0\244\36&\0\310\36&\0\254\36&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00241   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=11,Pid=356,ParentPid=4,}, 0x0, ) == 0x0
 00242   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00243   484   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00244   484   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0XH\316\231XH\0\340\0\0:\0\10\2\240\6\21\0\20\0\22\0\312\6\21\0\0P\0\0\377\377\0\0\360Z\374w\360Z\374w{\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00245   484   NtReadVirtualMemory  (88, 0x1106a0, 60, ...  (88, 0x1106a0, 60, ... "\\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0m\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00246   484   NtClose  (88, ... ) == 0x0
 00247   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {592, 0}, ... 88, ) == 0x0
 00248   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 00249   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00250   484   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00251   484   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00252   484   NtReadVirtualMemory  (88, 0x261f18, 76, ...  (88, 0x261f18, 76, ... "\270\37&\0\300\36&\0\300\37&\0\310\36&\0\310\37&\0\254\36&\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\4\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00253   484   NtReadVirtualMemory  (88, 0x261fb8, 76, ...  (88, 0x261fb8, 76, ... "X &\0\30\37&\0` &\0 \37&\0h &\0(\37&\0\0\0\264u\0\0\0\0\0\240\0\0<\0>\0p\37&\0\24\0\26\0\230\37&\0\6@\0\0\377\377\0\0pZ\374w\374\36&\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00254   484   NtReadVirtualMemory  (88, 0x262058, 76, ...  (88, 0x262058, 76, ... "\370 &\0\270\37&\0\0!&\0\300\37&\0P"&\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) &\0\310\37&\0\0\0\265u\0\0\0\0\0\340\0\0>\0@\0\20 &\0\26\0\30\08 &\0\4@\0\0\3\0\0\0hZ\374whZ\374w\30\376};\0\0\0\0", 76, ) == 0x0
 00255   484   NtReadVirtualMemory  (88, 0x2620f8, 76, ...  (88, 0x2620f8, 76, ... "\230!&\0X &\0\240!&\0` &\0\320$&\0\250!&\0\0\0\266u\0\0\0\0\0`\4\0<\0>\0\260 &\0\24\0\26\0\330 &\0\4@\0\0\2\0\0\0\20[\374w\20[\374w\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00256   484   NtReadVirtualMemory  (88, 0x262198, 76, ...  (88, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\370 &\0H (88, 0x262198, 76, ... "@"&\0\370 &\0H"&\0\0!&\0\10!&\0\360"&\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\324wKQ\324w\0\320\10\0<\0>\0P!&\0\24\0\26\0x!&\0\6@\14\0\6\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00257   484   NtReadVirtualMemory  (88, 0x262240, 76, ...  (88, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\230!&\0\350 (88, 0x262240, 76, ... "\340"&\0\230!&\0\350"&\0\240!&\08$&\0h &\0\0\0\346wA\242\347w\0P\16\0@\0B\0\360!&\0\30\0\32\0\30"&\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) &\0\6@\10\0\20\0\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00258   484   NtReadVirtualMemory  (88, 0x2622e0, 76, ...  (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\220#&\0H (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) &\0\22\0\24\0\300 (88, 0x2622e0, 76, ... "\210#&\0@"&\0\220#&\0H"&\0\250!&\0\230#&\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\230"&\0\22\0\24\0\300"&\0\6@\0\0\5\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00259   484   NtReadVirtualMemory  (88, 0x262388, 76, ...  (88, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\00$&\0\350 (88, 0x262388, 76, ... "($&\0\340"&\00$&\0\350"&\0\360"&\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) &\08$&\0\0\0\335w\373\34\335w\0\260\10\0@\0B\08#&\0\30\0\32\0`#&\0\6@\10\0\7\0\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00260   484   NtReadVirtualMemory  (88, 0x262428, 76, ...  (88, 0x262428, 76, ... "\300$&\0\210#&\0\310$&\0\220#&\0\230#&\0P"&\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) &\0\0\0\314w4\23\314w\0P\7\0<\0>\0\340#&\0\24\0\26\0\10$&\0\6@\10\0\3\0\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00261   484   NtReadVirtualMemory  (88, 0x2624c0, 76, ...  (88, 0x2624c0, 76, ... "\234\36&\0($&\0\244\36&\00$&\0\254\36&\0\10!&\0\0\0\351u\212\23\351u\0\20\12\06\08\0\200$&\0\16\0\20\0\250$&\0\4@\10\0\1\0\0\0\360Z\374w\360Z\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00262   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=592,ParentPid=356,}, 0x0, ) == 0x0
 00263   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36&\0", 4, ) , 4, ) == 0x0
 00264   484   NtReadVirtualMemory  (88, 0x261ea4, 4, ...  (88, 0x261ea4, 4, ... "\310\36&\0", 4, ) , 4, ) == 0x0
 00265   484   NtReadVirtualMemory  (88, 0x261ec0, 76, ...  (88, 0x261ec0, 76, ... "\30\37&\0\234\36&\0 \37&\0\244\36&\0\0\0\0\0\0\0\0\0\0\0hJ\16\21hJ\0@\0\0B\0D\04\5\21\0\22\0\24\0d\5\21\0\0P\0\0\377\377\0\0\364\37&\0pZ\374wo\204};\0\0\0\0", 76, ) , 76, ) == 0x0
 00266   484   NtReadVirtualMemory  (88, 0x110534, 68, ...  (88, 0x110534, 68, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0s\0r\0s\0s\0.\0e\0x\0e\0\0\0", 68, ) , 68, ) == 0x0
 00267   484   NtClose  (88, ... ) == 0x0
 00268   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {616, 0}, ... 88, ) == 0x0
 00269   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 00270   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00271   484   NtReadVirtualMemory  (88, 0x171ea4, 4, ...  (88, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00272   484   NtReadVirtualMemory  (88, 0x171ec0, 76, ...  (88, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00273   484   NtReadVirtualMemory  (88, 0x171f18, 76, ...  (88, 0x171f18, 76, ... "\300\37\27\0\300\36\27\0\310\37\27\0\310\36\27\0\320\37\27\0\254\36\27\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\244%\27\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00274   484   NtReadVirtualMemory  (88, 0x171fc0, 76, ...  (88, 0x171fc0, 76, ... "h \27\0\30\37\27\0p \27\0 \37\27\0\30!\27\0(\37\27\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\27\0\30\0\32\0\230\37\27\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00275   484   NtReadVirtualMemory  (88, 0x172068, 76, ...  (88, 0x172068, 76, ... "\10!\27\0\300\37\27\0\20!\27\0\310\37\27\0X"\27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) \27\0\30!\27\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \27\0\30\0\32\0@ \27\0\6@\10\0\377\377\0\0\344!\27\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00276   484   NtReadVirtualMemory  (88, 0x172108, 76, ...  (88, 0x172108, 76, ... "\250!\27\0h \27\0\260!\27\0p \27\0x \27\0\320\37\27\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \27\0\24\0\26\0\350 \27\0\6@\10\0\377\377\0\0\314(\27\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00277   484   NtReadVirtualMemory  (88, 0x1721a8, 76, ...  (88, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\10!\27\0P (88, 0x1721a8, 76, ... "H"\27\0\10!\27\0P"\27\0\20!\27\08$\27\0X"\27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) \27\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0`!\27\0\22\0\24\0\210!\27\0\6@\10\0\377\377\0\0`Z\374w\244 \27\0\22\376};\0\0\0\0", 76, ) == 0x0
 00278   484   NtReadVirtualMemory  (88, 0x172248, 76, ...  (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\250!\27\0\360 (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) \27\0\24\0\26\0( (88, 0x172248, 76, ... "\350"\27\0\250!\27\0\360"\27\0\260!\27\0\270!\27\0x \27\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\27\0\24\0\26\0("\27\0\6@\10\0\377\377\0\0\4%\27\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00279   484   NtReadVirtualMemory  (88, 0x1722e8, 76, ...  (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\220#\27\0P (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) \27\0\26\0\30\0\310 (88, 0x1722e8, 76, ... "\210#\27\0H"\27\0\220#\27\0P"\27\0x%\27\0\330$\27\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\27\0\26\0\30\0\310"\27\0\6@\10\0\377\377\0\0\2541\27\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00280   484   NtReadVirtualMemory  (88, 0x172388, 76, ...  (88, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) \27\00$\27\0\360 (88, 0x172388, 76, ... "($\27\0\350"\27\00$\27\0\360"\27\0\330$\27\08$\27\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\27\0\24\0\26\0h#\27\0\6@\14\0\377\377\0\0\214'\27\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00281   484   NtReadVirtualMemory  (88, 0x172428, 76, ...  (88, 0x172428, 76, ... "\310$\27\0\210#\27\0\320$\27\0\220#\27\0\230#\27\0\270!\27\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\27\0\22\0\24\0\10$\27\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00282   484   NtReadVirtualMemory  (88, 0x1724c8, 76, ...  (88, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) \27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204 (88, 0x1724c8, 76, ... "h%\27\0($\27\0p%\27\00$\27\0\370"\27\0\230#\27\0\0\0*v\\20*v\0\360\0\0<\0>\0\200$\27\0\24\0\26\0\250$\27\0\6@\14\0\377\377\0\0\304/\27\0\204"\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00283   484   NtReadVirtualMemory  (88, 0x172568, 76, ...  (88, 0x172568, 76, ... "\10&\27\0\310$\27\0\20&\27\0\320$\27\0\300&\27\0\370"\27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) \27\0\0\0\224u\220\20\224u\0p\0\0>\0@\0 %\27\0\26\0\30\0H%\27\0\6@\10\0\377\377\0\0\354&\27\0T\37\27\0\31\376};\0\0\0\0", 76, ) == 0x0
 00284   484   NtReadVirtualMemory  (88, 0x172608, 76, ...  (88, 0x172608, 76, ... "\260&\27\0h%\27\0\270&\27\0p%\27\0\0(\27\0`'\27\0\0\0\223u \22\223u\0\240\0\0>\0@\0\300%\27\0\26\0\30\0\350%\27\0\6@\10\0\377\377\0\0,(\27\0\330Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00285   484   NtReadVirtualMemory  (88, 0x1726b0, 76, ...  (88, 0x1726b0, 76, ... "P'\27\0\10&\27\0X'\27\0\20&\27\0`'\27\0x%\27\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0`&\27\0\30\0\32\0\210&\27\0\6@\14\0\377\377\0\0|?\27\0\244%\27\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00286   484   NtReadVirtualMemory  (88, 0x172750, 76, ...  (88, 0x172750, 76, ... "\360'\27\0\260&\27\0\370'\27\0\270&\27\0\30&\27\0\300&\27\0\0\0\247uM\31\247u\00\12\0>\0@\0\10'\27\0\26\0\30\00'\27\0\6@\14\0\377\377\0\0\3348\27\0\304#\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00287   484   NtReadVirtualMemory  (88, 0x1727f0, 76, ...  (88, 0x1727f0, 76, ... "\220(\27\0P'\27\0\230(\27\0X'\27\0\240(\27\0\30&\27\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\250'\27\0\22\0\24\0\320'\27\0\6@\14\0\377\377\0\0\330Z\374wD&\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00288   484   NtReadVirtualMemory  (88, 0x172890, 76, ...  (88, 0x172890, 76, ... "0)\27\0\360'\27\08)\27\0\370'\27\0@)\27\0\0(\27\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0H(\27\0\24\0\26\0p(\27\0\6@\10\0\377\377\0\0T<\27\0D!\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00289   484   NtReadVirtualMemory  (88, 0x172930, 76, ...  (88, 0x172930, 76, ... "\330)\27\0\220(\27\0\340)\27\0\230(\27\0\350)\27\0\240(\27\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\350(\27\0\26\0\30\0\20)\27\0\6@\14\0\377\377\0\0\24*\27\0\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00290   484   NtReadVirtualMemory  (88, 0x1729d8, 76, ...  (88, 0x1729d8, 76, ... "x*\27\00)\27\0\200*\27\08)\27\0\320+\27\0@)\27\0\0\0gv8\25gv\0@\16\0@\0B\0\210)\27\0\30\0\32\0\260)\27\0\6@\10\0\377\377\0\0\264*\27\0l)\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00291   484   NtReadVirtualMemory  (88, 0x172a78, 76, ...  (88, 0x172a78, 76, ... " +\27\0\330)\27\0(+\27\0\340)\27\0\30-\27\00+\27\0\0\0\306v\355\346\306v\0\220\2\0<\0>\00*\27\0\24\0\26\0X*\27\0\6@\14\0\377\377\0\0d0\27\0\24*\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00292   484   NtReadVirtualMemory  (88, 0x172b20, 76, ...  (88, 0x172b20, 76, ... "\300+\27\0x*\27\0\310+\27\0\200*\27\0\210*\27\0x,\27\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\320*\27\0\30\0\32\0\370*\27\0\6@\14\0\377\377\0\0\344-\27\0\374\36\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00293   484   NtReadVirtualMemory  (88, 0x172bc0, 76, ...  (88, 0x172bc0, 76, ... "h,\27\0 +\27\0p,\27\0(+\27\0x,\27\0\350)\27\0\0\0\33wp\10\34w\0\240\21\0:\0<\0x+\27\0\22\0\24\0\240+\27\0\6@\10\0\377\377\0\0L2\27\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00294   484   NtReadVirtualMemory  (88, 0x172c68, 76, ...  (88, 0x172c68, 76, ... "\10-\27\0\300+\27\0\20-\27\0\310+\27\00+\27\0\320+\27\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\30,\27\0\30\0\32\0@,\27\0\6@\14\0\377\377\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00295   484   NtReadVirtualMemory  (88, 0x172d08, 76, ...  (88, 0x172d08, 76, ... "\250-\27\0h,\27\0\260-\27\0p,\27\0\270-\27\0\210*\27\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\300,\27\0\26\0\30\0\350,\27\0\6@\10\0\377\377\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00296   484   NtReadVirtualMemory  (88, 0x172da8, 76, ...  (88, 0x172da8, 76, ... "H.\27\0\10-\27\0P.\27\0\20-\27\0\370.\27\0\30-\27\0\0\06v\240\206v\0\360\0\0<\0>\0`-\27\0\24\0\26\0\210-\27\0\6@\10\0\377\377\0\0\204.\27\0\+\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00297   484   NtReadVirtualMemory  (88, 0x172e48, 76, ...  (88, 0x172e48, 76, ... "\350.\27\0\250-\27\0\360.\27\0\260-\27\0\3300\27\0\370.\27\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\0.\27\0\24\0\26\0(.\27\0\6@\10\0\377\377\0\0$/\27\0\344-\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00298   484   NtReadVirtualMemory  (88, 0x172ee8, 76, ...  (88, 0x172ee8, 76, ... "\210/\27\0H.\27\0\220/\27\0P.\27\0X.\27\0\270-\27\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\240.\27\0\26\0\30\0\310.\27\0\6@\14\0\377\377\0\0\2546\27\0\204.\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00299   484   NtReadVirtualMemory  (88, 0x172f88, 76, ...  (88, 0x172f88, 76, ... "(0\27\0\350.\27\000\27\0\360.\27\0\04\27\0 2\27\0\0\0\227u\31\32\227u\0\20\17\0<\0>\0@/\27\0\24\0\26\0h/\27\0\4@\14\0\2\0\0\0\264;\27\0\4%\27\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00300   484   NtReadVirtualMemory  (88, 0x173028, 76, ...  (88, 0x173028, 76, ... "\3100\27\0\210/\27\0\3200\27\0\220/\27\0\2001\27\0\3300\27\0\0\0=w\24 ?w\0@\177\0>\0@\0\340/\27\0\26\0\30\0\100\27\0\6@\10\0\21\0\0\0\41\27\0\264*\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00301   484   NtReadVirtualMemory  (88, 0x1730c8, 76, ...  (88, 0x1730c8, 76, ... "p1\27\0(0\27\0x1\27\000\27\080\27\0X.\27\0\0\0-w\306@-w\00\6\0>\0@\0\2000\27\0\26\0\30\0\2500\27\0\6@\14\0\35\0\0\0l5\27\0d0\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00302   484   NtReadVirtualMemory  (88, 0x173170, 76, ...  (88, 0x173170, 76, ... "\202\27\0\3100\27\0\302\27\0\3200\27\0\3102\27\080\27\0\0\04wY\324w\0\260\10\0@\0B\0 1\27\0\30\0\32\0H1\27\0\6@\14\0\10\0\0\0\3642\27\0$#\27\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00303   484   NtReadVirtualMemory  (88, 0x173210, 76, ...  (88, 0x173210, 76, ... "\2702\27\0p1\27\0\3002\27\0x1\27\0\230/\27\0\3102\27\0\0\0{\37\200F{\37\0\20\3\0<\0>\0\3101\27\0\24\0\26\0\3601\27\0\6@\14\0\2\0\0\0\3144\27\0\374+\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00304   484   NtReadVirtualMemory  (88, 0x1732b8, 76, ...  (88, 0x1732b8, 76, ... "\3603\27\0\202\27\0\3703\27\0\302\27\0 2\27\0\2001\27\0\0\0;v\0\26;v\0P\4\0@\0B\0h2\27\0\30\0\32\0\2202\27\0\6@\14\0\3\0\0\0,4\27\0\2541\27\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00305   484   NtReadVirtualMemory  (88, 0x1733f0, 76, ...  (88, 0x1733f0, 76, ... "\2204\27\0\2702\27\0\2304\27\0\3002\27\0\2404\27\0\230/\27\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\203\27\0\30\0\32\0\3163\27\0\4@\14\20\3\0\0\0\34:\27\0\3642\27\02\376};\370\254\7\0", 76, ) , 76, ) == 0x0
 00306   484   NtReadVirtualMemory  (88, 0x173490, 76, ...  (88, 0x173490, 76, ... "05\27\0\3603\27\085\27\0\3703\27\0@5\27\0\04\27\0\0\0\205\37\0\0\0\0\0`\1\0>\0@\0H4\27\0\26\0\30\0p4\27\0\4@\0\0\1\0\0\0\234G\27\0L2\27\05"O;\0\0\0\0", 76, ) O;\0\0\0\0", 76, ) == 0x0
 00307   484   NtReadVirtualMemory  (88, 0x173530, 76, ...  (88, 0x173530, 76, ... "\3105\27\0\2204\27\0\3205\27\0\2304\27\0\3305\27\0\2404\27\0\0\0\275vG"\276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0\3504\27\0\24\0\26\0\205\27\0\4@\10\0\1\0\0\0\46\27\0\41\27\0\23\376};\0\0\0\0", 76, ) == 0x0
 00308   484   NtReadVirtualMemory  (88, 0x1735c8, 76, ...  (88, 0x1735c8, 76, ... "p6\27\005\27\0x6\27\085\27\0(7\27\0@5\27\0\0\0\273v\0\0\0\0\0@\0\06\08\0\2105\27\0\16\0\20\0\2605\27\0\4@\0\0\2\0\0\0\3747\27\0l5\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00309   484   NtReadVirtualMemory  (88, 0x173670, 76, ...  (88, 0x173670, 76, ... "\307\27\0\3105\27\0 7\27\0\3205\27\0\3207\27\0(7\27\0\0\0=r\240\22=r\0\240\1\0@\0B\0 6\27\0\30\0\32\0H6\27\0\4@\10\0\7\0\0\0T7\27\0$/\27\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00310   484   NtReadVirtualMemory  (88, 0x173718, 76, ...  (88, 0x173718, 76, ... "\3007\27\0p6\27\0\3107\27\0x6\27\0\2006\27\0\3305\27\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\3106\27\0\30\0\32\0\3606\27\0\6@\0\0\7\0\0\0|9\27\0\2546\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00311   484   NtReadVirtualMemory  (88, 0x1737c0, 76, ...  (88, 0x1737c0, 76, ... "\2408\27\0\307\27\0\2508\27\0 7\27\0\2608\27\0\2006\27\0\0\0\351u\212\23\351u\0\20\12\06\08\0\308\27\0\16\0\20\0@8\27\0\4@\10\0\1\0\0\0\224=\27\0\46\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00312   484   NtReadVirtualMemory  (88, 0x1738a0, 76, ...  (88, 0x1738a0, 76, ... "@9\27\0\3007\27\0H9\27\0\3107\27\0P9\27\0\3207\27\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0X8\27\0\26\0\30\0\2008\27\0\4@\10\0\5\0\0\0\0[\374w\214'\27\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00313   484   NtReadVirtualMemory  (88, 0x173940, 76, ...  (88, 0x173940, 76, ... "\3409\27\0\2408\27\0\3509\27\0\2508\27\0\3609\27\0\2608\27\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\3708\27\0\22\0\24\0 9\27\0\4@\14\0\7\0\0\0t:\27\0T7\27\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00314   484   NtReadVirtualMemory  (88, 0x1739e0, 76, ...  (88, 0x1739e0, 76, ... "8:\27\0@9\27\0@:\27\0H9\27\0\360:\27\0P9\27\0\0\0`v\20\22`v\0\260\1\0<\0>\0\2309\27\0\24\0\26\0\3009\27\0\4@\10\0\3\0\0\04>\27\0,4\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00315   484   NtReadVirtualMemory  (88, 0x173a38, 76, ...  (88, 0x173a38, 76, ... "\340:\27\0\3409\27\0\350:\27\0\3509\27\0(<\27\0\210;\27\0\0\0\225um\25\225u\0\220\1\0@\0B\0p7\27\0\30\0\32\0\2307\27\0\4@\14\0\6\0\0\0\34;\27\0|9\27\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00316   484   NtReadVirtualMemory  (88, 0x173ae0, 76, ...  (88, 0x173ae0, 76, ... "x;\27\08:\27\0\200;\27\0@:\27\0\210;\27\0\3609\27\0\0\0\0s\372\26\0s\00\2\0@\0B\0\220:\27\0\30\0\32\0\270:\27\0\6@\14\0\6\0\0\0\34E\27\0t:\27\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00317   484   NtReadVirtualMemory  (88, 0x173b78, 76, ...  (88, 0x173b78, 76, ... "\30<\27\0\340:\27\0 <\27\0\350:\27\0H:\27\0\360:\27\0\0\0\262q\234\21\262q\0\20\1\06\08\08;\27\0\16\0\20\0`;\27\0\6@\14\0\12\0\0\0\364<\27\0\304/\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00318   484   NtReadVirtualMemory  (88, 0x173c18, 76, ...  (88, 0x173c18, 76, ... "\270<\27\0x;\27\0\300<\27\0\200;\27\0\310<\27\0H:\27\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\320;\27\0\24\0\26\0\370;\27\0\4@\14\0\1\0\0\0\350Z\374w\314(\27\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00319   484   NtReadVirtualMemory  (88, 0x173cb8, 76, ...  (88, 0x173cb8, 76, ... "X=\27\0\30<\27\0`=\27\0 <\27\0h=\27\0(<\27\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0p<\27\0\24\0\26\0\230<\27\0\4@\0\0\1\0\0\0, 76, ) , 76, ) == 0x0
 00320   484   NtReadVirtualMemory  (88, 0x173d58, 76, ...  (88, 0x173d58, 76, ... "\370=\27\0\270<\27\0\0>\27\0\300<\27\0\10>\27\0\310<\27\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\20=\27\0\24\0\26\08=\27\0\4@\10\0\5\0\0\0\360Z\374w\3747\27\01\376};\200`\10\0", 76, ) , 76, ) == 0x0
 00321   484   NtReadVirtualMemory  (88, 0x173df8, 76, ...  (88, 0x173df8, 76, ... "\240>\27\0X=\27\0\250>\27\0`=\27\0\260>\27\0h=\27\0\0\0bv\316\26bv\0\340\4\0:\0<\0\260=\27\0\22\0\24\0\330=\27\0\4@\14\0\1\0\0\0\364F\27\0\34:\27\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00322   484   NtReadVirtualMemory  (88, 0x173ea0, 76, ...  (88, 0x173ea0, 76, ... "@?\27\0\370=\27\0H?\27\0\0>\27\0\360?\27\0\10>\27\0\0\0\366ux\20\366u\0`\0\0<\0>\0\370>\27\0\24\0\26\0 ?\27\0\4@\14\0\1\0\0\0\374A\27\0xZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00323   484   NtReadVirtualMemory  (88, 0x173f40, 76, ...  (88, 0x173f40, 76, ... "\340?\27\0\240>\27\0\350?\27\0\250>\27\0\320A\27\0\220@\27\0\0\0\301q\12\23\301q\0\320\0\0@\0B\0P>\27\0\30\0\32\0x>\27\0\4@\14\0\1\0\0\0\34@\27\0\354&\27\04\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00324   484   NtReadVirtualMemory  (88, 0x173fe0, 76, ...  (88, 0x173fe0, 76, ... "\200@\27\0@?\27\0\210@\27\0H?\27\00A\27\0\260>\27\0\0\0\315q\6\22\315q\0`\1\0<\0>\0\230?\27\0\24\0\26\0\300?\27\0\6@\14\0\5\0\0\0\274@\27\0|?\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00325   484   NtReadVirtualMemory  (88, 0x174080, 76, ...  (88, 0x174080, 76, ... " A\27\0\340?\27\0(A\27\0\350?\27\0P?\27\00A\27\0\0\0\311qP\26\311q\0\300\3\0<\0>\08@\27\0\24\0\26\0`@\27\0\6@\14\0\2\0\0\0\A\27\0\34@\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00326   484   NtReadVirtualMemory  (88, 0x174120, 76, ...  (88, 0x174120, 76, ... "\300A\27\0\200@\27\0\310A\27\0\210@\27\0\220@\27\0\360?\27\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\330@\27\0\24\0\26\0\0A\27\0\6@\0\0\2\0\0\0\334C\27\0\274@\27\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00327   484   NtReadVirtualMemory  (88, 0x1741c0, 76, ...  (88, 0x1741c0, 76, ... "`B\27\0 A\27\0hB\27\0(A\27\0pB\27\0P?\27\0\0\0\367uB\21\367u\0\220\0\0>\0@\0xA\27\0\26\0\30\0\240A\27\0\4@\14\0\1\0\0\0xZ\374w\334>\27\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00328   484   NtReadVirtualMemory  (88, 0x174260, 76, ...  (88, 0x174260, 76, ... "\0C\27\0\300A\27\0\10C\27\0\310A\27\0\260C\27\0\320A\27\0\0\0\0\20\340t\0\20\0\0\2\0:\0<\0\30B\27\0\22\0\24\0@B\27\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374w\340Z\332D\0\0\0\0", 76, ) , 76, ) == 0x0
 00329   484   NtReadVirtualMemory  (88, 0x174300, 76, ...  (88, 0x174300, 76, ... "\240C\27\0`B\27\0\250C\27\0hB\27\0PD\27\0\260C\27\0\0\0\260q>\23\260q\0\360\0\0:\0<\0\270B\27\0\22\0\24\0\340B\27\0\4@\14\0\1\0\0\0\300Z\374w\364<\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00330   484   NtReadVirtualMemory  (88, 0x1743a0, 76, ...  (88, 0x1743a0, 76, ... "@D\27\0\0C\27\0HD\27\0\10C\27\0\20C\27\0pB\27\0\0\0\272qp\27\272q\0\340\4\0<\0>\0XC\27\0\24\0\26\0\200C\27\0\6@\14\0\1\0\0\0|D\27\0\A\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00331   484   NtReadVirtualMemory  (88, 0x174440, 76, ...  (88, 0x174440, 76, ... "\340D\27\0\240C\27\0\350D\27\0\250C\27\0\360D\27\0\20C\27\0\0\0\264q\0\0\0\0\0\300\2\0<\0>\0\370C\27\0\24\0\26\0 D\27\0\4@\0\0\1\0\0\0\274E\27\0\334C\27\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00332   484   NtReadVirtualMemory  (88, 0x1744e0, 76, ...  (88, 0x1744e0, 76, ... "\200E\27\0@D\27\0\210E\27\0HD\27\0\220E\27\0PD\27\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\230D\27\0\26\0\30\0\300D\27\0\4@\10\0\2\0\0\0\20[\374w\34;\27\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00333   484   NtReadVirtualMemory  (88, 0x174580, 76, ...  (88, 0x174580, 76, ... "\270F\27\0\340D\27\0\300F\27\0\350D\27\0\310F\27\0\360D\27\0\0\0\316v\353\23\316v\0\360\1\0>\0@\08E\27\0\26\0\30\0`E\27\0\4@\14\0\1\0\0\0\310Z\374w|D\27\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00334   484   NtReadVirtualMemory  (88, 0x1746b8, 76, ...  (88, 0x1746b8, 76, ... "`G\27\0\200E\27\0hG\27\0\210E\27\0pG\27\0\220E\27\0\0\0\5wH\20\5w\0P\14\0<\0>\0pF\27\0\24\0\26\0\230F\27\0\6@\14\0\2\0\0\0\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00335   484   NtReadVirtualMemory  (88, 0x174760, 76, ...  (88, 0x174760, 76, ... "\0H\27\0\270F\27\0\10H\27\0\300F\27\0\20H\27\0\310F\27\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\20G\27\0\30\0\32\08G\27\0\6@\10\0\2\0\0\0\320Z\374w\3144\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00336   484   NtReadVirtualMemory  (88, 0x174800, 76, ...  (88, 0x174800, 76, ... "\234\36\27\0`G\27\0\244\36\27\0hG\27\0\254\36\27\0pG\27\0\0\0\375v%0\375v\0\200\7\0>\0@\0\270G\27\0\26\0\30\0\340G\27\0\4@\14\0\2\0\0\0pZ\374w\364F\27\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00337   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=616,ParentPid=356,}, 0x0, ) == 0x0
 00338   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\27\0", 4, ) , 4, ) == 0x0
 00339   484   NtReadVirtualMemory  (88, 0x171ea4, 4, ...  (88, 0x171ea4, 4, ... "\310\36\27\0", 4, ) , 4, ) == 0x0
 00340   484   NtReadVirtualMemory  (88, 0x171ec0, 76, ...  (88, 0x171ec0, 76, ... "\30\37\27\0\234\36\27\0 \37\27\0\244\36\27\0\0\0\0\0\0\0\0\0\0\0\0\1]=\3\1\0\340\6\0H\0J\04\5\2\0\30\0\32\0d\5\2\0\0P\0\0\377\377\0\0\+\27\0\20[\374w\310\214};\0\0\0\0", 76, ) , 76, ) == 0x0
 00341   484   NtReadVirtualMemory  (88, 0x20534, 74, ...  (88, 0x20534, 74, ... "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0l\0o\0g\0o\0n\0.\0e\0x\0e\0\0\0", 74, ) , 74, ) == 0x0
 00342   484   NtClose  (88, ... ) == 0x0
 00343   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {660, 0}, ... 88, ) == 0x0
 00344   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 00345   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00346   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00347   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00348   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00349   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00350   484   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\300Z\374w\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00351   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\4%\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00352   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00353   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\304#\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00354   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"\30\0\22\0\24\0\310"\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00355   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) \30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\330$\30\0X"\30\0\0\0\247uM\31\247u\00\12\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0\254%\30\0\204"\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00356   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0 &\30\0\330$\30\0\0\0\216u\20\24\216u\0\320\4\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\377\377\377\377\224'\30\0\374\36\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00357   484   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\08$\30\0\230#\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0`Z\374wD!\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00358   484   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0\310&\30\0 &\30\0\0\0\214u\203\27\214u\0\300\1\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\0[\374w\304#\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00359   484   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\200%\30\08$\30\0\0\06v\240\206v\0\360\0\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\10\0\377\377\0\0\334(\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00360   484   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0h'\30\0\200%\30\0\0\0w_5\21w_\0\340\0\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\10\0\377\377\0\0l+\30\0T\37\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00361   484   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0P)\30\0\310&\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\20'\30\0\26\0\30\08'\30\0\4@\14\0\3\0\0\0\360Z\374wd$\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00362   484   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\230*\30\0\360)\30\0\0\0\212u\0\0\0\0\0\360\0\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\4@\0\0\1\0\0\0\200Z\374w\200Z\374w\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00363   484   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "@)\30\0\0(\30\0H)\30\0\10(\30\0\360)\30\0P)\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0X(\30\0\24\0\26\0\200(\30\0\6@\10\0\1\0\0\0|)\30\0L&\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00364   484   NtReadVirtualMemory  (88, 0x182940, 76, ...  (88, 0x182940, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\260(\30\0h'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\370(\30\0\26\0\30\0 )\30\0\6@\14\0\1\0\0\0\304*\30\0\334(\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00365   484   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0\20(\30\0\260(\30\0\0\0\277v\310\20\277v\0\260\0\0:\0<\0\230)\30\0\22\0\24\0\300)\30\0\6@\14\0\1\0\0\0\330Z\374w\330Z\374w\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00366   484   NtReadVirtualMemory  (88, 0x182a88, 76, ...  (88, 0x182a88, 76, ... "0+\30\0\340)\30\08+\30\0\350)\30\0@+\30\0\20(\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08*\30\0\30\0\32\0`*\30\0\4@\0\0\1\0\0\0\20[\374w|)\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00367   484   NtReadVirtualMemory  (88, 0x182b30, 76, ...  (88, 0x182b30, 76, ... "\234\36\30\0\210*\30\0\244\36\30\0\220*\30\0\254\36\30\0\230*\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\340*\30\0\30\0\32\0\10+\30\0\4@\14\0\2\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00368   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=660,ParentPid=616,}, 0x0, ) == 0x0
 00369   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00370   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00371   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\340\203\0\1\0\260\1\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0d$\30\0\360Z\374w\307\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00372   484   NtReadVirtualMemory  (88, 0x20598, 66, ...  (88, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0e\0r\0v\0i\0c\0e\0s\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00373   484   NtClose  (88, ... ) == 0x0
 00374   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {672, 0}, ... 88, ) == 0x0
 00375   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 00376   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00377   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00378   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00379   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\324(\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00380   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\04-\30\0\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00381   484   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\2541\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00382   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\3144\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00383   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0h,\30\0\200*\30\0\0\0Rt\0\0\0\0\0p\12\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\0\0\377\377\0\0\270Z\374w\374\36\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00384   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\370"\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\10\0\377\377\0\0,(\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00385   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\08$\30\0X"\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\4%\30\0\360Z\374w\21\376};\0\0\0\0", 76, ) == 0x0
 00386   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\200%\30\08$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\14\0\377\377\0\0\244=\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00387   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\340#\30\0\22\0\24\0\10$\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00388   484   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\0(\30\0 &\30\0\0\0Dt\0\0\0\0\0\220\6\0<\0>\0\200$\30\0\24\0\26\0\250$\30\0\6@\0\0\377\377\0\0t)\30\0$#\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00389   484   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\310$\30\0\30&\30\0\320$\30\0`'\30\0\230#\30\0\0\0yv\7\30yv\0\260\0\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\14\0\377\377\0\0\274;\30\0pZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00390   484   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\260&\30\0p%\30\0\270&\30\0x%\30\0\330$\30\0\300&\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\377\377\0\0\34;\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00391   484   NtReadVirtualMemory  (88, 0x1826b0, 76, ...  (88, 0x1826b0, 76, ... "P'\30\0\20&\30\0X'\30\0\30&\30\0 &\30\0`'\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h&\30\0\24\0\26\0\220&\30\0\6@\10\0\377\377\0\0\214'\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00392   484   NtReadVirtualMemory  (88, 0x182750, 76, ...  (88, 0x182750, 76, ... "\360'\30\0\260&\30\0\370'\30\0\270&\30\0\300&\30\0\200%\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10'\30\0\26\0\30\00'\30\0\6@\14\0\377\377\0\0L+\30\0\354&\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00393   484   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\250(\30\0\330$\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\6@\14\0\377\377\0\0\14*\30\0\204"\30\0\26\376};\0\0\0\0", 76, ) \30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00394   484   NtReadVirtualMemory  (88, 0x182898, 76, ...  (88, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0H)\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\6@\14\0\377\377\0\0\254*\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00395   484   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\320)\30\0\230(\30\0\330)\30\0\240(\30\0\340)\30\0\250(\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\10\0\377\377\0\0t5\30\0\4%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00396   484   NtReadVirtualMemory  (88, 0x1829d0, 76, ...  (88, 0x1829d0, 76, ... "p*\30\08)\30\0x*\30\0@)\30\0 +\30\0H)\30\0\0\0\262q\234\21\262q\0\20\1\06\08\0\220)\30\0\16\0\20\0\270)\30\0\6@\14\0\377\377\0\0\224,\30\0,(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00397   484   NtReadVirtualMemory  (88, 0x182a70, 76, ...  (88, 0x182a70, 76, ... "\20+\30\0\320)\30\0\30+\30\0\330)\30\0\270!\30\0 +\30\0\0\0zv\32\22zv\00\1\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0\377\377\0\0\334-\30\0\324(\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00398   484   NtReadVirtualMemory  (88, 0x182b10, 76, ...  (88, 0x182b10, 76, ... "X,\30\0p*\30\0`,\30\0x*\30\0\200*\30\0\340)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\310*\30\0\26\0\30\0\360*\30\0\6@\10\0\377\377\0\0|.\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00399   484   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\370,\30\0\20+\30\0\0-\30\0\30+\30\0\10-\30\0\270!\30\0\0\0;t\0\0\0\0\0\320\0\0>\0@\0\20,\30\0\26\0\30\08,\30\0\4@\0\0\1\0\0\0\364+\30\0\14*\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00400   484   NtReadVirtualMemory  (88, 0x182cf8, 76, ...  (88, 0x182cf8, 76, ... "\270+\30\0X,\30\0\300+\30\0`,\30\0\310+\30\0h,\30\0\0\0\317q7\177\320q\0@\4\0@\0B\0h+\30\0\30\0\32\0\220+\30\0\4@\14\0\2\0\0\0\260Z\374w\374\37\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00401   484   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "\240-\30\0\370,\30\0\250-\30\0\0-\30\0\360.\30\0\10-\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\4@\0\0\4\0\0\0\34/\30\0\224,\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00402   484   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "@.\30\0\270+\30\0H.\30\0\300+\30\0\260>\30\0P.\30\0\0\0Kt\232\356Kt\00\6\0@\0B\0P-\30\0\30\0\32\0x-\30\0\4@\14\0\2\0\0\0d0\30\0\254*\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00403   484   NtReadVirtualMemory  (88, 0x182e40, 76, ...  (88, 0x182e40, 76, ... "\340.\30\0\240-\30\0\350.\30\0\250-\30\0\260-\30\0x=\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\370-\30\0\26\0\30\0 .\30\0\6@\0\0\2\0\0\0\2348\30\0L+\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00404   484   NtReadVirtualMemory  (88, 0x182ee0, 76, ...  (88, 0x182ee0, 76, ... "\210/\30\0@.\30\0\220/\30\0H.\30\0 2\30\0\310+\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0\230.\30\0\26\0\30\0\300.\30\0\6@\14\0\2\0\0\0\41\30\0\364+\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00405   484   NtReadVirtualMemory  (88, 0x182f88, 76, ...  (88, 0x182f88, 76, ... "(0\30\0\340.\30\000\30\0\350.\30\0x=\30\080\30\0\0\0\326v\326/\326v\0P\1\0@\0B\08/\30\0\30\0\32\0`/\30\0\6@\14\0\11\0\0\0\264B\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00406   484   NtReadVirtualMemory  (88, 0x183028, 76, ...  (88, 0x183028, 76, ... "\3100\30\0\210/\30\0\3200\30\0\220/\30\0\230/\30\0\2609\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\340/\30\0\24\0\26\0\100\30\0\6@\14\0\3\0\0\0\310Z\374w\334-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00407   484   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "p1\30\0(0\30\0x1\30\000\30\0\2206\30\0H5\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\2000\30\0\24\0\26\0\2500\30\0\6@\14\0\3\0\0\0DE\30\0\34/\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00408   484   NtReadVirtualMemory  (88, 0x183170, 76, ...  (88, 0x183170, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0\2404\30\0\04\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0 1\30\0\30\0\32\0H1\30\0\6@\14\0\3\0\0\0L2\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00409   484   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\2702\30\0\360.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\3101\30\0\26\0\30\0\3601\30\0\6@\10\0\3\0\0\0\3442\30\0\2541\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00410   484   NtReadVirtualMemory  (88, 0x1832a8, 76, ...  (88, 0x1832a8, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0X3\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\14\0\3\0\0\0`Z\374wL2\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00411   484   NtReadVirtualMemory  (88, 0x183348, 76, ...  (88, 0x183348, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0\04\30\0\2702\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\03\30\0\22\0\24\0(3\30\0\6@\10\0\25\0\0\0,4\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00412   484   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2204\30\0H3\30\0\2304\30\0P3\30\0\2001\30\0X3\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\6@\10\0\15\0\0\0TC\30\0\2043\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00413   484   NtReadVirtualMemory  (88, 0x183490, 76, ...  (88, 0x183490, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\0H5\30\0\2001\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\14\0\12\0\0\0\346\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00414   484   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3405\30\0\2204\30\0\3505\30\0\2304\30\0\3300\30\0\2404\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3504\30\0\30\0\32\0\205\30\0\6@\10\0\4\0\0\0\3747\30\0t)\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00415   484   NtReadVirtualMemory  (88, 0x1835e0, 76, ...  (88, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\209\30\007\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\14\0\4\0\0\0\2746\30\0\3144\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00416   484   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... " 7\30\0\3405\30\0(7\30\0\3505\30\0\3207\30\0\3300\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\14\0\4\0\0\0lA\30\0\346\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00417   484   NtReadVirtualMemory  (88, 0x183720, 76, ...  (88, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3605\30\0p8\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\6@\10\0\4\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00418   484   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\0\2206\30\0\0\0-w\306@-w\00\6\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\6@\14\0\15\0\0\0<9\30\0t5\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00419   484   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\007\30\0\3207\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\308\30\0\22\0\24\0@8\30\0\6@\14\0\4\0\0\0\3349\30\0|.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00420   484   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2409\30\0`8\30\0\2509\30\0h8\30\0H:\30\0\3605\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\6@\10\0\4\0\0\0,@\30\0\3747\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00421   484   NtReadVirtualMemory  (88, 0x1839a0, 76, ...  (88, 0x1839a0, 76, ... "8:\30\0\09\30\0@:\30\0\109\30\080\30\08<\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X9\30\0\24\0\26\0\2009\30\0\6@\14\0\3\0\0\0t:\30\0\2348\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00422   484   NtReadVirtualMemory  (88, 0x183a38, 76, ...  (88, 0x183a38, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\360:\30\0\209\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3709\30\0\16\0\20\0 :\30\0\6@\0\0\3\0\0\0d<\30\0\3349\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00423   484   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\0\220;\30\0H:\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\3\0\0\0,G\30\0L&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00424   484   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0,vN\25,v\0\240\10\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\10\0\6\0\0\0\334>\30\0\254%\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00425   484   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0\2609\30\0\330<\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\0\0\3\0\0\0\4=\30\0t:\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00426   484   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\08<\30\0\220;\30\0\0\06v\240\206v\0\360\0\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\10\0\6\0\0\0\314@\30\0d<\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00427   484   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\240>\30\0\310<\30\0\250>\30\0\320<\30\0P.\30\0\230/\30\0\0\0\247uM\31\247u\00\12\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\14\0\6\0\0\0\0[\374w\304#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00428   484   NtReadVirtualMemory  (88, 0x183ea0, 76, ...  (88, 0x183ea0, 76, ... "H?\30\0h=\30\0P?\30\0p=\30\0X?\30\0\260-\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300=\30\0\30\0\32\0~>\30\0\4@\14\20\2\0\0\0\204?\30\0\274;\30\02\376};\30\15\11\0", 76, ) , 76, ) == 0x0
 00429   484   NtReadVirtualMemory  (88, 0x183f48, 76, ...  (88, 0x183f48, 76, ... "\360?\30\0\240>\30\0\370?\30\0\250>\30\0\0@\30\0\260>\30\0\0\04wY\324w\0\260\10\0@\0B\0\370>\30\0\30\0\32\0 ?\30\0\4@\14\0\1\0\0\0pZ\374w\334>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00430   484   NtReadVirtualMemory  (88, 0x183ff0, 76, ...  (88, 0x183ff0, 76, ... "\220@\30\0H?\30\0\230@\30\0P?\30\0\240@\30\0X?\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\240?\30\0\30\0\32\0\310?\30\0\4@\14\0\1\0\0\0\14B\30\0<9\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00431   484   NtReadVirtualMemory  (88, 0x184090, 76, ...  (88, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0\0@\30\0\0\08t\0\0\0\0\0\360\0\0>\0@\0H@\30\0\26\0\30\0p@\30\0\4@\0\0\1\0\0\0\374C\30\0\4=\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00432   484   NtReadVirtualMemory  (88, 0x184130, 76, ...  (88, 0x184130, 76, ... "\320A\30\0\220@\30\0\330A\30\0\230@\30\0\340A\30\0\240@\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\350@\30\0\24\0\26\0\20A\30\0\4@\14\0\1\0\0\0\350Z\374w\2746\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00433   484   NtReadVirtualMemory  (88, 0x1841d0, 76, ...  (88, 0x1841d0, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\0@A\30\0\0\0At\200\23At\0\320\2\0<\0>\0\210A\30\0\24\0\26\0\260A\30\0\4@\10\0\1\0\0\0\360Z\374w,@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00434   484   NtReadVirtualMemory  (88, 0x184278, 76, ...  (88, 0x184278, 76, ... "\30C\30\0\320A\30\0 C\30\0\330A\30\0xD\30\0(C\30\0\0\0>tG\26>t\0p\2\0@\0B\0(B\30\0\30\0\32\0PB\30\0\4@\14\0\1\0\0\0\240Z\374w\304/\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00435   484   NtReadVirtualMemory  (88, 0x184318, 76, ...  (88, 0x184318, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\210B\30\0\320C\30\0\0\0]t\206\25]t\0p\13\0<\0>\0\320B\30\0\24\0\26\0\370B\30\0\6@\10\0\1\0\0\0\320Z\374w,4\30\0!\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00436   484   NtReadVirtualMemory  (88, 0x1843c0, 76, ...  (88, 0x1843c0, 76, ... "hD\30\0\30C\30\0pD\30\0 C\30\0(C\30\0\340A\30\0\0\07tP\207t\0\240\0\0@\0B\0pC\30\0\30\0\32\0\230C\30\0\6@\14\0\1\0\0\0\354E\30\0\314@\30\0"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00437   484   NtReadVirtualMemory  (88, 0x184468, 76, ...  (88, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\210B\30\0\0\0:tP\21:t\0\220\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\14\0\1\0\0\0\214F\30\0\330Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00438   484   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0\300E\30\0xD\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300D\30\0\26\0\30\0\350D\30\0\4@\10\0\2\0\0\0\300Z\374w\41\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00439   484   NtReadVirtualMemory  (88, 0x1845b0, 76, ...  (88, 0x1845b0, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0`F\30\0\30E\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\0\20[\374w\374C\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00440   484   NtReadVirtualMemory  (88, 0x184650, 76, ...  (88, 0x184650, 76, ... "\360F\30\0\260E\30\0\370F\30\0\270E\30\0\0G\30\0\300E\30\0\0\0\0\10F\30\0\24\0\26\00F\30\0\4@\14\0\1\0\0\0\330Z\374w\244D\30\0"\376};\330C\13\0", 76, ) \376};\330C\13\0", 76, ) == 0x0
 00441   484   NtReadVirtualMemory  (88, 0x1846f0, 76, ...  (88, 0x1846f0, 76, ... "\234\36\30\0PF\30\0\244\36\30\0XF\30\0\254\36\30\0`F\30\0\0\0\372\17\37]\372\17\0\20\2\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\4@\14\0\1\0\0\0xZ\374w\34;\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00442   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=9,Pid=672,ParentPid=616,}, 0x0, ) == 0x0
 00443   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00444   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00445   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\11\24\0\1\0P\0\0:\0<\0\230\5\2\0\22\0\24\0\300\5\2\0\0P\0\0\377\377\0\0\344!\30\0\270Z\374ws\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00446   484   NtReadVirtualMemory  (88, 0x20598, 60, ...  (88, 0x20598, 60, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0l\0s\0a\0s\0s\0.\0e\0x\0e\0\0\0", 60, ) , 60, ) == 0x0
 00447   484   NtClose  (88, ... ) == 0x0
 00448   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {844, 0}, ... 88, ) == 0x0
 00449   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=844,ParentPid=660,}, 0x0, ) == 0x0
 00450   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00451   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00452   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00453   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0t)\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00454   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00455   484   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0X"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\274*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00456   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\344!\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00457   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30&\30\0x%\30\0\0\0\205uj\5\206u\0 \4\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\14\0\1\0\0\0$/\30\0D!\30\0\31\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00458   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0<\0\0\0\344&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00459   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\310 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\330$\30\0\230#\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\10\0\22\0\0\0\304#\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00460   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) \30\0X (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\370"\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\22\0\0\0\214'\30\0$#\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00461   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0x%\30\0\330$\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\04\0\0\0D&\30\0\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00462   484   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\08$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\0\0\36\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00463   484   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "\10&\30\0\310$\30\0\20&\30\0\320$\30\0\270!\30\08$\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0 %\30\0\26\0\30\0H%\30\0\6@\14\0\5\0\0\0\304/\30\0\374\36\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00464   484   NtReadVirtualMemory  (88, 0x182608, 76, ...  (88, 0x182608, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\270!\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\300%\30\0\26\0\30\0\350%\30\0\4@\14\0\1\0\0\0\0[\374wd$\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00465   484   NtReadVirtualMemory  (88, 0x1826a8, 76, ...  (88, 0x1826a8, 76, ... "P'\30\0\10&\30\0X'\30\0\20&\30\0`'\30\0\30&\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\4@\10\0\5\0\0\0\24*\30\0\204"\30\01\376};\0\0\0\0", 76, ) \30\01\376};\0\0\0\0", 76, ) == 0x0
 00466   484   NtReadVirtualMemory  (88, 0x182750, 76, ...  (88, 0x182750, 76, ... "\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0(\30\0\270&\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\0'\30\0\30\0\32\0('\30\0\4@\14\0\1\0\0\0\244,\30\0\304#\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00467   484   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "\230(\30\0P'\30\0\240(\30\0X'\30\0\330+\30\0`'\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\250'\30\0\24\0\26\0\320'\30\0\4@\14\0\3\0\0\0\246\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00468   484   NtReadVirtualMemory  (88, 0x182898, 76, ...  (88, 0x182898, 76, ... "8)\30\0\360'\30\0@)\30\0\370'\30\0\2509\30\0H)\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00469   484   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\330)\30\0\230(\30\0\340)\30\0\240(\30\0\250(\30\0\2504\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\360(\30\0\24\0\26\0\30)\30\0\6@\14\0\1\0\0\0\4,\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00470   484   NtReadVirtualMemory  (88, 0x1829d8, 76, ...  (88, 0x1829d8, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\2101\30\0@0\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\220)\30\0\24\0\26\0\270)\30\0\6@\14\0\1\0\0\0T7\30\0\344&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00471   484   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\330)\30\0(+\30\0\340)\30\0\370.\30\0X.\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\00*\30\0\30\0\32\0X*\30\0\6@\14\0\1\0\0\0\+\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00472   484   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\20-\30\0x,\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\330*\30\0\26\0\30\0\0+\30\0\6@\10\0\1\0\0\0<-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00473   484   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0x,\30\0\0(\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\14\0\6\0\0\0\310Z\374wt)\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00474   484   NtReadVirtualMemory  (88, 0x182c68, 76, ...  (88, 0x182c68, 76, ... "\0-\30\0\310+\30\0\10-\30\0\320+\30\00+\30\0\330+\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\10\0\2\0\0\0\2243\30\0\214'\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00475   484   NtReadVirtualMemory  (88, 0x182d00, 76, ...  (88, 0x182d00, 76, ... "\240-\30\0h,\30\0\250-\30\0p,\30\0\260-\30\00+\30\0\0\0\262v<-\262v\0P\1\06\08\0\300,\30\0\16\0\20\0\350,\30\0\6@\14\0\1\0\0\0`Z\374w\+\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00476   484   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0X.\30\0\20-\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0X-\30\0\22\0\24\0\200-\30\0\6@\10\0\13\0\0\0\204.\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00477   484   NtReadVirtualMemory  (88, 0x182e48, 76, ...  (88, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\220*\30\0\260-\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\10\0\6\0\0\0\320Z\374w\334-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00478   484   NtReadVirtualMemory  (88, 0x182ee8, 76, ...  (88, 0x182ee8, 76, ... "\210/\30\0H.\30\0\220/\30\0P.\30\0\230/\30\0\220*\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\14\0\4\0\0\0\241\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00479   484   NtReadVirtualMemory  (88, 0x182f88, 76, ...  (88, 0x182f88, 76, ... "00\30\0\350.\30\080\30\0\360.\30\0@0\30\0\370.\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0@/\30\0\24\0\26\0h/\30\0\6@\10\0\1\0\0\0l0\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00480   484   NtReadVirtualMemory  (88, 0x183030, 76, ...  (88, 0x183030, 76, ... "\3300\30\0\210/\30\0\3400\30\0\220/\30\0\350)\30\0\230/\30\0\0\0gv8\25gv\0@\16\0@\0B\0\340/\30\0\30\0\32\0\100\30\0\6@\10\0\1\0\0\0\3642\30\0\304/\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00481   484   NtReadVirtualMemory  (88, 0x1830d8, 76, ...  (88, 0x1830d8, 76, ... "x1\30\000\30\0\2001\30\080\30\0\104\30\0(2\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\2100\30\0\30\0\32\0\2600\30\0\6@\14\0\2\0\0\0\2641\30\0$/\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00482   484   NtReadVirtualMemory  (88, 0x183178, 76, ...  (88, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0\3102\30\0\350)\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\001\30\0\24\0\26\0X1\30\0\6@\14\0\2\0\0\0\304;\30\0\241\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00483   484   NtReadVirtualMemory  (88, 0x183218, 76, ...  (88, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0\3500\30\0h3\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\3201\30\0\24\0\26\0\3701\30\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00484   484   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\302\30\0`3\30\0 2\30\0h3\30\0\2101\30\0\0\0-w\306@-w\00\6\0>\0@\0p2\30\0\26\0\30\0\2302\30\0\6@\14\0\6\0\0\044\30\0l0\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00485   484   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0(2\30\0\3102\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\203\30\0\22\0\24\083\30\0\6@\14\0\2\0\0\0\3244\30\0\244,\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00486   484   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0@5\30\0\3500\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2603\30\0\26\0\30\0\3303\30\0\6@\10\0\1\0\0\0\360Z\374w\3642\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00487   484   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "05\30\0\3703\30\085\30\0\04\30\0H)\30\0\3207\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0P4\30\0\24\0\26\0x4\30\0\6@\14\0\1\0\0\0l5\30\0\2243\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00488   484   NtReadVirtualMemory  (88, 0x183530, 76, ...  (88, 0x183530, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\3505\30\0\104\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\3604\30\0\16\0\20\0\305\30\0\6@\0\0\1\0\0\0\3747\30\0\3244\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00489   484   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0(7\30\0@5\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\14\0\1\0\0\0xZ\374w,(\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00490   484   NtReadVirtualMemory  (88, 0x183678, 76, ...  (88, 0x183678, 76, ... "\307\30\0\3305\30\0 7\30\0\3405\30\0p8\30\0(7\30\0\0\0,vN\25,v\0\240\10\0>\0@\006\30\0\26\0\30\0X6\30\0\6@\10\0\1\0\0\0\3249\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00491   484   NtReadVirtualMemory  (88, 0x183718, 76, ...  (88, 0x183718, 76, ... "\3007\30\0x6\30\0\3107\30\0\2006\30\0\2106\30\0\3505\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3206\30\0\24\0\26\0\3706\30\0\6@\14\0\1\0\0\0\300Z\374w\24*\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00492   484   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0\307\30\0h8\30\0 7\30\0\2504\30\0p8\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0p7\30\0\30\0\32\0\2307\30\0\6@\0\0\1\0\0\0\2348\30\0l5\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00493   484   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\2309\30\0\3007\30\0\2409\30\0\3107\30\0\3207\30\0\2106\30\0\0\06v\240\206v\0\360\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\6@\10\0\2\0\0\0\34;\30\0\3747\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00494   484   NtReadVirtualMemory  (88, 0x183998, 76, ...  (88, 0x183998, 76, ... "@:\30\0`8\30\0H:\30\0h8\30\0P:\30\0\250(\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\2708\30\0\30\0\32\0v9\30\0\4@\14\20\2\0\0\0|:\30\0\2646\30\02\376};\360e\12\0", 76, ) , 76, ) == 0x0
 00495   484   NtReadVirtualMemory  (88, 0x183a40, 76, ...  (88, 0x183a40, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\360:\30\0\2509\30\0\0\04wY\324w\0\260\10\0@\0B\0\3609\30\0\30\0\32\0\30:\30\0\4@\14\0\1\0\0\0d<\30\0\3249\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00496   484   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\210;\30\0@:\30\0\220;\30\0H:\30\0\230;\30\0P:\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\230:\30\0\24\0\26\0\300:\30\0\4@\14\0\1\0\0\0\20[\374w\2348\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00497   484   NtReadVirtualMemory  (88, 0x183b88, 76, ...  (88, 0x183b88, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\330<\30\0\360:\30\0\0\0\374v!\21\374v\0P\0\0@\0B\08;\30\0\30\0\32\0`;\30\0\4@\14\0\1\0\0\0\350Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00498   484   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\210;\30\0\320<\30\0\220;\30\0\254\36\30\0x=\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\340;\30\0\26\0\30\0\10<\30\0\4@\14\0\2\0\0\0\4=\30\0|:\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00499   484   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0\230;\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\200<\30\0\24\0\26\0\250<\30\0\6@\14\0\2\0\0\0pZ\374wd<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00500   484   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\234\36\30\0\310<\30\0\244\36\30\0\320<\30\08<\30\0\330<\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0 =\30\0\26\0\30\0H=\30\0\6@\10\0\2\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00501   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=844,ParentPid=660,}, 0x0, ) == 0x0
 00502   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00503   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00504   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\244%\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00505   484   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00506   484   NtClose  (88, ... ) == 0x0
 00507   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {964, 0}, ... 88, ) == 0x0
 00508   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=964,ParentPid=660,}, 0x0, ) == 0x0
 00509   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00510   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00511   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00512   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364+\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00513   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00514   484   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<-\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00515   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\41\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00516   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\265\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\265\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\265\0\0\0d0\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00517   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0F\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0F\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0F\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0F\1\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00518   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\205\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\205\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\205\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\205\2\0\049\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00519   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0x%\30\0\330$\30\0\0\0\275vG"\276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) \276v\0\340\1\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\10\0\2\0\0\0\4%\30\0\374\36\30\0\23\376};\0\0\0\0", 76, ) == 0x0
 00520   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0:\2\0\0\224,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00521   484   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "h%\30\0($\30\0p%\30\00$\30\0\230#\30\08$\30\0\0\0-w\306@-w\00\6\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0C\0\0\0\244%\30\0\304#\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00522   484   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "\240&\30\0\310$\30\0\250&\30\0\320$\30\0\260&\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0 %\30\0\26\0\30\0H%\30\0\4@\10\0\24\0\0\0\2441\30\0\4%\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00523   484   NtReadVirtualMemory  (88, 0x1826a0, 76, ...  (88, 0x1826a0, 76, ... "H'\30\0h%\30\0P'\30\0p%\30\0X'\30\0x%\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\300%\30\0\30\0\32\0~&\30\0\4@\14\20\11\0\0\0\204'\30\0pZ\374w2\376};H\315\10\0", 76, ) , 76, ) == 0x0
 00524   484   NtReadVirtualMemory  (88, 0x182748, 76, ...  (88, 0x182748, 76, ... "\350'\30\0\240&\30\0\360'\30\0\250&\30\0\370'\30\0\260&\30\0\0\04wY\324w\0\260\10\0@\0B\0\370&\30\0\30\0\32\0 '\30\0\4@\14\0\1\0\0\0L7\30\0\334&\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00525   484   NtReadVirtualMemory  (88, 0x1827e8, 76, ...  (88, 0x1827e8, 76, ... "\220(\30\0H'\30\0\230(\30\0P'\30\0\200*\30\0X'\30\0\0\06v\240\206v\0\360\0\0<\0>\0\240'\30\0\24\0\26\0\310'\30\0\4@\10\0#\0\0\0\14*\30\0\20[\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00526   484   NtReadVirtualMemory  (88, 0x182890, 76, ...  (88, 0x182890, 76, ... "0)\30\0\350'\30\08)\30\0\360'\30\0\109\30\0(+\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0@(\30\0\30\0\32\0h(\30\0\4@\14\0\17\0\0\0l)\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00527   484   NtReadVirtualMemory  (88, 0x182930, 76, ...  (88, 0x182930, 76, ... "\320)\30\0\220(\30\0\330)\30\0\230(\30\0X.\30\0\340)\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350(\30\0\24\0\26\0\20)\30\0\6@\14\0\21\0\0\0lS\30\0\314(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00528   484   NtReadVirtualMemory  (88, 0x1829d0, 76, ...  (88, 0x1829d0, 76, ... "p*\30\00)\30\0x*\30\08)\30\0@)\30\0\200*\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210)\30\0\24\0\26\0\260)\30\0\6@\10\0g\0\0\0\254*\30\0$(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00529   484   NtReadVirtualMemory  (88, 0x182a70, 76, ...  (88, 0x182a70, 76, ... "\30+\30\0\320)\30\0 +\30\0\330)\30\0\340)\30\0\370'\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(*\30\0\26\0\30\0P*\30\0\6@\14\0.\0\0\0$/\30\0\14*\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00530   484   NtReadVirtualMemory  (88, 0x182b18, 76, ...  (88, 0x182b18, 76, ... "\270+\30\0p*\30\0\300+\30\0x*\30\0\240(\30\0\310+\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310*\30\0\30\0\32\0\360*\30\0\6@\14\0!\0\0\0\C\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00531   484   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0(+\30\0\3505\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p+\30\0\24\0\26\0\230+\30\0\6@\14\0\15\0\0\0\204.\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00532   484   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\0-\30\0\270+\30\0\10-\30\0\300+\30\0h3\30\0 2\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20,\30\0\24\0\26\08,\30\0\6@\14\0\17\0\0\0\3547\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00533   484   NtReadVirtualMemory  (88, 0x182d00, 76, ...  (88, 0x182d00, 76, ... "\240-\30\0X,\30\0\250-\30\0`,\30\0\3300\30\080\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260,\30\0\30\0\32\0\330,\30\0\6@\14\0\20\0\0\0\334-\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00534   484   NtReadVirtualMemory  (88, 0x182da0, 76, ...  (88, 0x182da0, 76, ... "H.\30\0\0-\30\0P.\30\0\10-\30\0\220/\30\0\370.\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X-\30\0\26\0\30\0\200-\30\0\6@\10\0\20\0\0\0\274/\30\0<-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00535   484   NtReadVirtualMemory  (88, 0x182e48, 76, ...  (88, 0x182e48, 76, ... "\350.\30\0\240-\30\0\360.\30\0\250-\30\0\370.\30\0@)\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370-\30\0\30\0\32\0 .\30\0\6@\14\0d\0\0\0\214?\30\0\364+\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00536   484   NtReadVirtualMemory  (88, 0x182ee8, 76, ...  (88, 0x182ee8, 76, ... "\200/\30\0H.\30\0\210/\30\0P.\30\0\260-\30\0X.\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240.\30\0\26\0\30\0\310.\30\0\6@\10\0\27\0\0\0\3244\30\0\254*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00537   484   NtReadVirtualMemory  (88, 0x182f80, 76, ...  (88, 0x182f80, 76, ... "(0\30\0\350.\30\000\30\0\360.\30\080\30\0\260-\30\0\0\0\262v<-\262v\0P\1\06\08\0@/\30\0\16\0\20\0h/\30\0\6@\14\0\23\0\0\0\244D\30\0\334-\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00538   484   NtReadVirtualMemory  (88, 0x183028, 76, ...  (88, 0x183028, 76, ... "\3100\30\0\200/\30\0\3200\30\0\210/\30\0\20-\30\0\220/\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\330/\30\0\30\0\32\0\00\30\0\6@\10\0t\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00539   484   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "h1\30\0(0\30\0p1\30\000\30\0x1\30\0\20-\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\2000\30\0\26\0\30\0\2500\30\0\6@\14\0-\0\0\0\3642\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00540   484   NtReadVirtualMemory  (88, 0x183168, 76, ...  (88, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\6@\10\0\21\0\0\0L2\30\0\244%\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00541   484   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2702\30\0h1\30\0\3002\30\0p1\30\0h,\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\6@\10\0\24\0\0\0t5\30\0\2441\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00542   484   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "X3\30\0\202\30\0`3\30\0\302\30\0H5\30\0\104\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0h2\30\0\30\0\32\0\2202\30\0\6@\14\0\20\0\0\0\2243\30\0\41\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00543   484   NtReadVirtualMemory  (88, 0x183358, 76, ...  (88, 0x183358, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\2504\30\0h,\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\203\30\0\24\0\26\083\30\0\6@\14\0\21\0\0\0\3249\30\0\3642\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00544   484   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0X3\30\0\2404\30\0`3\30\0\3102\30\0\2504\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\2603\30\0\24\0\26\0\3303\30\0\6@\10\0\20\0\0\0TO\30\0\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00545   484   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\104\30\0h3\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0P4\30\0\22\0\24\0x4\30\0\6@\14\0\17\0\0\0\246\30\0$/\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00546   484   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2006\30\0\3102\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\14\08\0\0\0\34;\30\0L2\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00547   484   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "p6\30\085\30\0x6\30\0@5\30\0\310+\30\0h8\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\15\0\0\0\2546\30\0\3244\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00548   484   NtReadVirtualMemory  (88, 0x183670, 76, ...  (88, 0x183670, 76, ... "\207\30\0\3305\30\0\307\30\0\3405\30\0\3007\30\0H5\30\0\0\0\323v\0\0\0\0\0@\0\06\08\006\30\0\16\0\20\0X6\30\0\6@\0\0\15\0\0\0\2248\30\0\246\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00549   484   NtReadVirtualMemory  (88, 0x183710, 76, ...  (88, 0x183710, 76, ... "\2607\30\0p6\30\0\2707\30\0x6\30\0h8\30\0\3007\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3106\30\0\26\0\30\0\3606\30\0\6@\10\0\31\0\0\0,@\30\0\204'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00550   484   NtReadVirtualMemory  (88, 0x1837b0, 76, ...  (88, 0x1837b0, 76, ... "X8\30\0\207\30\0`8\30\0\307\30\0 7\30\0\2006\30\0\0\0*v\\20*v\0\360\0\0<\0>\0h7\30\0\24\0\26\0\2207\30\0\6@\14\0\23\0\0\0\244=\30\0\224,\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00551   484   NtReadVirtualMemory  (88, 0x183858, 76, ...  (88, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\3505\30\0 7\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\108\30\0\30\0\32\008\30\0\6@\0\0\21\0\0\0d<\30\0\2546\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00552   484   NtReadVirtualMemory  (88, 0x1838f8, 76, ...  (88, 0x1838f8, 76, ... "\2309\30\0X8\30\0\2409\30\0`8\30\0\2509\30\0\240(\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\3\0\0\0\274;\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00553   484   NtReadVirtualMemory  (88, 0x183998, 76, ...  (88, 0x183998, 76, ... "8:\30\0\3708\30\0@:\30\0\09\30\0\220;\30\0\109\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0P9\30\0\24\0\26\0x9\30\0\4@\14\0\1\0\0\0t:\30\0\2243\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00554   484   NtReadVirtualMemory  (88, 0x183a38, 76, ...  (88, 0x183a38, 76, ... "\340:\30\0\2309\30\0\350:\30\0\2409\30\0\330<\30\08<\30\0\0\0\361t\1\225\361t\0\0\1\0<\0>\0\3609\30\0\24\0\26\0\30:\30\0\4@\14\0\1\0\0\0\4=\30\0\3249\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00555   484   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\08:\30\0\210;\30\0@:\30\08<\30\0\220;\30\0\0\0\177v\345\23\177v\0@\2\0@\0B\0\220:\30\0\30\0\32\0\270:\30\0\6@\14\0\1\0\0\0\24B\30\0t5\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00556   484   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... "(<\30\0\340:\30\00<\30\0\350:\30\0\360:\30\0\2509\30\0\0\0\247uM\31\247u\00\12\0>\0@\08;\30\0\26\0\30\0`;\30\0\6@\14\0\14\0\0\0\274c\30\049\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00557   484   NtReadVirtualMemory  (88, 0x183c28, 76, ...  (88, 0x183c28, 76, ... "\310<\30\0\200;\30\0\320<\30\0\210;\30\0H:\30\0\360:\30\0\0\0=r\240\22=r\0\240\1\0@\0B\0\330;\30\0\30\0\32\0\0<\30\0\6@\10\0\1\0\0\0\354>\30\0\2248\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00558   484   NtReadVirtualMemory  (88, 0x183cc8, 76, ...  (88, 0x183cc8, 76, ... "h=\30\0(<\30\0p=\30\00<\30\0x=\30\0H:\30\0\0\0\363t\0\0\0\0\0\300\0\0>\0@\0\200<\30\0\26\0\30\0\250<\30\0\4@\0\0\1\0\0\0\314\\30\0t:\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00559   484   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\10>\30\0\310<\30\0\20>\30\0\320<\30\0\30>\30\0\330<\30\0\0\0\321v\0\0\0\0\0\320\1\0<\0>\0 =\30\0\24\0\26\0H=\30\0\4@\0\0\1\0\0\0D>\30\0\3547\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00560   484   NtReadVirtualMemory  (88, 0x183e08, 76, ...  (88, 0x183e08, 76, ... "\260>\30\0h=\30\0\270>\30\0p=\30\0\300>\30\0x=\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\6\0\0\0\374C\30\0\244=\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00561   484   NtReadVirtualMemory  (88, 0x183eb0, 76, ...  (88, 0x183eb0, 76, ... "P?\30\0\10>\30\0X?\30\0\20>\30\0`?\30\0\30>\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0`>\30\0\30\0\32\0\210>\30\0\4@\14\0\1\0\0\0DE\30\0d<\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00562   484   NtReadVirtualMemory  (88, 0x183f50, 76, ...  (88, 0x183f50, 76, ... "\360?\30\0\260>\30\0\370?\30\0\270>\30\0\240@\30\0\300>\30\0\0\0\316v\353\23\316v\0\360\1\0>\0@\0\10?\30\0\26\0\30\00?\30\0\4@\14\0\1\0\0\0\264B\30\0\204.\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00563   484   NtReadVirtualMemory  (88, 0x183ff0, 76, ...  (88, 0x183ff0, 76, ... "\220@\30\0P?\30\0\230@\30\0X?\30\0\210B\30\0@A\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0\250?\30\0\26\0\30\0\320?\30\0\4@\14\0\4\0\0\0\314@\30\0L7\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00564   484   NtReadVirtualMemory  (88, 0x184090, 76, ...  (88, 0x184090, 76, ... "0A\30\0\360?\30\08A\30\0\370?\30\0@A\30\0`?\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0H@\30\0\24\0\26\0p@\30\0\6@\14\0\15\0\0\0\354E\30\0,@\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00565   484   NtReadVirtualMemory  (88, 0x184130, 76, ...  (88, 0x184130, 76, ... "\330A\30\0\220@\30\0\340A\30\0\230@\30\0\0@\30\0\240@\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\350@\30\0\26\0\30\0\20A\30\0\6@\10\0\20\0\0\0\254L\30\0\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00566   484   NtReadVirtualMemory  (88, 0x1841d8, 76, ...  (88, 0x1841d8, 76, ... "xB\30\00A\30\0\200B\30\08A\30\0\320C\30\00C\30\0\0\0\35u\335\243\35u\0\220\2\0@\0B\0\210A\30\0\30\0\32\0\260A\30\0\4@\14\0\1\0\0\0\364O\30\0\34;\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00567   484   NtReadVirtualMemory  (88, 0x184278, 76, ...  (88, 0x184278, 76, ... " C\30\0\330A\30\0(C\30\0\340A\30\00C\30\0\0@\30\0\0\0zv\32\22zv\00\1\0>\0@\00B\30\0\26\0\30\0XB\30\0\6@\14\0\2\0\0\0|b\30\0\214?\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00568   484   NtReadVirtualMemory  (88, 0x184320, 76, ...  (88, 0x184320, 76, ... "\300C\30\0xB\30\0\310C\30\0\200B\30\0\350A\30\0\210B\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0\320B\30\0\30\0\32\0\370B\30\0\6@\14\0\3\0\0\0\354_\30\0T+\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00569   484   NtReadVirtualMemory  (88, 0x1843c0, 76, ...  (88, 0x1843c0, 76, ... "hD\30\0 C\30\0pD\30\0(C\30\0xD\30\0\350A\30\0\0\0\365t\10\21\365t\0P\0\0<\0>\0xC\30\0\24\0\26\0\240C\30\0\4@\14\0\1\0\0\0dJ\30\0D>\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00570   484   NtReadVirtualMemory  (88, 0x184468, 76, ...  (88, 0x184468, 76, ... "\10E\30\0\300C\30\0\20E\30\0\310C\30\0\30E\30\0\320C\30\0\0\0\213p\275#\213p\0\300\0\0@\0B\0\30D\30\0\30\0\32\0@D\30\0\4@\10\0\1\0\0\0\254T\30\0\274/\30\0>\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00571   484   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\260E\30\0hD\30\0\270E\30\0pD\30\0hF\30\0xD\30\0\0\0\27u\0\0\0\0\0\0\2\0<\0>\0\300D\30\0\24\0\26\0\350D\30\0\4@\0\0\1\0\0\0\224F\30\0\354>\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00572   484   NtReadVirtualMemory  (88, 0x1845b0, 76, ...  (88, 0x1845b0, 76, ... "XF\30\0\10E\30\0`F\30\0\20E\30\0\220I\30\0\350H\30\0\0\0\372t~\23\372t\0\0\1\0@\0B\0`E\30\0\30\0\32\0\210E\30\0\4@\14\0\1\0\0\04G\30\0\314@\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00573   484   NtReadVirtualMemory  (88, 0x184658, 76, ...  (88, 0x184658, 76, ... "\370F\30\0\260E\30\0\0G\30\0\270E\30\0HH\30\0\30E\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0\10F\30\0\30\0\32\00F\30\0\6@\14\0\3\0\0\0tH\30\0DE\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00574   484   NtReadVirtualMemory  (88, 0x1846f8, 76, ...  (88, 0x1846f8, 76, ... "\230G\30\0XF\30\0\240G\30\0`F\30\0\350H\30\0\250G\30\0\0\05u\240\245u\0\0\3\0>\0@\0\260F\30\0\26\0\30\0\330F\30\0\6@\14\0\1\0\0\0\324G\30\0\354E\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00575   484   NtReadVirtualMemory  (88, 0x184798, 76, ...  (88, 0x184798, 76, ... "8H\30\0\370F\30\0@H\30\0\0G\30\0\10G\30\0HH\30\0\0\0Mu$\25Mu\0`\7\0>\0@\0PG\30\0\26\0\30\0xG\30\0\6@\14\0\1\0\0\0\244Y\30\04G\30\0\33\376}; \237\13\0", 76, ) , 76, ) == 0x0
 00576   484   NtReadVirtualMemory  (88, 0x184838, 76, ...  (88, 0x184838, 76, ... "\330H\30\0\230G\30\0\340H\30\0\240G\30\0\250G\30\0hF\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\360G\30\0\26\0\30\0\30H\30\0\6@\10\0\4\0\0\0\274I\30\0\224F\30\0\26\376}; \237\13\0", 76, ) , 76, ) == 0x0
 00577   484   NtReadVirtualMemory  (88, 0x1848d8, 76, ...  (88, 0x1848d8, 76, ... "\200I\30\08H\30\0\210I\30\0@H\30\0\300E\30\0\10G\30\0\0\0qi\320\22qi\0\320\17\0:\0<\0\220H\30\0\22\0\24\0\270H\30\0\6@\10\0\1\0\0\0$R\30\0\200Z\374w\210\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00578   484   NtReadVirtualMemory  (88, 0x184980, 76, ...  (88, 0x184980, 76, ... "(J\30\0\330H\30\00J\30\0\340H\30\08J\30\0\300E\30\0\0\0\354t\0\0\0\0\0P\0\0@\0B\00I\30\0\30\0\32\0XI\30\0\4@\0\0\1\0\0\0\14K\30\0tH\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00579   484   NtReadVirtualMemory  (88, 0x184a28, 76, ...  (88, 0x184a28, 76, ... "\320J\30\0\200I\30\0\330J\30\0\210I\30\0\340K\30\0\220I\30\0\0\0Lr\3662Lr\0\360\0\0@\0B\0\330I\30\0\30\0\32\0\0J\30\0\4@\10\0\1\0\0\0\354M\30\0\374C\30\0,\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00580   484   NtReadVirtualMemory  (88, 0x184ad0, 76, ...  (88, 0x184ad0, 76, ... "\320K\30\0(J\30\0\330K\30\00J\30\0\300M\30\0\200L\30\0\0\0zY7\255zY\0\300\1\0F\0H\0\200J\30\0\24\0\26\0\262J\30\0\4@\14\0\1\0\0\0\14L\30\0\274I\30\0\325\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00581   484   NtReadVirtualMemory  (88, 0x184bd0, 76, ...  (88, 0x184bd0, 76, ... "pL\30\0\320J\30\0xL\30\0\330J\30\0\200L\30\08J\30\0\0\0)u\222\217)u\0\200\3\0J\0L\0xK\30\0\30\0\32\0\252K\30\0\6@\14\0\20\0\0\0LM\30\0\14K\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00582   484   NtReadVirtualMemory  (88, 0x184c70, 76, ...  (88, 0x184c70, 76, ... "\20M\30\0\320K\30\0\30M\30\0\330K\30\0\340J\30\0\340K\30\0\0\0>u\231s@u\0\200\6\0<\0>\0(L\30\0\24\0\26\0PL\30\0\6@\10\0\1\0\0\0\10[\374wlA\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00583   484   NtReadVirtualMemory  (88, 0x184d10, 76, ...  (88, 0x184d10, 76, ... "\260M\30\0pL\30\0\270M\30\0xL\30\0\210N\30\0\300M\30\0\0\0|v\0\0\0\0\0\240\2\0>\0@\0\310L\30\0\26\0\30\0\360L\30\0\4@\0\0\3\0\0\0\14T\30\0\14L\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00584   484   NtReadVirtualMemory  (88, 0x184db0, 76, ...  (88, 0x184db0, 76, ... "xN\30\0\20M\30\0\200N\30\0\30M\30\0 M\30\0\340J\30\0\0\0\10v\0\20\10v\0\20\6\0>\0@\0hM\30\0\26\0\30\0\220M\30\0\6@\14\0\3\0\0\0\354P\30\0dJ\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00585   484   NtReadVirtualMemory  (88, 0x184e78, 76, ...  (88, 0x184e78, 76, ... "\30O\30\0\260M\30\0 O\30\0\270M\30\0(O\30\0 M\30\0\0\0\364t\354!\364t\0\240\0\0^\0b\0\10N\30\0\24\0\30\0RN\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00586   484   NtReadVirtualMemory  (88, 0x184f18, 76, ...  (88, 0x184f18, 76, ... "\270O\30\0xN\30\0\300O\30\0\200N\30\0\310O\30\0\210N\30\0\0\0\7u\24\31\7u\0`\1\0<\0>\0\320N\30\0\24\0\26\0\370N\30\0\4@\14\0\1\0\0\0L_\30\044\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00587   484   NtReadVirtualMemory  (88, 0x184fb8, 76, ...  (88, 0x184fb8, 76, ... "\20P\30\0\30O\30\0\30P\30\0 O\30\0 P\30\0(O\30\0\0\0\32uh\342\32u\0\240\2\0:\0<\0pO\30\0\22\0\24\0\230O\30\0\4@\14\0\1\0\0\0LP\30\0\24B\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00588   484   NtReadVirtualMemory  (88, 0x185010, 76, ...  (88, 0x185010, 76, ... "\260P\30\0\270O\30\0\270P\30\0\300O\30\0\300P\30\0\310O\30\0\0\0\322s\0\0\0\0\0\220\0\0@\0B\0(K\30\0\30\0\32\0PK\30\0\4@\0\0\1\0\0\0\214Q\30\0\364O\30\0$\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00589   484   NtReadVirtualMemory  (88, 0x1850b0, 76, ...  (88, 0x1850b0, 76, ... "PQ\30\0\20P\30\0XQ\30\0\30P\30\0`Q\30\0 P\30\0\0\0\366t\0\0\0\0\0\260\0\0<\0>\0hP\30\0\24\0\26\0\220P\30\0\4@\0\0\1\0\0\0DZ\30\0\354M\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00590   484   NtReadVirtualMemory  (88, 0x185150, 76, ...  (88, 0x185150, 76, ... "\350Q\30\0\260P\30\0\360Q\30\0\270P\30\0\370Q\30\0\300P\30\0\0\0\11u\0\0\0\0\0p\1\0<\0>\0\10Q\30\0\24\0\26\00Q\30\0\4@\0\0\1\0\0\0DU\30\0LP\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00591   484   NtReadVirtualMemory  (88, 0x1851e8, 76, ...  (88, 0x1851e8, 76, ... "\210R\30\0PQ\30\0\220R\30\0XQ\30\0\230R\30\0`Q\30\0\0\0\267v!\226\271v\0\320\3\04\06\0\250Q\30\0\14\0\16\0\320Q\30\0\4@\14\0\3\0\0\0\304R\30\0\24I\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00592   484   NtReadVirtualMemory  (88, 0x185288, 76, ...  (88, 0x185288, 76, ... "0S\30\0\350Q\30\08S\30\0\360Q\30\0@S\30\0\370Q\30\0\0\0\370tg0\370t\0\200\0\0:\0<\0@R\30\0\22\0\24\0hR\30\0\4@\14\0\1\0\0\0Lg\30\0$R\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00593   484   NtReadVirtualMemory  (88, 0x185330, 76, ...  (88, 0x185330, 76, ... "\320S\30\0\210R\30\0\330S\30\0\220R\30\0\200T\30\0\230R\30\0\0\0\371t\0\21\371t\0\220\0\0@\0B\0\340R\30\0\30\0\32\0\10S\30\0\4@\10\0\1\0\0\0xZ\374wl)\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00594   484   NtReadVirtualMemory  (88, 0x1853d0, 76, ...  (88, 0x1853d0, 76, ... "pT\30\00S\30\0xT\30\08S\30\0XV\30\0\30U\30\0\0\0\0u\31\222\0u\0\260\1\0>\0@\0\210S\30\0\26\0\30\0\260S\30\0\4@\14\0\1\0\0\0$W\30\0LM\30\0\35\376};x\237\14\0", 76, ) , 76, ) == 0x0
 00595   484   NtReadVirtualMemory  (88, 0x185470, 76, ...  (88, 0x185470, 76, ... "\10U\30\0\320S\30\0\20U\30\0\330S\30\0\270U\30\0@S\30\0\0\0&u\305H&u\0p\2\0>\0@\0(T\30\0\26\0\30\0PT\30\0\6@\10\0\1\0\0\0\314W\30\0\244D\30\0\34\376};x\237\14\0", 76, ) , 76, ) == 0x0
 00596   484   NtReadVirtualMemory  (88, 0x185508, 76, ...  (88, 0x185508, 76, ... "\250U\30\0pT\30\0\260U\30\0xT\30\0\340S\30\0\270U\30\0\0\0\273v\0\0\0\0\0@\0\06\08\0\310T\30\0\16\0\20\0\360T\30\0\6@\0\0\1\0\0\0\344U\30\0\214Q\30\0\23\376};x\237\14\0", 76, ) , 76, ) == 0x0
 00597   484   NtReadVirtualMemory  (88, 0x1855a8, 76, ...  (88, 0x1855a8, 76, ... "HV\30\0\10U\30\0PV\30\0\20U\30\0\30U\30\0\200T\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0`U\30\0\24\0\26\0\210U\30\0\6@\14\0\2\0\0\0\204V\30\0DU\30\0\22\376};x\237\14\0", 76, ) , 76, ) == 0x0
 00598   484   NtReadVirtualMemory  (88, 0x185648, 76, ...  (88, 0x185648, 76, ... "\350V\30\0\250U\30\0\360V\30\0\260U\30\0\370V\30\0\340S\30\0\0\0-r\201\22-r\0\300\0\08\0:\0\0V\30\0\20\0\22\0(V\30\0\4@\14\0\1\0\0\0\4Y\30\0\344U\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00599   484   NtReadVirtualMemory  (88, 0x1856e8, 76, ...  (88, 0x1856e8, 76, ... "\220W\30\0HV\30\0\230W\30\0PV\30\0\240W\30\0XV\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0\240V\30\0\24\0\26\0\310V\30\0\4@\14\0\1\0\0\0\344Z\30\0\14T\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00600   484   NtReadVirtualMemory  (88, 0x185790, 76, ...  (88, 0x185790, 76, ... "0X\30\0\350V\30\08X\30\0\360V\30\0@X\30\0\370V\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0@W\30\0\30\0\32\0hW\30\0\4@\14\0\1\0\0\0\214`\30\0\254T\30\00\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00601   484   NtReadVirtualMemory  (88, 0x185830, 76, ...  (88, 0x185830, 76, ... "\310X\30\0\220W\30\0\320X\30\0\230W\30\0\330X\30\0\240W\30\0\0\0\376t\0\0\0\0\0\360\0\0>\0@\0\350W\30\0\26\0\30\0\20X\30\0\4@\0\0\1\0\0\0hZ\374whZ\374w\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00602   484   NtReadVirtualMemory  (88, 0x1858c8, 76, ...  (88, 0x1858c8, 76, ... "hY\30\00X\30\0pY\30\08X\30\0\270Z\30\0@X\30\0\0\0\351u\212\23\351u\0\20\12\06\08\0\210X\30\0\16\0\20\0\260X\30\0\4@\10\0\1\0\0\0\d\30\0\204V\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00603   484   NtReadVirtualMemory  (88, 0x185968, 76, ...  (88, 0x185968, 76, ... "\10Z\30\0\310X\30\0\20Z\30\0\320X\30\0\370[\30\0X[\30\0\0\0suh"su\0\320\21\0>\0@\0 Y\30\0\26\0\30\0HY\30\0\4@\14\0\2\0\0\0\204[\30\0\324G\30\0\31\376};\0\0\0\0", 76, ) su\0\320\21\0>\0@\0 Y\30\0\26\0\30\0HY\30\0\4@\14\0\2\0\0\0\204[\30\0\324G\30\0\31\376};\0\0\0\0", 76, ) == 0x0
 00604   484   NtReadVirtualMemory  (88, 0x185a08, 76, ...  (88, 0x185a08, 76, ... "\250Z\30\0hY\30\0\260Z\30\0pY\30\0X[\30\0\270Z\30\0\0\0\17u@\22\17u\0 \1\0<\0>\0\300Y\30\0\24\0\26\0\350Y\30\0\6@\14\0\2\0\0\0l]\30\0\354P\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00605   484   NtReadVirtualMemory  (88, 0x185aa8, 76, ...  (88, 0x185aa8, 76, ... "H[\30\0\10Z\30\0P[\30\0\20Z\30\0\30Z\30\0\330X\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\0`Z\30\0\26\0\30\0\210Z\30\0\6@\0\0\2\0\0\0\254e\30\0$W\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00606   484   NtReadVirtualMemory  (88, 0x185b48, 76, ...  (88, 0x185b48, 76, ... "\350[\30\0\250Z\30\0\360[\30\0\260Z\30\0xY\30\0\30Z\30\0\0\0\23u*\24\23u\00\1\0>\0@\0\0[\30\0\26\0\30\0([\30\0\6@\14\0\2\0\0\0$\\30\0\244Y\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00607   484   NtReadVirtualMemory  (88, 0x185be8, 76, ...  (88, 0x185be8, 76, ... "\220\\30\0H[\30\0\230\\30\0P[\30\0\240\\30\0xY\30\0\0\0\374t\0\0\0\0\0\0\1\0>\0@\0\240[\30\0\26\0\30\0\310[\30\0\4@\0\0\3\0\0\0\34c\30\0\204[\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00608   484   NtReadVirtualMemory  (88, 0x185c90, 76, ...  (88, 0x185c90, 76, ... "0]\30\0\350[\30\08]\30\0\360[\30\0@]\30\0\370[\30\0\0\0\13u\320\21\13u\0\20\1\0@\0B\0@\\30\0\30\0\32\0h\\30\0\4@\14\0\1\0\0\0\254^\30\0\4=\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00609   484   NtReadVirtualMemory  (88, 0x185d30, 76, ...  (88, 0x185d30, 76, ... "\310]\30\0\220\\30\0\320]\30\0\230\\30\0\330]\30\0\240\\30\0\0\0\15uP\21\15u\0p\1\0<\0>\0\350\\30\0\24\0\26\0\20]\30\0\4@\10\0\1\0\0\0\4^\30\0DZ\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00610   484   NtReadVirtualMemory  (88, 0x185dc8, 76, ...  (88, 0x185dc8, 76, ... "p^\30\00]\30\0x^\30\08]\30\0\200^\30\0@]\30\0\0\0@v:\222@v\0\260\37\06\08\0\210]\30\0\16\0\20\0\260]\30\0\4@\14\0\1\0\0\04a\30\0l]\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00611   484   NtReadVirtualMemory  (88, 0x185e70, 76, ...  (88, 0x185e70, 76, ... "\20_\30\0\310]\30\0\30_\30\0\320]\30\0\300_\30\0\330]\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0 ^\30\0\30\0\32\0H^\30\0\4@\14\0\1\0\0\0\324a\30\0\314\\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00612   484   NtReadVirtualMemory  (88, 0x185f10, 76, ...  (88, 0x185f10, 76, ... "\260_\30\0p^\30\0\270_\30\0x^\30\0\250a\30\0\10a\30\0\0\0-u\230`-u\0\240\3\0>\0@\0\310^\30\0\26\0\30\0\360^\30\0\4@\14\0\1\0\0\0\370Z\374wTO\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00613   484   NtReadVirtualMemory  (88, 0x185fb0, 76, ...  (88, 0x185fb0, 76, ... "P`\30\0\20_\30\0X`\30\0\30_\30\0``\30\0\200^\30\0\0\0\367t\0\0\0\0\0P\0\0<\0>\0h_\30\0\24\0\26\0\220_\30\0\6@\0\0\1\0\0\0\240Z\374w\C\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00614   484   NtReadVirtualMemory  (88, 0x186050, 76, ...  (88, 0x186050, 76, ... "\370`\30\0\260_\30\0\0a\30\0\270_\30\0\10a\30\0\300_\30\0\0\0\314v\220\21\314v\0\0\1\0:\0<\0\10`\30\0\22\0\24\00`\30\0\6@\10\0\1\0\0\0`Z\374w\314W\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00615   484   NtReadVirtualMemory  (88, 0x1860f8, 76, ...  (88, 0x1860f8, 76, ... "\230a\30\0P`\30\0\240a\30\0X`\30\0 _\30\0``\30\0\0\0\21u\260Q\21u\0\300\1\0@\0B\0\250`\30\0\30\0\32\0\320`\30\0\6@\14\0\1\0\0\0\300Z\374w\4^\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00616   484   NtReadVirtualMemory  (88, 0x186198, 76, ...  (88, 0x186198, 76, ... "@b\30\0\370`\30\0Hb\30\0\0a\30\0\360b\30\0 _\30\0\0\0\274v\0\21\274v\0\340\0\0<\0>\0Pa\30\0\24\0\26\0xa\30\0\4@\10\0\1\0\0\0\j\30\0\254^\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00617   484   NtReadVirtualMemory  (88, 0x186240, 76, ...  (88, 0x186240, 76, ... "\340b\30\0\230a\30\0\350b\30\0\240a\30\00d\30\0\360b\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0\360a\30\0\30\0\32\0\30b\30\0\4@\14\0\2\0\0\0dk\30\0\264B\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00618   484   NtReadVirtualMemory  (88, 0x1862e0, 76, ...  (88, 0x1862e0, 76, ... "\200c\30\0@b\30\0\210c\30\0Hb\30\0Pb\30\0\250a\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\230b\30\0\24\0\26\0\300b\30\0\6@\14\0\2\0\0\0pZ\374w$\\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00619   484   NtReadVirtualMemory  (88, 0x186380, 76, ...  (88, 0x186380, 76, ... " d\30\0\340b\30\0(d\30\0\350b\30\0\320d\30\00d\30\0\0\0\4u\300\276\4u\0\360\1\08\0:\08c\30\0\20\0\22\0`c\30\0\4@\14\0\1\0\0\0\0[\374w\274;\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00620   484   NtReadVirtualMemory  (88, 0x186420, 76, ...  (88, 0x186420, 76, ... "\300d\30\0\200c\30\0\310d\30\0\210c\30\0\220c\30\0Pb\30\0\0\0\360t\222E\360t\0\240\0\0>\0@\0\330c\30\0\26\0\30\0\0d\30\0\6@\14\0\1\0\0\0\360Z\374w\4Y\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00621   484   NtReadVirtualMemory  (88, 0x1864c0, 76, ...  (88, 0x1864c0, 76, ... "pe\30\0 d\30\0xe\30\0(d\30\0\200e\30\0\220c\30\0\0\0\210hw:\212h\0\360\3\0>\0@\0xd\30\0\26\0\30\0\240d\30\0\4@\14\0\1\0\0\0\230Z\374w\230Z\374wk\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00622   484   NtReadVirtualMemory  (88, 0x186570, 76, ...  (88, 0x186570, 76, ... "pf\30\0\300d\30\0xf\30\0\310d\30\0 h\30\0\320d\30\0\0\0\357t\14\22\357t\0\240\0\0J\0L\0\30e\30\0\30\0\32\0Je\30\0\4@\14\0\1\0\0\0\254f\30\0\344Z\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00623   484   NtReadVirtualMemory  (88, 0x186670, 76, ...  (88, 0x186670, 76, ... "\20g\30\0pe\30\0\30g\30\0xe\30\0\320h\30\0 g\30\0\0\0Eu\26\0Ju\0p\7\0J\0L\0\30f\30\0\30\0\32\0Jf\30\0\4@\14\0\1\0\0\0\374h\30\0\254e\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00624   484   NtReadVirtualMemory  (88, 0x186710, 76, ...  (88, 0x186710, 76, ... "\20h\30\0pf\30\0\30h\30\0xf\30\0\200f\30\0 h\30\0\0\01u\0\2713u\0\300\3\0F\0H\0\310e\30\0\24\0\26\0\372e\30\0\6@\14\0\4\0\0\0\200Z\374w\304R\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00625   484   NtReadVirtualMemory  (88, 0x186810, 76, ...  (88, 0x186810, 76, ... "\300h\30\0\20g\30\0\310h\30\0\30g\30\0 g\30\0\200e\30\0\0\0iu\317\254mu\0 \11\0J\0L\0\270g\30\0\30\0\32\0\352g\30\0\6@\14\0\10\0\0\0\210Z\374w\210Z\374w\32\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00626   484   NtReadVirtualMemory  (88, 0x1868c0, 76, ...  (88, 0x1868c0, 76, ... "pi\30\0\20h\30\0xi\30\0\30h\30\0\200i\30\0\200f\30\0\0\0\355t\16\246\355t\0\360\0\0H\0J\0hh\30\0\26\0\30\0\232h\30\0\4@\10\0\1\0\0\0\254i\30\0\254f\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00627   484   NtReadVirtualMemory  (88, 0x186970, 76, ...  (88, 0x186970, 76, ... " j\30\0\300h\30\0(j\30\0\310h\30\00j\30\0\320h\30\0\0\0\2u\254\365\2u\0\260\1\0J\0L\0\30i\30\0\30\0\32\0Ji\30\0\4@\14\0\1\0\0\0\14k\30\0\374h\30\0\35\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00628   484   NtReadVirtualMemory  (88, 0x186a20, 76, ...  (88, 0x186a20, 76, ... "\320j\30\0pi\30\0\330j\30\0xi\30\08k\30\0\200i\30\0\0\0 uh\251!u\0@\2\0J\0L\0\310i\30\0\30\0\32\0\372i\30\0\4@\14\0\1\0\0\0\14m\30\0\324a\30\0\34\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00629   484   NtReadVirtualMemory  (88, 0x186ad0, 76, ...  (88, 0x186ad0, 76, ... "(k\30\0 j\30\00k\30\0(j\30\0\350k\30\08k\30\0\0\0\177Yy\17\204Y\0p\6\0J\0L\0xj\30\0\30\0\32\0\252j\30\0\4@\14\0\1\0\0\0\24l\30\0\254i\30\0\322\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00630   484   NtReadVirtualMemory  (88, 0x186b28, 76, ...  (88, 0x186b28, 76, ... "\330k\30\0\320j\30\0\340k\30\0\330j\30\0\340j\30\00j\30\0\0\0w_5\21w_\0\340\0\0@\0B\0hg\30\0\30\0\32\0\220g\30\0\6@\10\0\2\0\0\0ll\30\0|b\30\0\223\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00631   484   NtReadVirtualMemory  (88, 0x186bd8, 76, ...  (88, 0x186bd8, 76, ... "0l\30\0(k\30\08l\30\00k\30\0@l\30\0\340j\30\0\0\09u\36\315;u\0 \4\0H\0J\0\200k\30\0\26\0\30\0\262k\30\0\4@\14\0\1\0\0\0\20[\374w\14k\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00632   484   NtReadVirtualMemory  (88, 0x186c30, 76, ...  (88, 0x186c30, 76, ... "\320l\30\0\330k\30\0\330l\30\0\340k\30\0\340l\30\0\350k\30\0\0\0_u\261\245bu\0\20\11\0>\0@\0\310f\30\0\26\0\30\0\360f\30\0\4@\14\0\1\0\0\0\310Z\374wdk\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00633   484   NtReadVirtualMemory  (88, 0x186cd0, 76, ...  (88, 0x186cd0, 76, ... "\234\36\30\00l\30\0\244\36\30\08l\30\0\254\36\30\0@l\30\0\0\0Uu\2017Wu\0\340\11\0<\0>\0\210l\30\0\24\0\26\0\260l\30\0\4@\10\0\1\0\0\0\350Z\374w\j\30\0\33\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00634   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=964,ParentPid=660,}, 0x0, ) == 0x0
 00635   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00636   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00637   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00638   484   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00639   484   NtClose  (88, ... ) == 0x0
 00640   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1068, 0}, ... 88, ) == 0x0
 00641   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1068,ParentPid=660,}, 0x0, ) == 0x0
 00642   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00643   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00644   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00645   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\364&\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00646   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00647   484   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0`"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0<(\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00648   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\260!\30\0h \30\0\270!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\244,\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00649   484   NtReadVirtualMemory  (88, 0x1821b0, 76, ...  (88, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) \30\0\10!\30\0X (88, 0x1821b0, 76, ... "P"\30\0\10!\30\0X"\30\0\20!\30\0\3107\30\0(&\30\0\0\0wv\0\0\0\0\0\320\0\0@\0B\0`!\30\0\30\0\32\0\210!\30\0\4@\0\0\1\0\0\0l$\30\0xZ\374w\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00650   484   NtReadVirtualMemory  (88, 0x182250, 76, ...  (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\260!\30\0\370 (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\00 (88, 0x182250, 76, ... "\360"\30\0\260!\30\0\370"\30\0\270!\30\0\240#\30\0x \30\0\0\0\301wO\351\301w\00\5\0<\0>\0\10"\30\0\24\0\26\00"\30\0\6@\10\0=\0\0\0\224'\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00651   484   NtReadVirtualMemory  (88, 0x1822f0, 76, ...  (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\230#\30\0X (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0\320 (88, 0x1822f0, 76, ... "\220#\30\0P"\30\0\230#\30\0X"\30\0\200%\30\0\240#\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\250"\30\0\24\0\26\0\320"\30\0\6@\14\0B\0\0\0\0[\374w\0[\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00652   484   NtReadVirtualMemory  (88, 0x182390, 76, ...  (88, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\08$\30\0\370 (88, 0x182390, 76, ... "0$\30\0\360"\30\08$\30\0\370"\30\0\0#\30\0`"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0H#\30\0\22\0\24\0p#\30\0\6@\0\0\37\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00653   484   NtReadVirtualMemory  (88, 0x182430, 76, ...  (88, 0x182430, 76, ... "\320$\30\0\220#\30\0\330$\30\0\230#\30\0X)\30\0\340$\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\350#\30\0\24\0\26\0\20$\30\0\6@\14\0\3\0\0\044\30\0\354!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00654   484   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\00$\30\0x%\30\08$\30\0@$\30\0\200%\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\210$\30\0\24\0\26\0\260$\30\0\6@\10\0\16\0\0\0\254%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00655   484   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0\340$\30\0\0#\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0(%\30\0\26\0\30\0P%\30\0\6@\14\0\10\0\0\0$*\30\0\14%\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00656   484   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\300!\30\0\310&\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00657   484   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0(&\30\0\3102\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0p&\30\0\24\0\26\0\230&\30\0\6@\14\0\2\0\0\0\204)\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00658   484   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0\10/\30\0\300-\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\20'\30\0\24\0\26\08'\30\0\6@\14\0\2\0\0\0t5\30\0\214"\30\0\22\376};\0\0\0\0", 76, ) \30\0\22\376};\0\0\0\0", 76, ) == 0x0
 00659   484   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0x,\30\0\330+\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\2\0\0\0\334(\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00660   484   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "H)\30\0\0(\30\0P)\30\0\10(\30\0\220*\30\0\370)\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\274*\30\0<(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00661   484   NtReadVirtualMemory  (88, 0x182948, 76, ...  (88, 0x182948, 76, ... "\350)\30\0\240(\30\0\360)\30\0\250(\30\0\370)\30\0@$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\370(\30\0\30\0\32\0 )\30\0\6@\14\0\13\0\0\0\310Z\374w\364&\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00662   484   NtReadVirtualMemory  (88, 0x1829e8, 76, ...  (88, 0x1829e8, 76, ... "\200*\30\0H)\30\0\210*\30\0P)\30\0\260(\30\0X)\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\240)\30\0\26\0\30\0\310)\30\0\6@\10\0\2\0\0\0\241\30\0\254%\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00663   484   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\350)\30\0(+\30\0\360)\30\00+\30\0\260(\30\0\0\0\262v<-\262v\0P\1\06\08\0@*\30\0\16\0\20\0h*\30\0\6@\14\0\2\0\0\0`Z\374w\334(\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00664   484   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\330*\30\0\22\0\24\0\0+\30\0\6@\10\0\15\0\0\0\4,\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00665   484   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "h,\30\0 +\30\0p,\30\0(+\30\0\20(\30\00+\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\10\0\0\0\320Z\374w\+\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00666   484   NtReadVirtualMemory  (88, 0x182c68, 76, ...  (88, 0x182c68, 76, ... "\10-\30\0\310+\30\0\20-\30\0\320+\30\0\30-\30\0\20(\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0 ,\30\0\26\0\30\0H,\30\0\6@\14\0\7\0\0\0\224.\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00667   484   NtReadVirtualMemory  (88, 0x182d08, 76, ...  (88, 0x182d08, 76, ... "\260-\30\0h,\30\0\270-\30\0p,\30\0\300-\30\0x,\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\300,\30\0\24\0\26\0\350,\30\0\6@\10\0\2\0\0\0\354-\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00668   484   NtReadVirtualMemory  (88, 0x182db0, 76, ...  (88, 0x182db0, 76, ... "X.\30\0\10-\30\0`.\30\0\20-\30\0h'\30\0\30-\30\0\0\0gv8\25gv\0@\16\0@\0B\0`-\30\0\30\0\32\0\210-\30\0\6@\10\0\2\0\0\0t0\30\0D-\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00669   484   NtReadVirtualMemory  (88, 0x182e58, 76, ...  (88, 0x182e58, 76, ... "\370.\30\0\260-\30\0\0/\30\0\270-\30\0\2101\30\0\250/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\10.\30\0\30\0\32\00.\30\0\6@\14\0\3\0\0\04/\30\0\244,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00670   484   NtReadVirtualMemory  (88, 0x182ef8, 76, ...  (88, 0x182ef8, 76, ... "\230/\30\0X.\30\0\240/\30\0`.\30\0H0\30\0h'\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\260.\30\0\24\0\26\0\330.\30\0\6@\14\0\3\0\0\0\350Z\374w\224.\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00671   484   NtReadVirtualMemory  (88, 0x182f98, 76, ...  (88, 0x182f98, 76, ... "80\30\0\370.\30\0@0\30\0\0/\30\0h.\30\0\3500\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0P/\30\0\24\0\26\0x/\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00672   484   NtReadVirtualMemory  (88, 0x183038, 76, ...  (88, 0x183038, 76, ... "\3300\30\0\230/\30\0\3400\30\0\240/\30\0\3500\30\0\10/\30\0\0\0-w\306@-w\00\6\0>\0@\0\360/\30\0\26\0\30\0\300\30\0\6@\14\0\11\0\0\0\2641\30\0\354-\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00673   484   NtReadVirtualMemory  (88, 0x1830d8, 76, ...  (88, 0x1830d8, 76, ... "x1\30\080\30\0\2001\30\0@0\30\0\250/\30\0H0\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2200\30\0\22\0\24\0\2700\30\0\6@\14\0\3\0\0\0\3642\30\0$*\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00674   484   NtReadVirtualMemory  (88, 0x183178, 76, ...  (88, 0x183178, 76, ... "\302\30\0\3300\30\0 2\30\0\3400\30\0(2\30\0h.\30\0\0\0=w\24 ?w\0@\177\0>\0@\001\30\0\26\0\30\0X1\30\0\6@\10\0\2\0\0\0T2\30\0t0\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00675   484   NtReadVirtualMemory  (88, 0x183218, 76, ...  (88, 0x183218, 76, ... "\2702\30\0x1\30\0\3002\30\0\2001\30\0`3\30\0\2101\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3201\30\0\26\0\30\0\3701\30\0\6@\14\0\6\0\0\0\360Z\374w\2641\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00676   484   NtReadVirtualMemory  (88, 0x1832b8, 76, ...  (88, 0x1832b8, 76, ... "P3\30\0\302\30\0X3\30\0 2\30\0\310&\30\0\3605\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0p2\30\0\24\0\26\0\2302\30\0\6@\14\0\2\0\0\0\2143\30\0\241\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00677   484   NtReadVirtualMemory  (88, 0x183350, 76, ...  (88, 0x183350, 76, ... "\3703\30\0\2702\30\0\04\30\0\3002\30\0\104\30\0(2\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\203\30\0\16\0\20\083\30\0\6@\0\0\2\0\0\0\346\30\0\3642\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00678   484   NtReadVirtualMemory  (88, 0x1833f8, 76, ...  (88, 0x1833f8, 76, ... "\2304\30\0P3\30\0\2404\30\0X3\30\0H5\30\0`3\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2503\30\0\30\0\32\0\3203\30\0\6@\14\0\2\0\0\0xZ\374wl$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00679   484   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3703\30\0@5\30\0\04\30\0\2206\30\0H5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0P4\30\0\26\0\30\0x4\30\0\6@\10\0\2\0\0\0\3647\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00680   484   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3405\30\0\2304\30\0\3505\30\0\2404\30\0\2504\30\0\104\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3604\30\0\24\0\26\0\305\30\0\6@\14\0\2\0\0\0<9\30\0\224'\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00681   484   NtReadVirtualMemory  (88, 0x1835e0, 76, ...  (88, 0x1835e0, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0\3102\30\0\2206\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2205\30\0\30\0\32\0\2705\30\0\6@\0\0\2\0\0\0\2746\30\0\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00682   484   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... "\2707\30\0\3405\30\0\3007\30\0\3505\30\0\3605\30\0\2504\30\0\0\06v\240\206v\0\360\0\0<\0>\086\30\0\24\0\26\0`6\30\0\6@\10\0\4\0\0\0\3449\30\0\346\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00683   484   NtReadVirtualMemory  (88, 0x1837b8, 76, ...  (88, 0x1837b8, 76, ... "`8\30\0\2006\30\0h8\30\0\2106\30\0p8\30\0\300!\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3306\30\0\30\0\32\0\2267\30\0\4@\14\20\2\0\0\0\2348\30\0\3244\30\02\376};\200x\10\0", 76, ) , 76, ) == 0x0
 00684   484   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\2707\30\0\109\30\0\3007\30\0\209\30\0\3107\30\0\0\04wY\324w\0\260\10\0@\0B\0\208\30\0\30\0\32\088\30\0\4@\14\0\1\0\0\0pZ\374w\3647\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00685   484   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\2709\30\0p8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2708\30\0\26\0\30\0\3408\30\0\4@\10\0\2\0\0\0\300Z\374wt5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00686   484   NtReadVirtualMemory  (88, 0x1839a8, 76, ...  (88, 0x1839a8, 76, ... "\234\36\30\0\09\30\0\244\36\30\0\109\30\0\254\36\30\0\209\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\4@\14\0\1\0\0\0\20[\374w\2746\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00687   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1068,ParentPid=660,}, 0x0, ) == 0x0
 00688   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00689   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00690   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0D-\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00691   484   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00692   484   NtClose  (88, ... ) == 0x0
 00693   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1088, 0}, ... 88, ) == 0x0
 00694   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 00695   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00696   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00697   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00698   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00699   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "h \30\0\30\37\30\0p \30\0 \37\30\0\30!\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00700   484   NtReadVirtualMemory  (88, 0x182068, 76, ...  (88, 0x182068, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\370"\30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\30 \30\0\30\0\32\0@ \30\0\6@\10\0\377\377\0\0\364&\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00701   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0h \30\0\260!\30\0p \30\0x \30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\300 \30\0\24\0\26\0\350 \30\0\6@\10\0\377\377\0\0\274*\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00702   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\08$\30\0X"\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0`!\30\0\22\0\24\0\210!\30\0\4@\10\0\20\0\0\0\34*\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00703   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\04\0\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00704   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0x \30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0[\0\0\0D>\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00705   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\3007\30\0\340$\30\0\0\0\304t\0\0\0\0\0`\0\0<\0>\0@#\30\0\24\0\26\0h#\30\0\4@\0\0\1\0\0\0\270Z\374w\270Z\374w\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00706   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\20(\30\0\270!\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0r\0\0\0L&\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00707   484   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\230#\30\0\200%\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\6\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00708   484   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\20&\30\0\320$\30\0\30&\30\0\330$\30\0\340$\30\0 2\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%\30\0\24\0\26\0P%\30\0\6@\14\0\2\0\0\0<(\30\0T\37\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00709   484   NtReadVirtualMemory  (88, 0x182610, 76, ...  (88, 0x182610, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0`.\30\0\330+\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%\30\0\24\0\26\0\360%\30\0\6@\14\0\2\0\0\0l5\30\0d$\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00710   484   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\20&\30\0`'\30\0\30&\30\0\220*\30\0\360)\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&\30\0\30\0\32\0\220&\30\0\6@\14\0\2\0\0\0\224'\30\0\244 \30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00711   484   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\0(\30\0\270&\30\0\10(\30\0\300&\30\0H)\30\0\260(\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\2\0\0\0t)\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00712   484   NtReadVirtualMemory  (88, 0x182800, 76, ...  (88, 0x182800, 76, ... "\240(\30\0X'\30\0\250(\30\0`'\30\0\260(\30\08$\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'\30\0\30\0\32\0\330'\30\0\6@\14\0\13\0\0\0\310Z\374w\254%\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00713   484   NtReadVirtualMemory  (88, 0x1828a0, 76, ...  (88, 0x1828a0, 76, ... "8)\30\0\0(\30\0@)\30\0\10(\30\0h'\30\0\20(\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X(\30\0\26\0\30\0\200(\30\0\6@\10\0\2\0\0\0\354-\30\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00714   484   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\340)\30\0\240(\30\0\350)\30\0\250(\30\0\360)\30\0h'\30\0\0\0\262v<-\262v\0P\1\06\08\0\370(\30\0\16\0\20\0 )\30\0\6@\14\0\2\0\0\0`Z\374w\224'\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00715   484   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\200*\30\08)\30\0\210*\30\0@)\30\0\310&\30\0H)\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\220)\30\0\30\0\32\0\270)\30\0\6@\10\0\11\0\0\0\320Z\374w\344!\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00716   484   NtReadVirtualMemory  (88, 0x182a80, 76, ...  (88, 0x182a80, 76, ... " +\30\0\340)\30\0(+\30\0\350)\30\00+\30\0\310&\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\08*\30\0\26\0\30\0`*\30\0\6@\14\0\7\0\0\0\254,\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00717   484   NtReadVirtualMemory  (88, 0x182b20, 76, ...  (88, 0x182b20, 76, ... "\310+\30\0\200*\30\0\320+\30\0\210*\30\0\330+\30\0\220*\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0\330*\30\0\24\0\26\0\0+\30\0\6@\10\0\2\0\0\0\4,\30\0\374\36\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00718   484   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "p,\30\0 +\30\0x,\30\0(+\30\0 &\30\00+\30\0\0\0gv8\25gv\0@\16\0@\0B\0x+\30\0\30\0\32\0\240+\30\0\6@\10\0\2\0\0\0\314/\30\0\+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00719   484   NtReadVirtualMemory  (88, 0x182c70, 76, ...  (88, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\3400\30\0\0/\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\3\0\0\0L-\30\0\274*\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00720   484   NtReadVirtualMemory  (88, 0x182d10, 76, ...  (88, 0x182d10, 76, ... "\260-\30\0p,\30\0\270-\30\0x,\30\0\240/\30\0\300-\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\310,\30\0\24\0\26\0\360,\30\0\6@\14\0\3\0\0\0\3349\30\0\254,\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00721   484   NtReadVirtualMemory  (88, 0x182db0, 76, ...  (88, 0x182db0, 76, ... "P.\30\0\20-\30\0X.\30\0\30-\30\0 -\30\0`.\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0h-\30\0\24\0\26\0\220-\30\0\6@\10\00\0\0\0\214.\30\0\334(\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00722   484   NtReadVirtualMemory  (88, 0x182e50, 76, ...  (88, 0x182e50, 76, ... "\360.\30\0\260-\30\0\370.\30\0\270-\30\0\300-\30\0 &\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\10.\30\0\26\0\30\00.\30\0\6@\14\0+\0\0\0l0\30\0\354-\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00723   484   NtReadVirtualMemory  (88, 0x182ef0, 76, ...  (88, 0x182ef0, 76, ... "\220/\30\0P.\30\0\230/\30\0X.\30\0\200,\30\0@0\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\250.\30\0\24\0\26\0\320.\30\0\6@\10\0\3\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00724   484   NtReadVirtualMemory  (88, 0x182f90, 76, ...  (88, 0x182f90, 76, ... "00\30\0\360.\30\080\30\0\370.\30\0@0\30\0 -\30\0\0\0-w\306@-w\00\6\0>\0@\0H/\30\0\26\0\30\0p/\30\0\6@\14\0\15\0\0\0\141\30\0\4,\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00725   484   NtReadVirtualMemory  (88, 0x183030, 76, ...  (88, 0x183030, 76, ... "\3200\30\0\220/\30\0\3300\30\0\230/\30\0\0/\30\0\240/\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\350/\30\0\22\0\24\0\200\30\0\6@\14\0\3\0\0\0L2\30\0\214.\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00726   484   NtReadVirtualMemory  (88, 0x1830d0, 76, ...  (88, 0x1830d0, 76, ... "p1\30\000\30\0x1\30\080\30\0\2001\30\0\200,\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\2100\30\0\26\0\30\0\2600\30\0\6@\10\0\4\0\0\0\2541\30\0\314/\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00727   484   NtReadVirtualMemory  (88, 0x183170, 76, ...  (88, 0x183170, 76, ... "\202\30\0\3200\30\0\302\30\0\3300\30\0\2702\30\0\3400\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0(1\30\0\26\0\30\0P1\30\0\6@\14\0\10\0\0\0\374<\30\0\141\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00728   484   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2502\30\0p1\30\0\2602\30\0x1\30\0\200%\30\0\3505\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0\3101\30\0\24\0\26\0\3601\30\0\6@\14\0\2\0\0\0\3442\30\0l0\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00729   484   NtReadVirtualMemory  (88, 0x1832a8, 76, ...  (88, 0x1832a8, 76, ... "P3\30\0\202\30\0X3\30\0\302\30\0\04\30\0\2001\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0h2\30\0\16\0\20\0\2202\30\0\6@\0\0\2\0\0\0\246\30\0L2\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00730   484   NtReadVirtualMemory  (88, 0x183350, 76, ...  (88, 0x183350, 76, ... "\3603\30\0\2502\30\0\3703\30\0\2602\30\0@5\30\0\04\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\03\30\0\30\0\32\0(3\30\0\6@\14\0\2\0\0\0,4\30\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00731   484   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2204\30\0P3\30\0\2304\30\0X3\30\0`3\30\0\2702\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\2503\30\0\24\0\26\0\3203\30\0\6@\14\0\3\0\0\0xZ\374w\2143\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00732   484   NtReadVirtualMemory  (88, 0x183490, 76, ...  (88, 0x183490, 76, ... "05\30\0\3603\30\085\30\0\3703\30\0\2106\30\0@5\30\0\0\0,vN\25,v\0\240\10\0>\0@\0H4\30\0\26\0\30\0p4\30\0\6@\10\0\3\0\0\0\3547\30\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00733   484   NtReadVirtualMemory  (88, 0x183530, 76, ...  (88, 0x183530, 76, ... "\3305\30\0\2204\30\0\3405\30\0\2304\30\0\2404\30\0`3\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\3504\30\0\24\0\26\0\205\30\0\6@\14\0\3\0\0\049\30\0L&\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00734   484   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "x6\30\005\30\0\2006\30\085\30\0 2\30\0\2106\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\2105\30\0\30\0\32\0\2605\30\0\6@\0\0\2\0\0\0\2646\30\0\3442\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00735   484   NtReadVirtualMemory  (88, 0x183678, 76, ...  (88, 0x183678, 76, ... "\2607\30\0\3305\30\0\2707\30\0\3405\30\0\3505\30\0\2404\30\0\0\06v\240\206v\0\360\0\0<\0>\006\30\0\24\0\26\0X6\30\0\6@\10\0\4\0\0\0|:\30\0\246\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00736   484   NtReadVirtualMemory  (88, 0x1837b0, 76, ...  (88, 0x1837b0, 76, ... "X8\30\0x6\30\0`8\30\0\2006\30\0h8\30\0\230#\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\3206\30\0\30\0\32\0\2167\30\0\4@\14\20\3\0\0\0\2248\30\0\3144\30\02\376};\330\324\10\0", 76, ) , 76, ) == 0x0
 00737   484   NtReadVirtualMemory  (88, 0x183858, 76, ...  (88, 0x183858, 76, ... "\3708\30\0\2607\30\0\09\30\0\2707\30\0\109\30\0\3007\30\0\0\04wY\324w\0\260\10\0@\0B\0\108\30\0\30\0\32\008\30\0\4@\14\0\1\0\0\0pZ\374w\3547\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00738   484   NtReadVirtualMemory  (88, 0x1838f8, 76, ...  (88, 0x1838f8, 76, ... "\2409\30\0X8\30\0\2509\30\0`8\30\0\2609\30\0h8\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\2608\30\0\26\0\30\0\3308\30\0\4@\10\0\4\0\0\0\300Z\374wl5\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00739   484   NtReadVirtualMemory  (88, 0x1839a0, 76, ...  (88, 0x1839a0, 76, ... "@:\30\0\3708\30\0H:\30\0\09\30\0\360:\30\0\109\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0P9\30\0\30\0\32\0x9\30\0\4@\14\0\1\0\0\0\<\30\0L-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00740   484   NtReadVirtualMemory  (88, 0x183a40, 76, ...  (88, 0x183a40, 76, ... "\340:\30\0\2409\30\0\350:\30\0\2509\30\0\220;\30\0\360:\30\0\0\0nZ\0\0\0\0\0@\1\0>\0@\0\3709\30\0\26\0\30\0 :\30\0\4@\0\0\1\0\0\0\34;\30\0\2646\30\0\321\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00741   484   NtReadVirtualMemory  (88, 0x183ae0, 76, ...  (88, 0x183ae0, 76, ... "\200;\30\0@:\30\0\210;\30\0H:\30\0P:\30\0\2609\30\0\0\0 v\204\27 v\0p\11\0>\0@\0\230:\30\0\26\0\30\0\300:\30\0\6@\10\0\1\0\0\0\274;\30\0|:\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00742   484   NtReadVirtualMemory  (88, 0x183b80, 76, ...  (88, 0x183b80, 76, ... " <\30\0\340:\30\0(<\30\0\350:\30\00<\30\0P:\30\0\0\0\255q\0\0\0\0\0\200\0\0>\0@\08;\30\0\26\0\30\0`;\30\0\4@\0\0\1\0\0\0\244=\30\0\34;\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00743   484   NtReadVirtualMemory  (88, 0x183c20, 76, ...  (88, 0x183c20, 76, ... "\300<\30\0\200;\30\0\310<\30\0\210;\30\0\320<\30\0\220;\30\0\0\0\302t\220\22\302t\0\0\1\0<\0>\0\330;\30\0\24\0\26\0\0<\30\0\4@\10\0\1\0\0\0\350Z\374w\3349\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00744   484   NtReadVirtualMemory  (88, 0x183cc0, 76, ...  (88, 0x183cc0, 76, ... "h=\30\0 <\30\0p=\30\0(<\30\0x=\30\00<\30\0\0\0\301t`\36\301t\0\320\0\0>\0@\0x<\30\0\26\0\30\0\240<\30\0\4@\14\0\1\0\0\0\360Z\374w\2541\30\0\36\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00745   484   NtReadVirtualMemory  (88, 0x183d68, 76, ...  (88, 0x183d68, 76, ... "\10>\30\0\300<\30\0\20>\30\0\310<\30\0\30>\30\0\320<\30\0\0\0\251q}\21\251q\0\200\0\0@\0B\0\30=\30\0\30\0\32\0@=\30\0\4@\14\0\1\0\0\0\20[\374w\274;\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00746   484   NtReadVirtualMemory  (88, 0x183e08, 76, ...  (88, 0x183e08, 76, ... "\234\36\30\0h=\30\0\244\36\30\0p=\30\0\254\36\30\0x=\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\300=\30\0\26\0\30\0\350=\30\0\4@\10\0\2\0\0\0\0[\374w$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00747   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1088,ParentPid=660,}, 0x0, ) == 0x0
 00748   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00749   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00750   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\342\34\0\1\0`\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\+\30\0\360Z\374w\305\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00751   484   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0v\0c\0h\0o\0s\0t\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00752   484   NtClose  (88, ... ) == 0x0
 00753   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1372, 0}, ... 88, ) == 0x0
 00754   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1372,ParentPid=660,}, 0x0, ) == 0x0
 00755   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00756   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00757   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00758   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\234.\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00759   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00760   484   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\4,\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00761   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0T9\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00762   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0,(\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00763   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\330$\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00764   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0L-\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00765   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\0\30&\30\08$\30\0\0\0.tl+.t\00\1\0>\0@\0@#\30\0\26\0\30\0h#\30\0\4@\14\0\14\0\0\0|)\30\0\374\36\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00766   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\230#\30\0\330$\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\10\0\36\0\0\0\4%\30\0\20[\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00767   484   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "\10&\30\0($\30\0\20&\30\00$\30\08$\30\0X"\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) \30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\200$\30\0\26\0\30\0\250$\30\0\6@\14\0\24\0\0\0\304*\30\0d$\30\02\376};\0\0\0\0", 76, ) == 0x0
 00768   484   NtReadVirtualMemory  (88, 0x182608, 76, ...  (88, 0x182608, 76, ... "\360'\30\0\310$\30\0\370'\30\0\320$\30\0\0(\30\0\230#\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0\300%\30\0\24\0\26\0\350%\30\0\4@\14\0\4\0\0\0\34B\30\0xZ\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00769   484   NtReadVirtualMemory  (88, 0x1827f0, 76, ...  (88, 0x1827f0, 76, ... "h%\30\0\10&\30\0p%\30\0\20&\30\0X'\30\0\30&\30\0\0\0\374v!\21\374v\0P\0\0@\0B\0\240'\30\0\30\0\32\0\310'\30\0\4@\14\0\1\0\0\0,;\30\0\344!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00770   484   NtReadVirtualMemory  (88, 0x182568, 76, ...  (88, 0x182568, 76, ... "H'\30\0\360'\30\0P'\30\0\370'\30\0\310-\30\0 -\30\0\0\02t8Q2t\0\220\4\0@\0B\0H(\30\0\30\0\32\0p(\30\0\4@\14\0\4\0\0\0\270Z\374w\270Z\374w"\376};\0\0\0\0", 76, ) \376};\0\0\0\0", 76, ) == 0x0
 00771   484   NtReadVirtualMemory  (88, 0x182748, 76, ...  (88, 0x182748, 76, ... "\250&\30\0h%\30\0\260&\30\0p%\30\0\270&\30\0\0(\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0 %\30\0\22\0\24\0H%\30\0\6@\10\0\34\0\0\0\344&\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00772   484   NtReadVirtualMemory  (88, 0x1826a8, 76, ...  (88, 0x1826a8, 76, ... "\350(\30\0H'\30\0\360(\30\0P'\30\0\370(\30\0X'\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0\230(\30\0\30\0\32\0\300(\30\0\6@\10\0\12\0\0\0\320Z\374w\204'\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00773   484   NtReadVirtualMemory  (88, 0x1828e8, 76, ...  (88, 0x1828e8, 76, ... "@)\30\0\250&\30\0H)\30\0\260&\30\0P)\30\0\270&\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0\0'\30\0\26\0\30\0('\30\0\6@\10\0\6\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00774   484   NtReadVirtualMemory  (88, 0x182940, 76, ...  (88, 0x182940, 76, ... "\340)\30\0\350(\30\0\350)\30\0\360(\30\0\330+\30\0\370(\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0`&\30\0\26\0\30\0\210&\30\0\6@\14\0\7\0\0\0\34*\30\0\304#\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00775   484   NtReadVirtualMemory  (88, 0x1829e0, 76, ...  (88, 0x1829e0, 76, ... "\210*\30\0@)\30\0\220*\30\0H)\30\0 -\30\0\230*\30\0\0\0\306v\355\346\306v\0\220\2\0<\0>\0\230)\30\0\24\0\26\0\300)\30\0\6@\14\0\4\0\0\0\314;\30\0|)\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00776   484   NtReadVirtualMemory  (88, 0x182a88, 76, ...  (88, 0x182a88, 76, ... "(+\30\0\340)\30\00+\30\0\350)\30\0\360)\30\0\200,\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\08*\30\0\30\0\32\0`*\30\0\6@\14\0\4\0\0\0\364-\30\0\4%\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00777   484   NtReadVirtualMemory  (88, 0x182b28, 76, ...  (88, 0x182b28, 76, ... "\310+\30\0\210*\30\0\320+\30\0\220*\30\0\200,\30\0\330+\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\340*\30\0\26\0\30\0\10+\30\0\6@\10\0\12\0\0\0, 76, ) , 76, ) == 0x0
 00778   484   NtReadVirtualMemory  (88, 0x182bc8, 76, ...  (88, 0x182bc8, 76, ... "p,\30\0(+\30\0x,\30\00+\30\08+\30\0P)\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\200+\30\0\24\0\26\0\250+\30\0\6@\14\0\11\0\0\0\3041\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00779   484   NtReadVirtualMemory  (88, 0x182c70, 76, ...  (88, 0x182c70, 76, ... "\20-\30\0\310+\30\0\30-\30\0\320+\30\0\230*\30\08+\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\0 ,\30\0\30\0\32\0H,\30\0\6@\14\0\4\0\0\0$6\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00780   484   NtReadVirtualMemory  (88, 0x182d10, 76, ...  (88, 0x182d10, 76, ... "\270-\30\0p,\30\0\300-\30\0x,\30\0x%\30\0\360)\30\0\0\0\247uM\31\247u\00\12\0>\0@\0\310,\30\0\26\0\30\0\360,\30\0\6@\14\0\4\0\0\0\341\30\0$#\30\0\30\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00781   484   NtReadVirtualMemory  (88, 0x182db8, 76, ...  (88, 0x182db8, 76, ... "`.\30\0\20-\30\0h.\30\0\30-\30\0p.\30\0x%\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0h-\30\0\30\0\32\0\220-\30\0\4@\14\0\2\0\0\0\2542\30\0\304*\30\0)\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00782   484   NtReadVirtualMemory  (88, 0x182e60, 76, ...  (88, 0x182e60, 76, ... "\0/\30\0\270-\30\0\10/\30\0\300-\30\0\20/\30\0\310-\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\20.\30\0\30\0\32\08.\30\0\4@\14\0\12\0\0\0D4\30\0T\37\30\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00783   484   NtReadVirtualMemory  (88, 0x182f00, 76, ...  (88, 0x182f00, 76, ... "\240/\30\0`.\30\0\250/\30\0h.\30\0\260/\30\0p.\30\0\0\0*t\350\24*t\0\340\0\0>\0@\0\270.\30\0\26\0\30\0\340.\30\0\4@\10\0\1\0\0\0\3444\30\0d+\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00784   484   NtReadVirtualMemory  (88, 0x182fa0, 76, ...  (88, 0x182fa0, 76, ... "@0\30\0\0/\30\0H0\30\0\10/\30\0P0\30\0\20/\30\0\0\0(t\37\22(t\0p\0\0<\0>\0X/\30\0\24\0\26\0\200/\30\0\4@\14\0\1\0\0\0\330Z\374w\330Z\374w#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00785   484   NtReadVirtualMemory  (88, 0x183040, 76, ...  (88, 0x183040, 76, ... "\3400\30\0\240/\30\0\3500\30\0\250/\30\0\3600\30\0\260/\30\0\0\0@r\1\26@r\0\300\0\0<\0>\0\370/\30\0\24\0\26\0 0\30\0\4@\14\0\1\0\0\0\>\30\0\370Z\374w-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00786   484   NtReadVirtualMemory  (88, 0x1830e0, 76, ...  (88, 0x1830e0, 76, ... "\2101\30\0@0\30\0\2201\30\0H0\30\0\2301\30\0P0\30\0\0\0?r\355\23?r\0p\0\0<\0>\0\2300\30\0\24\0\26\0\3000\30\0\4@\14\0\1\0\0\0\0[\374wL-\30\0-\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00787   484   NtReadVirtualMemory  (88, 0x183188, 76, ...  (88, 0x183188, 76, ... "p2\30\0\3400\30\0x2\30\0\3500\30\0 3\30\0\3600\30\0\0\0\245q\375\35\245q\0\260\3\0>\0@\0\3401\30\0\26\0\30\0\102\30\0\4@\10\0\2\0\0\0\2548\30\0\4,\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00788   484   NtReadVirtualMemory  (88, 0x183270, 76, ...  (88, 0x183270, 76, ... "\203\30\0\2101\30\0\303\30\0\2201\30\0\304\30\0 3\30\0\0\0\373v\213\21\373v\0p\0\0<\0>\0(2\30\0\24\0\26\0P2\30\0\4@\14\0\1\0\0\0L3\30\0\364-\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00789   484   NtReadVirtualMemory  (88, 0x183310, 76, ...  (88, 0x183310, 76, ... "h3\30\0p2\30\0p3\30\0x2\30\0\2002\30\0\2301\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\3102\30\0\26\0\30\0\3602\30\0\6@\10\0\2\0\0\0\2443\30\0\2542\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00790   484   NtReadVirtualMemory  (88, 0x183368, 76, ...  (88, 0x183368, 76, ... "\104\30\0\203\30\0\204\30\0\303\30\0X5\30\0\304\30\0\0\0+t"\24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) \24+t\0\360\1\0@\0B\081\30\0\30\0\32\0`1\30\0\4@\14\0\1\0\0\0\234?\30\0L3\30\0#\376};\0\0\0\0", 76, ) == 0x0
 00791   484   NtReadVirtualMemory  (88, 0x183408, 76, ...  (88, 0x183408, 76, ... "\2504\30\0h3\30\0\2604\30\0p3\30\0x3\30\0\2002\30\0\0\0\310q\0\0\0\0\0`\0\0<\0>\0\3003\30\0\24\0\26\0\3503\30\0\6@\0\0\1\0\0\0\148\30\0\234.\30\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00792   484   NtReadVirtualMemory  (88, 0x1834a8, 76, ...  (88, 0x1834a8, 76, ... "H5\30\0\104\30\0P5\30\0\204\30\0\2306\30\0X5\30\0\0\0\375v%0\375v\0\200\7\0>\0@\0`4\30\0\26\0\30\0\2104\30\0\4@\14\0\2\0\0\0\2045\30\0, 76, ) , 76, ) == 0x0
 00793   484   NtReadVirtualMemory  (88, 0x183548, 76, ...  (88, 0x183548, 76, ... "\3505\30\0\2504\30\0\3605\30\0\2604\30\0\2704\30\0x3\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\05\30\0\24\0\26\0(5\30\0\6@\14\0\2\0\0\0\234D\30\0\3444\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00794   484   NtReadVirtualMemory  (88, 0x1835e8, 76, ...  (88, 0x1835e8, 76, ... "\2106\30\0H5\30\0\2206\30\0P5\30\0pD\30\0@7\30\0\0\00t\11\300t\0@\1\0<\0>\0\2405\30\0\24\0\26\0\3105\30\0\4@\14\0\1\0\0\0\3046\30\0\254,\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00795   484   NtReadVirtualMemory  (88, 0x183688, 76, ...  (88, 0x183688, 76, ... "07\30\0\3505\30\087\30\0\3605\30\0\3109\30\0\2704\30\0\0\0)t\0\0\0\0\0@\0\08\0:\0@6\30\0\20\0\22\0h6\30\0\6@\0\0\1\0\0\0l7\30\0$6\30\0#\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00796   484   NtReadVirtualMemory  (88, 0x183730, 76, ...  (88, 0x183730, 76, ... "\3207\30\0\2106\30\0\3307\30\0\2206\30\0\3705\30\0\3407\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\3406\30\0\30\0\32\0\107\30\0\6@\14\0\3\0\0\0\240Z\374w\3046\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00797   484   NtReadVirtualMemory  (88, 0x1837d0, 76, ...  (88, 0x1837d0, 76, ... "p8\30\007\30\0x8\30\087\30\0@7\30\0\260@\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\0\2107\30\0\24\0\26\0\2607\30\0\6@\14\0\1\0\0\0\310Z\374wD4\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00798   484   NtReadVirtualMemory  (88, 0x183870, 76, ...  (88, 0x183870, 76, ... "\309\30\0\3207\30\0 9\30\0\3307\30\0\220=\30\0H<\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0(8\30\0\24\0\26\0P8\30\0\6@\14\0\1\0\0\0\300Z\374w\3041\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00799   484   NtReadVirtualMemory  (88, 0x183918, 76, ...  (88, 0x183918, 76, ... "\2709\30\0p8\30\0\3009\30\0x8\30\0\0;\30\0`:\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0\3108\30\0\30\0\32\0\3608\30\0\6@\14\0\1\0\0\0\3649\30\0D!\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00800   484   NtReadVirtualMemory  (88, 0x1839b8, 76, ...  (88, 0x1839b8, 76, ... "P:\30\0\309\30\0X:\30\0 9\30\0`:\30\0\2306\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0p9\30\0\26\0\30\0\2309\30\0\6@\10\0\1\0\0\0\214:\30\0T9\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00801   484   NtReadVirtualMemory  (88, 0x183a50, 76, ...  (88, 0x183a50, 76, ... "\360:\30\0\2709\30\0\370:\30\0\3009\30\0(9\30\0\3109\30\0\0\0\262v<-\262v\0P\1\06\08\0\20:\30\0\16\0\20\08:\30\0\6@\14\0\1\0\0\0`Z\374w\3649\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00802   484   NtReadVirtualMemory  (88, 0x183af0, 76, ...  (88, 0x183af0, 76, ... "\220;\30\0P:\30\0\230;\30\0X:\30\0\240;\30\0(9\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\250:\30\0\26\0\30\0\320:\30\0\6@\14\0\4\0\0\0\34=\30\0,(\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00803   484   NtReadVirtualMemory  (88, 0x183b90, 76, ...  (88, 0x183b90, 76, ... "8<\30\0\360:\30\0@<\30\0\370:\30\0H<\30\0\0;\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\1\0\0\0t<\30\0\34*\30\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00804   484   NtReadVirtualMemory  (88, 0x183c38, 76, ...  (88, 0x183c38, 76, ... "\340<\30\0\220;\30\0\350<\30\0\230;\30\0\2008\30\0\240;\30\0\0\0gv8\25gv\0@\16\0@\0B\0\350;\30\0\30\0\32\0\20<\30\0\6@\10\0\1\0\0\0\374>\30\0\314;\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00805   484   NtReadVirtualMemory  (88, 0x183ce0, 76, ...  (88, 0x183ce0, 76, ... "\200=\30\08<\30\0\210=\30\0@<\30\0\20@\30\00>\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\220<\30\0\30\0\32\0\270<\30\0\6@\14\0\2\0\0\0\274=\30\0,;\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00806   484   NtReadVirtualMemory  (88, 0x183d80, 76, ...  (88, 0x183d80, 76, ... " >\30\0\340<\30\0(>\30\0\350<\30\0\320>\30\0\2008\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\08=\30\0\24\0\26\0`=\30\0\6@\14\0\2\0\0\0\350Z\374w\34=\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00807   484   NtReadVirtualMemory  (88, 0x183e20, 76, ...  (88, 0x183e20, 76, ... "\300>\30\0\200=\30\0\310>\30\0\210=\30\0\360<\30\0p?\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0\330=\30\0\24\0\26\0\0>\30\0\6@\10\0\2\0\0\0\370Z\374w|0\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00808   484   NtReadVirtualMemory  (88, 0x183ec0, 76, ...  (88, 0x183ec0, 76, ... "`?\30\0 >\30\0h?\30\0(>\30\0p?\30\0\220=\30\0\0\0-w\306@-w\00\6\0>\0@\0x>\30\0\26\0\30\0\240>\30\0\6@\14\0\6\0\0\0<@\30\0t<\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00809   484   NtReadVirtualMemory  (88, 0x183f60, 76, ...  (88, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\00>\30\0\320>\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\30?\30\0\22\0\24\0@?\30\0\6@\14\0\2\0\0\0\334@\30\0\2443\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00810   484   NtReadVirtualMemory  (88, 0x184000, 76, ...  (88, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0HA\30\0\360<\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0\360Z\374w\374>\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00811   484   NtReadVirtualMemory  (88, 0x1840a0, 76, ...  (88, 0x1840a0, 76, ... "8A\30\0\0@\30\0@A\30\0\10@\30\0\3407\30\0\230B\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0X@\30\0\24\0\26\0\200@\30\0\6@\14\0\1\0\0\0tA\30\0\234?\30\0\21\376};\0\0\0\0", 76, ) == 0x0
 00812   484   NtReadVirtualMemory  (88, 0x184138, 76, ...  (88, 0x184138, 76, ... "\340A\30\0\240@\30\0\350A\30\0\250@\30\0\360A\30\0\20@\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0\370@\30\0\16\0\20\0 A\30\0\6@\0\0\1\0\0\0\304B\30\0\334@\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00813   484   NtReadVirtualMemory  (88, 0x1841e0, 76, ...  (88, 0x1841e0, 76, ... "\210B\30\08A\30\0\220B\30\0@A\30\08C\30\0HA\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\220A\30\0\30\0\32\0\270A\30\0\6@\14\0\1\0\0\0xZ\374wD&\30\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00814   484   NtReadVirtualMemory  (88, 0x184288, 76, ...  (88, 0x184288, 76, ... "(C\30\0\340A\30\00C\30\0\350A\30\0\260@\30\08C\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\08B\30\0\30\0\32\0`B\30\0\6@\0\0\1\0\0\0dC\30\0tA\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00815   484   NtReadVirtualMemory  (88, 0x184328, 76, ...  (88, 0x184328, 76, ... "`D\30\0\210B\30\0hD\30\0\220B\30\0\230B\30\0\360A\30\0\0\06v\240\206v\0\360\0\0<\0>\0\340B\30\0\24\0\26\0\10C\30\0\6@\10\0\2\0\0\0\20[\374w\304B\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00816   484   NtReadVirtualMemory  (88, 0x184460, 76, ...  (88, 0x184460, 76, ... "\10E\30\0(C\30\0\20E\30\00C\30\0\30E\30\0\3705\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\200C\30\0\30\0\32\0>D\30\0\4@\14\20\2\0\0\0DE\30\0\2045\30\02\376};\320\265\11\0", 76, ) , 76, ) == 0x0
 00817   484   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\234\36\30\0`D\30\0\244\36\30\0hD\30\0\254\36\30\0pD\30\0\0\04wY\324w\0\260\10\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\4@\14\0\1\0\0\0pZ\374w\234D\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00818   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1372,ParentPid=660,}, 0x0, ) == 0x0
 00819   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00820   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00821   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\303 \0\1\0\360\0\0>\0@\0\230\5\2\0\26\0\30\0\300\5\2\0\0P\0\0\377\377\0\0\304#\30\0\360Z\374w\205\344};\0\0\0\0", 76, ) , 76, ) == 0x0
 00822   484   NtReadVirtualMemory  (88, 0x20598, 64, ...  (88, 0x20598, 64, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0p\0o\0o\0l\0s\0v\0.\0e\0x\0e\0\0\0", 64, ) , 64, ) == 0x0
 00823   484   NtClose  (88, ... ) == 0x0
 00824   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1636, 0}, ... 88, ) == 0x0
 00825   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1636,ParentPid=660,}, 0x0, ) == 0x0
 00826   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00827   484   NtReadVirtualMemory  (88, 0x241ea4, 4, ...  (88, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00828   484   NtReadVirtualMemory  (88, 0x241ec0, 76, ...  (88, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00829   484   NtReadVirtualMemory  (88, 0x241f18, 76, ...  (88, 0x241f18, 76, ... "\300\37$\0\300\36$\0\310\37$\0\310\36$\0\320\37$\0\254\36$\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\254%$\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00830   484   NtReadVirtualMemory  (88, 0x241fc0, 76, ...  (88, 0x241fc0, 76, ... "` $\0\30\37$\0h $\0 \37$\0p $\0(\37$\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37$\0\30\0\32\0\230\37$\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00831   484   NtReadVirtualMemory  (88, 0x242060, 76, ...  (88, 0x242060, 76, ... "\10!$\0\300\37$\0\20!$\0\310\37$\0\270!$\0\320\37$\0\0\04|\237"4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) 4|\0`\5\0>\0@\0\30 $\0\26\0\30\0@ $\0\6@\10\0\377\377\0\0\14%$\0\300Z\374w\254\36V>\0\0\0\0", 76, ) == 0x0
 00832   484   NtReadVirtualMemory  (88, 0x242108, 76, ...  (88, 0x242108, 76, ... "\250!$\0` $\0\260!$\0h $\0\370"$\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) $\0\270!$\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 $\0\30\0\32\0\340 $\0\6@\10\0\377\377\0\0\364&$\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00833   484   NtReadVirtualMemory  (88, 0x2421a8, 76, ...  (88, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) $\0\10!$\0P (88, 0x2421a8, 76, ... "H"$\0\10!$\0P"$\0\20!$\0\30!$\0p $\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!$\0\24\0\26\0\210!$\0\6@\10\0\377\377\0\0\+$\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00834   484   NtReadVirtualMemory  (88, 0x242248, 76, ...  (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\250!$\0\360 (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0 (88, 0x242248, 76, ... "\350"$\0\250!$\0\360"$\0\260!$\0\230#$\0\370"$\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\0"$\0\24\0\26\0("$\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) $\0\6@\14\0\377\377\0\0\3249$\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00835   484   NtReadVirtualMemory  (88, 0x2422e8, 76, ...  (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\220#$\0P (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240 (88, 0x2422e8, 76, ... "\210#$\0H"$\0\220#$\0P"$\0X"$\0\30!$\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\240"$\0\22\0\24\0\310"$\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) $\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00836   484   NtReadVirtualMemory  (88, 0x242388, 76, ...  (88, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\00$$\0\360 (88, 0x242388, 76, ... "($$\0\350"$\00$$\0\360"$\0\340$$\0X"$\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) $\0\0\0\300w\10\21\300w\0p\0\0>\0@\0@#$\0\26\0\30\0h#$\0\6@\10\0\377\377\0\0\10[\374w\374\36$\0\17\376};\0\0\0\0", 76, ) == 0x0
 00837   484   NtReadVirtualMemory  (88, 0x242428, 76, ...  (88, 0x242428, 76, ... "\320$$\0\210#$\0\330$$\0\220#$\0`8$\0\200%$\0\0\0\326v\326/\326v\0P\1\0@\0B\0\200$$\0\30\0\32\0\250$$\0\4@\14\0\3\0\0\0\240Z\374w\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00838   484   NtReadVirtualMemory  (88, 0x2424d0, 76, ...  (88, 0x2424d0, 76, ... "p%$\0($$\0x%$\00$$\0\20($\0\230#$\0\0\0\301wO\351\301w\00\5\0<\0>\0\340#$\0\24\0\26\0\10$$\0\6@\10\0"\0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) \0\0\0L&$\0\234 $\0\16\376};\0\0\0\0", 76, ) == 0x0
 00839   484   NtReadVirtualMemory  (88, 0x242570, 76, ...  (88, 0x242570, 76, ... "\20&$\0\320$$\0\30&$\0\330$$\08$$\0\3002$\0\0\0\336v\244\23\336v\0`\2\0<\0>\0(%$\0\24\0\26\0P%$\0\6@\14\0\1\0\0\0<($\0T\37$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00840   484   NtReadVirtualMemory  (88, 0x242610, 76, ...  (88, 0x242610, 76, ... "\270&$\0p%$\0\300&$\0x%$\0\0/$\0x,$\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\310%$\0\24\0\26\0\360%$\0\6@\14\0\1\0\0\0\146$\0\14%$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00841   484   NtReadVirtualMemory  (88, 0x2426b8, 76, ...  (88, 0x2426b8, 76, ... "X'$\0\20&$\0`'$\0\30&$\00+$\0\220*$\0\0\0\344v0\23\344v\0\360\2\0@\0B\0h&$\0\30\0\32\0\220&$\0\6@\14\0\1\0\0\0\224'$\0D!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00842   484   NtReadVirtualMemory  (88, 0x242758, 76, ...  (88, 0x242758, 76, ... "\0($\0\270&$\0\10($\0\300&$\0H)$\0\260($\0\0\0\341v}\22\341v\0@\2\0>\0@\0\20'$\0\26\0\30\08'$\0\6@\10\0\1\0\0\0t)$\0\364&$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00843   484   NtReadVirtualMemory  (88, 0x242800, 76, ...  (88, 0x242800, 76, ... "\240($\0X'$\0\250($\0`'$\0\260($\0\340$$\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0\260'$\0\30\0\32\0\330'$\0\6@\14\0\6\0\0\0\310Z\374w\254%$\03\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00844   484   NtReadVirtualMemory  (88, 0x2428a0, 76, ...  (88, 0x2428a0, 76, ... "8)$\0\0($\0@)$\0\10($\0h'$\0\20($\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0X($\0\26\0\30\0\200($\0\6@\10\0\1\0\0\0\214.$\0\20[\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00845   484   NtReadVirtualMemory  (88, 0x242938, 76, ...  (88, 0x242938, 76, ... "\330)$\0\240($\0\340)$\0\250($\0\350)$\0h'$\0\0\0\262v<-\262v\0P\1\06\08\0\370($\0\16\0\20\0 )$\0\6@\14\0\1\0\0\0`Z\374w\224'$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00846   484   NtReadVirtualMemory  (88, 0x2429d8, 76, ...  (88, 0x2429d8, 76, ... "\200*$\08)$\0\210*$\0@)$\0\220*$\0H)$\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\220)$\0\22\0\24\0\270)$\0\6@\10\0\7\0\0\0\274*$\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00847   484   NtReadVirtualMemory  (88, 0x242a80, 76, ...  (88, 0x242a80, 76, ... " +$\0\330)$\0(+$\0\340)$\0\310&$\0\350)$\0\0\0\22w\360+\23w\0\260\10\0@\0B\00*$\0\30\0\32\0X*$\0\6@\10\0\4\0\0\0\320Z\374w\24*$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00848   484   NtReadVirtualMemory  (88, 0x242b20, 76, ...  (88, 0x242b20, 76, ... "\300+$\0\200*$\0\310+$\0\210*$\0\320+$\0\310&$\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0\330*$\0\26\0\30\0\0+$\0\6@\14\0\4\0\0\0L-$\0\344!$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00849   484   NtReadVirtualMemory  (88, 0x242bc0, 76, ...  (88, 0x242bc0, 76, ... "h,$\0 +$\0p,$\0(+$\0x,$\00+$\0\0\0\277qp\21\277q\0\20\1\0<\0>\0x+$\0\24\0\26\0\240+$\0\6@\10\0\1\0\0\0\244,$\0\360Z\374w1\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00850   484   NtReadVirtualMemory  (88, 0x242c68, 76, ...  (88, 0x242c68, 76, ... "\20-$\0\300+$\0\30-$\0\310+$\0 &$\0\320+$\0\0\0gv8\25gv\0@\16\0@\0B\0\30,$\0\30\0\32\0@,$\0\6@\10\0\1\0\0\0l0$\0\374+$\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00851   484   NtReadVirtualMemory  (88, 0x242d10, 76, ...  (88, 0x242d10, 76, ... "\260-$\0h,$\0\270-$\0p,$\0\2001$\0\240/$\0\0\0\356v(\25\356v\0p\3\0@\0B\0\300,$\0\30\0\32\0\350,$\0\6@\14\0\2\0\0\0\354-$\0\+$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00852   484   NtReadVirtualMemory  (88, 0x242db0, 76, ...  (88, 0x242db0, 76, ... "P.$\0\20-$\0X.$\0\30-$\0@0$\0`.$\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0h-$\0\24\0\26\0\220-$\0\6@\14\0\2\0\0\0\350Z\374wL-$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00853   484   NtReadVirtualMemory  (88, 0x242e50, 76, ...  (88, 0x242e50, 76, ... "\360.$\0\260-$\0\370.$\0\270-$\0\300-$\0\0/$\0\0\0\253q\306\26\253q\0P\1\0<\0>\0\10.$\0\24\0\26\00.$\0\6@\10\0\6\0\0\0,/$\0\334($\01\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00854   484   NtReadVirtualMemory  (88, 0x242ef0, 76, ...  (88, 0x242ef0, 76, ... "\220/$\0P.$\0\230/$\0X.$\0`.$\0 &$\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\250.$\0\26\0\30\0\320.$\0\6@\14\0\2\0\0\0\141$\0\214.$\02\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00855   484   NtReadVirtualMemory  (88, 0x242f90, 76, ...  (88, 0x242f90, 76, ... "00$\0\360.$\080$\0\370.$\0 -$\0\3400$\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0H/$\0\24\0\26\0p/$\0\6@\10\0\2\0\0\0\370Z\374w\370Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00856   484   NtReadVirtualMemory  (88, 0x243030, 76, ...  (88, 0x243030, 76, ... "\3200$\0\220/$\0\3300$\0\230/$\0\3400$\0\300-$\0\0\0-w\306@-w\00\6\0>\0@\0\350/$\0\26\0\30\0\200$\0\6@\14\0\6\0\0\0\2541$\0\244,$\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00857   484   NtReadVirtualMemory  (88, 0x2430d0, 76, ...  (88, 0x2430d0, 76, ... "p1$\000$\0x1$\080$\0\240/$\0@0$\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\2100$\0\22\0\24\0\2600$\0\6@\14\0\2\0\0\0\3542$\0,/$\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00858   484   NtReadVirtualMemory  (88, 0x243170, 76, ...  (88, 0x243170, 76, ... "\202$\0\3200$\0\302$\0\3300$\0 2$\0 -$\0\0\0=w\24 ?w\0@\177\0>\0@\0(1$\0\26\0\30\0P1$\0\6@\10\0\1\0\0\0L2$\0l0$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00859   484   NtReadVirtualMemory  (88, 0x243210, 76, ...  (88, 0x243210, 76, ... "\2602$\0p1$\0\2702$\0x1$\0X3$\0\2001$\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\3101$\0\26\0\30\0\3601$\0\6@\14\0\3\0\0\0\360Z\374w\2541$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00860   484   NtReadVirtualMemory  (88, 0x2432b0, 76, ...  (88, 0x2432b0, 76, ... "H3$\0\202$\0P3$\0\302$\0\200%$\0\2106$\0\0\0\332v\33"\333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) \333v\0\0\3\0<\0>\0h2$\0\24\0\26\0\2202$\0\6@\14\0\1\0\0\0\2043$\0\141$\0\21\376};\0\0\0\0", 76, ) == 0x0
 00861   484   NtReadVirtualMemory  (88, 0x243348, 76, ...  (88, 0x243348, 76, ... "\3603$\0\2602$\0\3703$\0\2702$\0\2404$\0 2$\0\0\0\323v\0\0\0\0\0@\0\06\08\0\103$\0\16\0\20\003$\0\6@\0\0\1\0\0\0\2646$\0\3542$\0\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00862   484   NtReadVirtualMemory  (88, 0x2433f0, 76, ...  (88, 0x2433f0, 76, ... "\2204$\0H3$\0\2304$\0P3$\0\3405$\0\2404$\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\2403$\0\30\0\32\0\3103$\0\6@\14\0\1\0\0\0\3144$\0xZ\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00863   484   NtReadVirtualMemory  (88, 0x243490, 76, ...  (88, 0x243490, 76, ... "05$\0\3603$\085$\0\3703$\0\04$\0X3$\0\0\0\362v\317\22\362v\0P\2\0<\0>\0H4$\0\24\0\26\0p4$\0\6@\14\0\1\0\0\0xZ\374w,4$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00864   484   NtReadVirtualMemory  (88, 0x243530, 76, ...  (88, 0x243530, 76, ... "\3205$\0\2204$\0\3305$\0\2304$\0(7$\0\3405$\0\0\0,vN\25,v\0\240\10\0>\0@\0\3504$\0\26\0\30\0\205$\0\6@\10\0\1\0\0\0\2148$\0pZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00865   484   NtReadVirtualMemory  (88, 0x2435d0, 76, ...  (88, 0x2435d0, 76, ... "x6$\005$\0\2006$\085$\0@5$\0\04$\0\0\0*v\\20*v\0\360\0\0<\0>\0\2105$\0\24\0\26\0\2605$\0\6@\14\0\1\0\0\0\300Z\374wL&$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00866   484   NtReadVirtualMemory  (88, 0x243678, 76, ...  (88, 0x243678, 76, ... "\307$\0\3205$\0 7$\0\3305$\0\3002$\0(7$\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0(6$\0\30\0\32\0P6$\0\6@\0\0\1\0\0\0T7$\0\2043$\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00867   484   NtReadVirtualMemory  (88, 0x243718, 76, ...  (88, 0x243718, 76, ... "P8$\0x6$\0X8$\0\2006$\0\2106$\0@5$\0\0\06v\240\206v\0\360\0\0<\0>\0\3206$\0\24\0\26\0\3706$\0\6@\10\0\2\0\0\0\20[\374w\2646$\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00868   484   NtReadVirtualMemory  (88, 0x243850, 76, ...  (88, 0x243850, 76, ... "\3708$\0\307$\0\09$\0 7$\0\109$\08$$\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0p7$\0\30\0\32\0.8$\0\4@\14\20\2\0\0\049$\0l5$\02\376};\310W\24\0", 76, ) , 76, ) == 0x0
 00869   484   NtReadVirtualMemory  (88, 0x2438f8, 76, ...  (88, 0x2438f8, 76, ... "\2309$\0P8$\0\2409$\0X8$\0\2509$\0`8$\0\0\04wY\324w\0\260\10\0@\0B\0\2508$\0\30\0\32\0\3208$\0\4@\14\0\1\0\0\0pZ\374w\2148$\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00870   484   NtReadVirtualMemory  (88, 0x243998, 76, ...  (88, 0x243998, 76, ... "\234\36$\0\3708$\0\244\36$\0\09$\0\254\36$\0\109$\0\0\0\247uM\31\247u\00\12\0>\0@\0P9$\0\26\0\30\0x9$\0\4@\14\0\1\0\0\0\0[\374w\204"$\0\30\376};\0\0\0\0", 76, ) $\0\30\376};\0\0\0\0", 76, ) == 0x0
 00871   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=13,Pid=1636,ParentPid=660,}, 0x0, ) == 0x0
 00872   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36$\0", 4, ) , 4, ) == 0x0
 00873   484   NtReadVirtualMemory  (88, 0x241ea4, 4, ...  (88, 0x241ea4, 4, ... "\310\36$\0", 4, ) , 4, ) == 0x0
 00874   484   NtReadVirtualMemory  (88, 0x241ec0, 76, ...  (88, 0x241ec0, 76, ... "\30\37$\0\234\36$\0 \37$\0\244\36$\0\0\0\0\0\0\0\0\0\0\0@\0p\264@\0\00\4\0l\0n\0\270\5\2\0"\0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) \0$\0\2\6\2\0\0P\0\0\377\377\377\377\304#$\0\10[\374w\245\353\36F\0\0\0\0", 76, ) == 0x0
 00875   484   NtReadVirtualMemory  (88, 0x205b8, 110, ...  (88, 0x205b8, 110, ... "C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0V\0M\0w\0a\0r\0e\0\\0V\0M\0w\0a\0r\0e\0 \0T\0o\0o\0l\0s\0\\0V\0M\0w\0a\0r\0e\0S\0e\0r\0v\0i\0c\0e\0.\0e\0x\0e\0\0\0", 110, ) , 110, ) == 0x0
 00876   484   NtClose  (88, ... ) == 0x0
 00877   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1760, 0}, ... 88, ) == 0x0
 00878   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1760,ParentPid=616,}, 0x0, ) == 0x0
 00879   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00880   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00881   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00882   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\310Z\374w\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00883   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0X"\30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00884   484   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\0!\30\0\300\37\30\0\10!\30\0\310\37\30\0\230#\30\0\20!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\14\0\377\377\0\0\254%\30\0\374\36\30\0\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00885   484   NtReadVirtualMemory  (88, 0x182100, 76, ...  (88, 0x182100, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0p \30\0\270!\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\270 \30\0\22\0\24\0\340 \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00886   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\0!\30\0P"\30\0\10!\30\0\20!\30\0X"\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0X!\30\0\30\0\32\0\200!\30\0\6@\10\0\377\377\0\0`Z\374w`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00887   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\24\0\26\0( (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\270!\30\0\320\37\30\0\0\0\314w4\23\314w\0P\7\0<\0>\0\0"\30\0\24\0\26\0("\30\0\6@\10\0\377\377\0\0\350Z\374w\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00888   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) \30\0\26\0\30\0\310 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0\340$\30\08$\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\240"\30\0\26\0\30\0\310"\30\0\6@\10\0\377\377\0\0pZ\374wpZ\374w\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00889   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0p \30\0\0\0\301wO\351\301w\00\5\0<\0>\0@#\30\0\24\0\26\0h#\30\0\6@\10\0\377\377\0\0d$\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00890   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\320$\30\0\210#\30\0\330$\30\0\220#\30\0\370"\30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) \30\0\230#\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\340#\30\0\24\0\26\0\10$\30\0\6@\14\0\377\377\0\0\300Z\374w\304#\30\0\26\376};\0\0\0\0", 76, ) == 0x0
 00891   484   NtReadVirtualMemory  (88, 0x1824d0, 76, ...  (88, 0x1824d0, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\0\370"\30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) \30\0\0\0\0s\372\26\0s\00\2\0@\0B\0\200$\30\0\30\0\32\0\250$\30\0\6@\14\0\377\377\0\0\20[\374w\20[\374w)\376};\0\0\0\0", 76, ) == 0x0
 00892   484   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\320$\30\0 &\30\0\330$\30\0(&\30\0\340$\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0(%\30\0\26\0\30\0P%\30\0\4@\10\0\2\0\0\0\0[\374w\234 \30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00893   484   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\234\36\30\0p%\30\0\244\36\30\0x%\30\0\254\36\30\0\200%\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\4@\14\0\1\0\0\0\360Z\374w\360Z\374w\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00894   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1760,ParentPid=616,}, 0x0, ) == 0x0
 00895   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00896   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00897   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\243E\0\1\0\200\0\0@\0B\0\230\5\2\0\30\0\32\0\300\5\2\0\0P\0\0\377\377\0\0\234 \30\0\0[\374w\277\203};\0\0\0\0", 76, ) , 76, ) == 0x0
 00898   484   NtReadVirtualMemory  (88, 0x20598, 66, ...  (88, 0x20598, 66, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0s\0e\0r\0i\0n\0i\0t\0.\0e\0x\0e\0\0\0", 66, ) , 66, ) == 0x0
 00899   484   NtClose  (88, ... ) == 0x0
 00900   484   NtOpenProcess  (0x410, {24, 0, 0x0, 0, 0, 0x0}, {1828, 0}, ... 88, ) == 0x0
 00901   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1828,ParentPid=1760,}, 0x0, ) == 0x0
 00902   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00903   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00904   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00905   484   NtReadVirtualMemory  (88, 0x181f18, 76, ...  (88, 0x181f18, 76, ... "\300\37\30\0\300\36\30\0\310\37\30\0\310\36\30\0\320\37\30\0\254\36\30\0\0\0\365w\0\0\0\0\0\220\12\0:\0\10\2@j\374w\22\0\24\0\344p\367w\4@\0\0\377\377\0\0\41\30\0\310Z\374w\36\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00906   484   NtReadVirtualMemory  (88, 0x181fc0, 76, ...  (88, 0x181fc0, 76, ... "` \30\0\30\37\30\0h \30\0 \37\30\0p \30\0(\37\30\0\0\0\346wA\242\347w\0P\16\0@\0B\0p\37\30\0\30\0\32\0\230\37\30\0\4@\10\0\377\377\0\0\260Z\374w\260Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00907   484   NtReadVirtualMemory  (88, 0x182060, 76, ...  (88, 0x182060, 76, ... "\10!\30\0\300\37\30\0\20!\30\0\310\37\30\0\270!\30\0\320\37\30\0\0\0\301wO\351\301w\00\5\0<\0>\0\30 \30\0\24\0\26\0@ \30\0\6@\10\0\377\377\0\0\264/\30\0\300Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00908   484   NtReadVirtualMemory  (88, 0x182108, 76, ...  (88, 0x182108, 76, ... "\250!\30\0` \30\0\260!\30\0h \30\0\370"\30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) \30\0\270!\30\0\0\0\335w\373\34\335w\0\260\10\0@\0B\0\270 \30\0\30\0\32\0\340 \30\0\6@\10\0\377\377\0\0\24*\30\0`Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00909   484   NtReadVirtualMemory  (88, 0x1821a8, 76, ...  (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\7\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) \30\0\10!\30\0P (88, 0x1821a8, 76, ... "H"\30\0\10!\30\0P"\30\0\20!\30\0\30!\30\0p \30\0\0\0\314w4\23\314w\0P\7\0<\0>\0`!\30\0\24\0\26\0\210!\30\0\6@\10\0\377\377\0\0\7\30\0\350Z\374w\16\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00910   484   NtReadVirtualMemory  (88, 0x182248, 76, ...  (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\250!\30\0\360 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0 (88, 0x182248, 76, ... "\350"\30\0\250!\30\0\360"\30\0\260!\30\0\230#\30\0\370"\30\0\0\0\307w\0\0\0\0\0\0\4\0:\0<\0\0"\30\0\22\0\24\0("\30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\0\0\377\377\0\0\220Z\374w\220Z\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00911   484   NtReadVirtualMemory  (88, 0x1822e8, 76, ...  (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\220#\30\0P (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240 (88, 0x1822e8, 76, ... "\210#\30\0H"\30\0\220#\30\0P"\30\0X"\30\0\30!\30\0\0\0\324wKQ\324w\0\320\10\0<\0>\0\240"\30\0\24\0\26\0\310"\30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) \30\0\6@\14\0\377\377\0\0\224'\30\0\0[\374w\16\376};\0\0\0\0", 76, ) == 0x0
 00912   484   NtReadVirtualMemory  (88, 0x182388, 76, ...  (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\00$\30\0\360 (88, 0x182388, 76, ... "($\30\0\350"\30\00$\30\0\360"\30\08$\30\0X"\30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) \30\0\0\0-w\306@-w\00\6\0>\0@\0@#\30\0\26\0\30\0h#\30\0\6@\14\0\377\377\0\0d$\30\0\360Z\374w\20\376};\0\0\0\0", 76, ) == 0x0
 00913   484   NtReadVirtualMemory  (88, 0x182428, 76, ...  (88, 0x182428, 76, ... "\310$\30\0\210#\30\0\320$\30\0\220#\30\0\330$\30\0\230#\30\0\0\0=w\24 ?w\0@\177\0>\0@\0\340#\30\0\26\0\30\0\10$\30\0\6@\10\0\377\377\0\0\364&\30\0\304#\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00914   484   NtReadVirtualMemory  (88, 0x1824c8, 76, ...  (88, 0x1824c8, 76, ... "p%\30\0($\30\0x%\30\00$\30\0\200%\30\08$\30\0\0\0\33wp\10\34w\0\240\21\0:\0<\0\200$\30\0\22\0\24\0\250$\30\0\6@\10\0\377\377\0\0\254%\30\0\320Z\374w\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00915   484   NtReadVirtualMemory  (88, 0x182570, 76, ...  (88, 0x182570, 76, ... "\30&\30\0\310$\30\0 &\30\0\320$\30\0(&\30\0\330$\30\0\0\0\22w\360+\23w\0\260\10\0@\0B\0 %\30\0\30\0\32\0H%\30\0\6@\10\0\377\377\0\0\320Z\374w\4%\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00916   484   NtReadVirtualMemory  (88, 0x182618, 76, ...  (88, 0x182618, 76, ... "\270&\30\0p%\30\0\300&\30\0x%\30\0\310&\30\0\200%\30\0\0\0\370u\265*\370u\0\300\17\0@\0B\0\310%\30\0\30\0\32\0\360%\30\0\6@\14\0\377\377\0\0$I\30\0hZ\374w\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00917   484   NtReadVirtualMemory  (88, 0x1826b8, 76, ...  (88, 0x1826b8, 76, ... "X'\30\0\30&\30\0`'\30\0 &\30\0h'\30\0(&\30\0\0\0\234v=\5\235v\0\220\24\0>\0@\0p&\30\0\26\0\30\0\230&\30\0\6@\14\0\377\377\0\0\24/\30\0d$\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00918   484   NtReadVirtualMemory  (88, 0x182758, 76, ...  (88, 0x182758, 76, ... "\220(\30\0\270&\30\0\230(\30\0\300&\30\0\240(\30\0\310&\30\0\0\0\327Z\203\25\327Z\0@\3\0>\0@\0\20'\30\0\26\0\30\08'\30\0\6@\10\0\377\377\0\0\324-\30\0$#\30\0\317\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00919   484   NtReadVirtualMemory  (88, 0x182890, 76, ...  (88, 0x182890, 76, ... "8)\30\0X'\30\0@)\30\0`'\30\0H)\30\0h'\30\0\0\0\225q%\362\225q\0@\16\0\326\0\330\0\260'\30\0\30\0\32\0n(\30\0\4@\14\20\17\0\0\0t)\30\0pZ\374w2\376};(=\10\0", 76, ) , 76, ) == 0x0
 00920   484   NtReadVirtualMemory  (88, 0x182938, 76, ...  (88, 0x182938, 76, ... "\330)\30\0\220(\30\0\340)\30\0\230(\30\0\350)\30\0\240(\30\0\0\04wY\324w\0\260\10\0@\0B\0\350(\30\0\30\0\32\0\20)\30\0\4@\14\0\4\0\0\0\264*\30\0\314(\30\0\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00921   484   NtReadVirtualMemory  (88, 0x1829d8, 76, ...  (88, 0x1829d8, 76, ... "x*\30\08)\30\0\200*\30\0@)\30\0(+\30\0H)\30\0\0\0\364u\320\21\364u\0\320\1\0>\0@\0\220)\30\0\26\0\30\0\270)\30\0\4@\10\0\1\0\0\0\0\30\0D!\30\0\27\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00922   484   NtReadVirtualMemory  (88, 0x182a78, 76, ...  (88, 0x182a78, 76, ... "\30+\30\0\330)\30\0 +\30\0\340)\30\0\10-\30\0\310+\30\0\0\0\375v%0\375v\0\200\7\0>\0@\00*\30\0\26\0\30\0X*\30\0\4@\14\0\2\0\0\0T+\30\0t)\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00923   484   NtReadVirtualMemory  (88, 0x182b18, 76, ...  (88, 0x182b18, 76, ... "\270+\30\0x*\30\0\300+\30\0\200*\30\0\310+\30\0\350)\30\0\0\0\5wH\20\5w\0P\14\0<\0>\0\320*\30\0\24\0\26\0\370*\30\0\6@\14\0\2\0\0\0\224,\30\0\264*\30\0\20\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00924   484   NtReadVirtualMemory  (88, 0x182bb8, 76, ...  (88, 0x182bb8, 76, ... "X,\30\0\30+\30\0`,\30\0 +\30\0\210*\30\0(+\30\0\0\0\300w\10\21\300w\0p\0\0>\0@\0p+\30\0\26\0\30\0\230+\30\0\6@\10\0\3\0\0\0\10[\374w\10[\374w\17\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00925   484   NtReadVirtualMemory  (88, 0x182c58, 76, ...  (88, 0x182c58, 76, ... "\370,\30\0\270+\30\0\0-\30\0\300+\30\0\350.\30\0\10-\30\0\0\0bv\316\26bv\0\340\4\0:\0<\0\20,\30\0\22\0\24\08,\30\0\4@\14\0\2\0\0\04-\30\0T+\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00926   484   NtReadVirtualMemory  (88, 0x182cf8, 76, ...  (88, 0x182cf8, 76, ... "8.\30\0X,\30\0@.\30\0`,\30\0h,\30\0\210*\30\0\0\0`v\20\22`v\0\260\1\0<\0>\0\260,\30\0\24\0\26\0\330,\30\0\6@\10\0\2\0\0\0t5\30\0\224,\30\0\25\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00927   484   NtReadVirtualMemory  (88, 0x182e38, 76, ...  (88, 0x182e38, 76, ... "\330.\30\0\370,\30\0\340.\30\0\0-\30\0\250-\30\0\210/\30\0\0\0c[\237qd[\0\0\7\0>\0@\0\360-\30\0\26\0\30\0\30.\30\0\4@\14\0\1\0\0\0\304B\30\0\370Z\374w\267\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00928   484   NtReadVirtualMemory  (88, 0x182ed8, 76, ...  (88, 0x182ed8, 76, ... "x/\30\08.\30\0\200/\30\0@.\30\0\210/\30\0h,\30\0\0\0\371v\320\23\371v\0\0\1\0>\0@\0\220.\30\0\26\0\30\0\270.\30\0\6@\14\0\6\0\0\0\2441\30\0\364&\30\0\21\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00929   484   NtReadVirtualMemory  (88, 0x182f78, 76, ...  (88, 0x182f78, 76, ... "\230-\30\0\330.\30\0\240-\30\0\340.\30\0H.\30\0\350.\30\0\0\08v4\208v\0P\0\0>\0@\00/\30\0\26\0\30\0X/\30\0\6@\14\0\1\0\0\0\246\30\0\234 \30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00930   484   NtReadVirtualMemory  (88, 0x182d98, 76, ...  (88, 0x182d98, 76, ... " 0\30\0x/\30\0(0\30\0\200/\30\000\30\0H.\30\0\0\0\247uM\31\247u\00\12\0>\0@\0P-\30\0\26\0\30\0x-\30\0\4@\14\0\4\0\0\0\0[\374w\224'\30\0\30\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00931   484   NtReadVirtualMemory  (88, 0x183020, 76, ...  (88, 0x183020, 76, ... "\3100\30\0\230-\30\0\3200\30\0\240-\30\0\3300\30\0\250-\30\0\0\0\324q\252\20\324q\0\260\1\0@\0B\0\320/\30\0\30\0\32\0\370/\30\0\4@\14\0\1\0\0\0\2043\30\0\24*\30\00\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00932   484   NtReadVirtualMemory  (88, 0x1830c8, 76, ...  (88, 0x1830c8, 76, ... "h1\30\0 0\30\0p1\30\0(0\30\0x1\30\000\30\0\0\0\302q\374\26\302q\0\360\4\0@\0B\0x0\30\0\30\0\32\0\2400\30\0\4@\14\0\13\0\0\0\3542\30\0T\37\30\03\376};(=\10\0", 76, ) , 76, ) == 0x0
 00933   484   NtReadVirtualMemory  (88, 0x183168, 76, ...  (88, 0x183168, 76, ... "\202\30\0\3100\30\0\302\30\0\3200\30\0 2\30\0\3300\30\0\0\0\277qp\21\277q\0\20\1\0<\0>\0 1\30\0\24\0\26\0H1\30\0\4@\10\0\2\0\0\0L2\30\0\24/\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00934   484   NtReadVirtualMemory  (88, 0x183210, 76, ...  (88, 0x183210, 76, ... "\2602\30\0h1\30\0\2702\30\0p1\30\0X3\30\0x1\30\0\0\0gv8\25gv\0@\16\0@\0B\0\3001\30\0\30\0\32\0\3501\30\0\4@\10\0\7\0\0\0|H\30\0\2441\30\0\25\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00935   484   NtReadVirtualMemory  (88, 0x1832b0, 76, ...  (88, 0x1832b0, 76, ... "H3\30\0\202\30\0P3\30\0\302\30\0\04\30\0X3\30\0\0\0\231v\250\22\231v\0@\2\0>\0@\0h2\30\0\26\0\30\0\2202\30\0\4@\14\0\2\0\0\0\324:\30\0\41\30\0\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00936   484   NtReadVirtualMemory  (88, 0x183348, 76, ...  (88, 0x183348, 76, ... "\3603\30\0\2602\30\0\3703\30\0\2702\30\0\3002\30\0 2\30\0\0\0\262v<-\262v\0P\1\06\08\0\103\30\0\16\0\20\003\30\0\6@\14\0\3\0\0\0\3747\30\0\0\30\0\23\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00937   484   NtReadVirtualMemory  (88, 0x1833f0, 76, ...  (88, 0x1833f0, 76, ... "\2304\30\0H3\30\0\2404\30\0P3\30\0\3505\30\0\3002\30\0\0\0\230v\264\20\230v\0p\0\0@\0B\0\2403\30\0\30\0\32\0\3103\30\0\4@\14\0\1\0\0\0\270Z\374w\270Z\374w\24\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00938   484   NtReadVirtualMemory  (88, 0x183498, 76, ...  (88, 0x183498, 76, ... "85\30\0\3603\30\0@5\30\0\3703\30\007\30\0\2206\30\0\0\0\303v\320\24\303v\0\260\2\0@\0B\0H4\30\0\30\0\32\0p4\30\0\4@\14\0\1\0\0\0<9\30\0\20[\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00939   484   NtReadVirtualMemory  (88, 0x183538, 76, ...  (88, 0x183538, 76, ... "\3305\30\0\2304\30\0\3405\30\0\2404\30\0\2206\30\0\3505\30\0\0\0,vN\25,v\0\240\10\0>\0@\0\3604\30\0\26\0\30\0\305\30\0\6@\10\0\4\0\0\0\3449\30\04-\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00940   484   NtReadVirtualMemory  (88, 0x1835d8, 76, ...  (88, 0x1835d8, 76, ... "\2006\30\085\30\0\2106\30\0@5\30\0H5\30\0\04\30\0\0\0*v\\20*v\0\360\0\0<\0>\0\2205\30\0\24\0\26\0\2705\30\0\6@\14\0\5\0\0\0\2348\30\0\264/\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00941   484   NtReadVirtualMemory  (88, 0x183680, 76, ...  (88, 0x183680, 76, ... " 7\30\0\3305\30\0(7\30\0\3405\30\0\2504\30\0H5\30\0\0\0\311v\312\21\311v\0 \2\0@\0B\006\30\0\30\0\32\0X6\30\0\6@\14\0\1\0\0\0\24=\30\0\240Z\374w\22\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00942   484   NtReadVirtualMemory  (88, 0x183720, 76, ...  (88, 0x183720, 76, ... "\3007\30\0\2006\30\0\3107\30\0\2106\30\0\3207\30\0\2504\30\0\0\0\375\17\340\367\375\17\0 \2\0<\0>\0\3306\30\0\24\0\26\0\07\30\0\4@\14\0\1\0\0\0\334@\30\0\344!\30\0.FQ;\0\0\0\0", 76, ) , 76, ) == 0x0
 00943   484   NtReadVirtualMemory  (88, 0x1837c0, 76, ...  (88, 0x1837c0, 76, ... "`8\30\0 7\30\0h8\30\0(7\30\0p8\30\007\30\0\0\0\353p\240.\353p\0p\0\0>\0@\0x7\30\0\26\0\30\0\2407\30\0\4@\10\0\1\0\0\0\374>\30\0\2043\30\0q\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00944   484   NtReadVirtualMemory  (88, 0x183860, 76, ...  (88, 0x183860, 76, ... "\09\30\0\3007\30\0\109\30\0\3107\30\0\2709\30\0\3207\30\0\0\0_`(;_`\0\320\0\0<\0>\0\308\30\0\24\0\26\0@8\30\0\4@\10\0\1\0\0\0T>\30\0\246\30\0\357\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00945   484   NtReadVirtualMemory  (88, 0x183900, 76, ...  (88, 0x183900, 76, ... "\2509\30\0`8\30\0\2609\30\0h8\30\0\0;\30\0\2709\30\0\0\0\352t\360\24\352t\0\0\1\0<\0>\0\2708\30\0\24\0\26\0\3408\30\0\4@\10\0\1\0\0\0\314;\30\0\3244\30\0\37\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00946   484   NtReadVirtualMemory  (88, 0x1839a8, 76, ...  (88, 0x1839a8, 76, ... "\230:\30\0\09\30\0\240:\30\0\109\30\0\209\30\0p8\30\0\0\0;v\0\26;v\0P\4\0@\0B\0X9\30\0\30\0\32\0\2009\30\0\6@\14\0\1\0\0\0,;\30\0t5\30\0\26\376};\0\0\0\0", 76, ) , 76, ) == 0x0
 00947   484   NtReadVirtualMemory  (88, 0x183a98, 76, ...  (88, 0x183a98, 76, ... "\360:\30\0\2509\30\0\370:\30\0\2609\30\0\250G\30\0\350<\30\0\0\0\317u\344^\317u\0\0\31\0@\0B\0H:\30\0\30\0\32\0p:\30\0\4@\14\0\1\0\0\0\264=\30\0\3542\30\0\27\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00948   484   NtReadVirtualMemory  (88, 0x183af0, 76, ...  (88, 0x183af0, 76, ... "\220;\30\0\230:\30\0\230;\30\0\240:\30\0@<\30\0\209\30\0\0\0\300v\362\276\300v\0\320\2\0<\0>\0\0:\30\0\24\0\26\0(:\30\0\6@\14\0\1\0\0\0pZ\374w\3449\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00949   484   NtReadVirtualMemory  (88, 0x183b90, 76, ...  (88, 0x183b90, 76, ... "0<\30\0\360:\30\08<\30\0\370:\30\0\20@\30\0@<\30\0\0\0\253q\306\26\253q\0P\1\0<\0>\0H;\30\0\24\0\26\0p;\30\0\6@\10\0\7\0\0\0l<\30\0<9\30\01\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00950   484   NtReadVirtualMemory  (88, 0x183c30, 76, ...  (88, 0x183c30, 76, ... "\330<\30\0\220;\30\0\340<\30\0\230;\30\0\240;\30\0\0;\30\0\0\0\252q&\22\252q\0\200\0\0>\0@\0\350;\30\0\26\0\30\0\20<\30\0\6@\14\0\2\0\0\0<@\30\0\314;\30\02\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00951   484   NtReadVirtualMemory  (88, 0x183cd8, 76, ...  (88, 0x183cd8, 76, ... "x=\30\00<\30\0\200=\30\08<\30\0\250:\30\0\210=\30\0\0\0\326v\326/\326v\0P\1\0@\0B\0\210<\30\0\30\0\32\0\260<\30\0\6@\14\0\3\0\0\0\240Z\374w\2746\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00952   484   NtReadVirtualMemory  (88, 0x183d78, 76, ...  (88, 0x183d78, 76, ... "\30>\30\0\330<\30\0 >\30\0\340<\30\0\350<\30\0\330C\30\0\0\0\336v\244\23\336v\0`\2\0<\0>\00=\30\0\24\0\26\0X=\30\0\6@\14\0\1\0\0\0\310Z\374w\324:\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00953   484   NtReadVirtualMemory  (88, 0x183e18, 76, ...  (88, 0x183e18, 76, ... "\300>\30\0x=\30\0\310>\30\0\200=\30\0\370A\30\0\260@\30\0\0\0\324v\240\23\324v\0`\1\0<\0>\0\320=\30\0\24\0\26\0\370=\30\0\6@\14\0\1\0\0\0dJ\30\0\2348\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00954   484   NtReadVirtualMemory  (88, 0x183ec0, 76, ...  (88, 0x183ec0, 76, ... "`?\30\0\30>\30\0h?\30\0 >\30\0\260@\30\0p?\30\0\0\0\344v0\23\344v\0\360\2\0@\0B\0p>\30\0\30\0\32\0\230>\30\0\6@\14\0\1\0\0\0\234?\30\0\3747\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00955   484   NtReadVirtualMemory  (88, 0x183f60, 76, ...  (88, 0x183f60, 76, ... "\0@\30\0\300>\30\0\10@\30\0\310>\30\0\320>\30\0\20@\30\0\0\0\341v}\22\341v\0@\2\0>\0@\0\30?\30\0\26\0\30\0@?\30\0\6@\10\0\1\0\0\0`Z\374w\374>\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00956   484   NtReadVirtualMemory  (88, 0x184000, 76, ...  (88, 0x184000, 76, ... "\240@\30\0`?\30\0\250@\30\0h?\30\0p?\30\0\240;\30\0\0\0\366v\300\20\366v\0\300\2\0>\0@\0\270?\30\0\26\0\30\0\340?\30\0\6@\10\0\1\0\0\0dC\30\0l<\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00957   484   NtReadVirtualMemory  (88, 0x1840a0, 76, ...  (88, 0x1840a0, 76, ... "HA\30\0\0@\30\0PA\30\0\10@\30\0(>\30\0\320>\30\0\0\0\350v\31\24\350v\0\320\0\0>\0@\0X@\30\0\26\0\30\0\200@\30\0\6@\14\0\4\0\0\0\204A\30\0\7\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00958   484   NtReadVirtualMemory  (88, 0x184148, 76, ...  (88, 0x184148, 76, ... "\350A\30\0\240@\30\0\360A\30\0\250@\30\0pD\30\0\230B\30\0\0\0\356v(\25\356v\0p\3\0@\0B\0\370@\30\0\30\0\32\0 A\30\0\6@\14\0\2\0\0\0$B\30\0\334@\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00959   484   NtReadVirtualMemory  (88, 0x1841e8, 76, ...  (88, 0x1841e8, 76, ... "\210B\30\0HA\30\0\220B\30\0PA\30\08C\30\0(>\30\0\0\0\351v\200\21\351v\0\20\1\0<\0>\0\240A\30\0\24\0\26\0\310A\30\0\6@\14\0\2\0\0\0\350Z\374w\204A\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00960   484   NtReadVirtualMemory  (88, 0x184288, 76, ...  (88, 0x184288, 76, ... "(C\30\0\350A\30\00C\30\0\360A\30\0XA\30\08C\30\0\0\0\353v\200\23\353v\0\240\2\0<\0>\0@B\30\0\24\0\26\0hB\30\0\6@\10\0\2\0\0\0\370Z\374wt.\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00961   484   NtReadVirtualMemory  (88, 0x184328, 76, ...  (88, 0x184328, 76, ... "\310C\30\0\210B\30\0\320C\30\0\220B\30\0\230B\30\0\370A\30\0\0\0\264vA\34\264v\0\300\2\0:\0<\0\340B\30\0\22\0\24\0\10C\30\0\6@\14\0\2\0\0\0\4D\30\0<@\30\0\23\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00962   484   NtReadVirtualMemory  (88, 0x1843c8, 76, ...  (88, 0x1843c8, 76, ... "`D\30\0(C\30\0hD\30\00C\30\0\210=\30\0`F\30\0\0\0\332v\33"\333v\0\0\3\0<\0>\0\200C\30\0\24\0\26\0\250C\30\0\6@\14\0\1\0\0\0\234D\30\0dC\30\0\21\376};\330Z\10\0", 76, ) \333v\0\0\3\0<\0>\0\200C\30\0\24\0\26\0\250C\30\0\6@\14\0\1\0\0\0\234D\30\0dC\30\0\21\376};\330Z\10\0", 76, ) == 0x0
 00963   484   NtReadVirtualMemory  (88, 0x184460, 76, ...  (88, 0x184460, 76, ... "\10E\30\0\310C\30\0\20E\30\0\320C\30\0\270E\30\0XA\30\0\0\0\323v\0\0\0\0\0@\0\06\08\0 D\30\0\16\0\20\0HD\30\0\6@\0\0\1\0\0\0\214F\30\0\4D\30\0\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00964   484   NtReadVirtualMemory  (88, 0x184508, 76, ...  (88, 0x184508, 76, ... "\250E\30\0`D\30\0\260E\30\0hD\30\0\0G\30\0\270E\30\0\0\0\330v\240\22\330v\0\240\1\0@\0B\0\270D\30\0\30\0\32\0\340D\30\0\6@\14\0\1\0\0\0\344E\30\0xZ\374w\22\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00965   484   NtReadVirtualMemory  (88, 0x1845a8, 76, ...  (88, 0x1845a8, 76, ... "PF\30\0\10E\30\0XF\30\0\20E\30\0\30E\30\0pD\30\0\0\0\362v\317\22\362v\0P\2\0<\0>\0`E\30\0\24\0\26\0\210E\30\0\6@\14\0\1\0\0\0xZ\374wDE\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00966   484   NtReadVirtualMemory  (88, 0x184650, 76, ...  (88, 0x184650, 76, ... "\360F\30\0\250E\30\0\370F\30\0\260E\30\0\330C\30\0\0G\30\0\0\0\365v\0\0\0\0\0\200\0\0@\0B\0\0F\30\0\30\0\32\0(F\30\0\6@\0\0\3\0\0\0,G\30\0\234D\30\0\21\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00967   484   NtReadVirtualMemory  (88, 0x1846f0, 76, ...  (88, 0x1846f0, 76, ... "\230G\30\0PF\30\0\240G\30\0XF\30\0`F\30\0\30E\30\0\0\06v\240\206v\0\360\0\0<\0>\0\250F\30\0\24\0\26\0\320F\30\0\6@\10\0\5\0\0\0\324G\30\0\214F\30\0\26\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00968   484   NtReadVirtualMemory  (88, 0x184798, 76, ...  (88, 0x184798, 76, ... "@H\30\0\360F\30\0HH\30\0\370F\30\0\240I\30\0\250:\30\0\0\0\263t{\26\263t\0\20\4\0@\0B\0HG\30\0\30\0\32\0pG\30\0\4@\14\0\1\0\0\0\20[\374w,G\30\0\37\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00969   484   NtReadVirtualMemory  (88, 0x184840, 76, ...  (88, 0x184840, 76, ... "\350H\30\0\230G\30\0\360H\30\0\240G\30\08J\30\0\370H\30\0\0\0\260t\6\33\260t\0\0\2\0@\0B\0\360G\30\0\30\0\32\0\30H\30\0\4@\14\0\2\0\0\0\360Z\374wL2\30\0\37\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00970   484   NtReadVirtualMemory  (88, 0x1848e8, 76, ...  (88, 0x1848e8, 76, ... "\220I\30\0@H\30\0\230I\30\0HH\30\0PH\30\0\240I\30\0\0\0\257t\0\21\257t\0\220\0\0@\0B\0\230H\30\0\30\0\32\0\300H\30\0\6@\14\0\2\0\0\0hZ\374wT&\30\0\37\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00971   484   NtReadVirtualMemory  (88, 0x184990, 76, ...  (88, 0x184990, 76, ... "(J\30\0\350H\30\00J\30\0\360H\30\0\370H\30\0\250G\30\0\0\0\255t\37\24\255t\0p\0\0@\0B\0@I\30\0\30\0\32\0hI\30\0\6@\14\0\4\0\0\0\330Z\374w\330Z\374w\37\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00972   484   NtReadVirtualMemory  (88, 0x184a28, 76, ...  (88, 0x184a28, 76, ... "\234\36\30\0\220I\30\0\244\36\30\0\230I\30\0\254\36\30\0PH\30\0\0\0@v:\222@v\0\260\37\06\08\0\350I\30\0\16\0\20\0\20J\30\0\4@\14\0\1\0\0\0\300Z\374wT>\30\0\25\376};\330Z\10\0", 76, ) , 76, ) == 0x0
 00973   484   NtQueryInformationProcess  (88, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1828,ParentPid=1760,}, 0x0, ) == 0x0
 00974   484   NtReadVirtualMemory  (88, 0x7ffdf00c, 4, ...  (88, 0x7ffdf00c, 4, ... "\220\36\30\0", 4, ) , 4, ) == 0x0
 00975   484   NtReadVirtualMemory  (88, 0x181ea4, 4, ...  (88, 0x181ea4, 4, ... "\310\36\30\0", 4, ) , 4, ) == 0x0
 00976   484   NtReadVirtualMemory  (88, 0x181ec0, 76, ...  (88, 0x181ec0, 76, ... "\30\37\30\0\234\36\30\0 \37\30\0\244\36\30\0\0\0\0\0\0\0\0\0\0\0\0\1\22,\1\1\0p\17\0.\00\0\204\5\2\0\30\0\32\0\232\5\2\0\0P\0\0\377\377\0\0\200Z\374w\200Z\374wn\340};\0\0\0\0", 76, ) , 76, ) == 0x0
 00977   484   NtReadVirtualMemory  (88, 0x20584, 48, ...  (88, 0x20584, 48, ... "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0E\0x\0p\0l\0o\0r\0e\0r\0.\0E\0X\0E\0\0\0", 48, ) , 48, ) == 0x0
 00978   484   NtOpenProcess  (0x1f0fff, {24, 0, 0x0, 0, 0, 0x0}, {1828, 0}, ... 92, ) == 0x0
 00979   484   NtCreateSection  (0xf0007, 0x0, {36864, 0}, 4, 134217728, 0, ... 96, ) == 0x0
 00980   484   NtMapViewOfSection  (96, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x830000), {0, 0}, 36864, ) == 0x0
 00981   484   NtMapViewOfSection  (96, 92, (0x0), 0, 0, 0x0, 36864, 1, 0, 4, ... (0x1350000), 0x0, 36864, ) == 0x0
 00982   484   NtAllocateVirtualMemory  (92, 0, 0, 1048576, 8192, 4, ... 23068672, 1048576, ) == 0x0
 00983   484   NtAllocateVirtualMemory  (92, 24109056, 0, 8192, 4096, 4, ... 24109056, 8192, ) == 0x0
 00984   484   NtProtectVirtualMemory  (92, (0x16fe000), 4096, 260, ... (0x16fe000), 4096, 4, ) == 0x0
 00985   484   NtCreateThread  (0x1f03ff, 0x0, 92, 1243172, 1243888, 1, ... 100, {1828, 836}, ) == 0x0
 00986   484   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400}  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0$\7\0\0D\3\0\0" ... {28, 56, reply, 0, 480, 484, 1551, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0$\7\0\0D\3\0\0" )  ... {28, 56, reply, 0, 480, 484, 1551, 0}  (24, {28, 56, new_msg, 0, 1331704, 0, 2010004014, 1331400} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0$\7\0\0D\3\0\0" ... {28, 56, reply, 0, 480, 484, 1551, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0d\0\0\0$\7\0\0D\3\0\0" )  ) == 0x0
 00987   484   NtResumeThread  (100, ... 1, ) == 0x0
 00988   484   NtClose  (100, ... ) == 0x0
 00989   484   NtUnmapViewOfSection  (-1, 0x830000, ... ) == 0x0
 00990   484   NtClose  (96, ... ) == 0x0
 00991   484   NtClose  (92, ... ) == 0x0
 00992   484   NtTerminateProcess  (0, 0, ... ) == 0x0
 00993   484   NtFreeVirtualMemory  (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED
 00994   484   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 480, 484, 1552, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 480, 484, 1552, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 480, 484, 1552, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00995   484   NtTerminateProcess  (-1, 0, ...
 00996   484   NtClose  (44, ... ) == 0x0